How do I get higher rate limits for the NVD API?

You can enter your own NIST NVD API key within the MCP settings to increase your allowed request frequency.

Which AI clients can use this MCP?

This MCP works with any compatible client, including Claude, Cursor, Windsurf, and VS Code.

Can I search for vulnerabilities by severity?

Yes, you can ask your agent to filter CVEs based on their CVSS V3 severity levels, from Low to Critical.

What is a CPE string?

A CPE (Common Platform Enumeration) string is a standardized identifier used to name software and hardware products in the NVD.

Does Vinkius host this MCP?

Yes, Vinkius hosts and manages the MCP, so it is ready to use immediately after you connect your client.

Is an API Key mandatory?

No. The NVD API allows public access without a key. However, using a key increases your rate limit significantly (up to 50 requests per 30 seconds).

How far back can I search for vulnerabilities?

The NVD contains vulnerabilities dating back to the late 1990s. You can search the entire database by ID or keyword.

An astronaut overseeing a futuristic data hub

Download PDF Markdown Version

Connect NIST NVD to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Pull authoritative security intelligence directly into your AI agent.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through NIST NVD.

01
Search cve by cwe
Find CVEs by their associated Common Weakness Enumeration (CWE) identifier.
02
Search cve by date
Locate CVEs based on their specific publication dates.
03
Search cve by keyword
Search the CVE database using specific keywords.
04
List cpe matches
Retrieve a list of valid CPE match strings for products.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through NIST NVD.

05
Get cpe by ID
Get a specific entry from the CPE dictionary using its UUID.
06
Get cve by ID
Pull full details for a specific CVE using its unique ID.
07
Get cve change history
Get a log of all updates and modifications made to a CVE record.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through NIST NVD.

08
Search cpe by keyword
Search the official product dictionary using keywords.
09
Search cve by cpe
Find all CVEs associated with a specific product via its CPE string.
10
Search cve by severity
Filter the CVE database by CVSS severity levels.

Real work

What teams actually run

Vulnerability Scanning

Ask your agent to check if a specific software version in your stack has any known CVEs.

Threat Intelligence

Monitor recent security updates by asking for CVEs published within a specific timeframe.

Risk Assessment

Filter a list of vulnerabilities by 'Critical' severity to prioritize what to patch first.

Product Identification

Find the exact CPE string for a piece of hardware or software to ensure accurate vulnerability matching.

Automate a task

Put NIST NVD to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

NIST NVD works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

Building your own app? The connector is yours to use.

You don't need a client to put NIST NVD to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

1056ms average. Fast in production.

NIST NVD is checked daily against the live service.

Daily averagePeak 1230ms

Oct 11Today

Fastest day: 830ms
Slowest day: 1230ms
14-day trend: Slowing+24%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of NIST NVD, so you can see the experience inside your AI.

It does not authenticate your account with NIST NVD. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

NIST NVD Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_di1FzaR2p54s3bOkX9Kq05itOme6MTw3QnOWExLr/mcp

Claude Desktop

Follow the steps below to connect in seconds.

1In Claude Desktop, open Settings → Connectors.
2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
3Click Add and start a new chat — NIST NVD capabilities are ready to use.

Configuration · claude_desktop_config.jsonCopy

{
  "mcpServers": {
    "nist-nvd-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_di1FzaR2p54s3bOkX9Kq05itOme6MTw3QnOWExLr/mcp"
    }
  }
}

Claude
ChatGPT
Cursor
VS Code
Windsurf
Claude Code
JetBrains
Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up NIST NVD in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work NIST NVD owners hand off.

This MCP is built for professionals who need to bridge the gap between raw vulnerability data and actionable security decisions.

01
Security Analysts
They hand off the task of retrieving CVE details and CVSS scores to the agent for rapid risk assessment.
02
DevOps Engineers
They use the agent to monitor for new vulnerabilities that impact their specific software stack.
03
Compliance Officers
They use the agent to gather vulnerability data for security audits and reporting.

FAQ

Questions NIST NVD owners ask.

01
How do I get higher rate limits for the NVD API?
You can enter your own NIST NVD API key within the MCP settings to increase your allowed request frequency.
02
Which AI clients can use this MCP?
This MCP works with any compatible client, including Claude, Cursor, Windsurf, and VS Code.
03
Can I search for vulnerabilities by severity?
Yes, you can ask your agent to filter CVEs based on their CVSS V3 severity levels, from Low to Critical.
04
What is a CPE string?
A CPE (Common Platform Enumeration) string is a standardized identifier used to name software and hardware products in the NVD.
05
Does Vinkius host this MCP?
Yes, Vinkius hosts and manages the MCP, so it is ready to use immediately after you connect your client.
06
Is an API Key mandatory?
No. The NVD API allows public access without a key. However, using a key increases your rate limit significantly (up to 50 requests per 30 seconds).
07
How far back can I search for vulnerabilities?
The NVD contains vulnerabilities dating back to the late 1990s. You can search the entire database by ID or keyword.

Explore

More in The Unthinkable

Connect NIST NVD to Claude, Cursor, ChatGPT & more

Your AI does the work. We keep it safe and sound.

Each Connector runs inside its own sealed environment.

One switch stops every agent. Instantly.

Spending limits that pause instead of surprise.

We ship only the actions that matter.

01-04

Search cve by cwe

Search cve by date

Search cve by keyword

List cpe matches

05-07

Get cpe by ID

Get cve by ID

Get cve change history

08-10

Search cpe by keyword

Search cve by cpe

Search cve by severity

What teams actually run

Vulnerability Scanning

Threat Intelligence

Risk Assessment

Product Identification

Building your own app? The connector is yours to use.

NIST NVD Connector

Claude Desktop

Security Analysts

DevOps Engineers

Compliance Officers

How do I get higher rate limits for the NVD API?

Which AI clients can use this MCP?

Can I search for vulnerabilities by severity?

What is a CPE string?

Does Vinkius host this MCP?

Is an API Key mandatory?

How far back can I search for vulnerabilities?

Patchstack Security AI Connector

Halo Security AI Connector

Aikido Security AI Connector

Lacework (Cloud Security & CNAPP) AI Connector

Suggestions

Tenable AI Connector

HackEDU (Security Journey) AI Connector

Contrast Security AI Connector

Trend Micro AI Connector