# CIRCL CVE SEARCH MCP Server

A Model Context Protocol (MCP) server for accessing CIRCL's [Vulnerability-Lookup](https://vulnerability.circl.lu) platform, providing comprehensive, cross-source vulnerability and security information.

> This server previously used the legacy `cve.circl.lu` cve-search API. CIRCL has
> superseded that service with Vulnerability-Lookup, so this server now talks to
> `https://vulnerability.circl.lu/api`.

## Features

This MCP server provides reliable tools to access:

- **CVE Information**: Get detailed information about specific Common Vulnerabilities and Exposures
- **Vendor Browsing**: Browse known products for a vendor to discover security issues in specific vendors' products
- **CWE Information**: Get Common Weakness Enumeration information for understanding vulnerability types
- **CAPEC Information**: Get Common Attack Pattern Enumeration and Classification data for understanding attack methods
- **Recent Vulnerabilities**: Get the most recently published/updated vulnerabilities, correlated across all sources tracked by the platform

## Key Improvements

- **Retry Logic**: Automatic retry with exponential backoff for reliable API calls
- **Enhanced Formatting**: Structured, readable response formatting with key information highlighted
- **Better Error Handling**: Clear, actionable error messages with troubleshooting guidance
- **Input Validation**: Comprehensive validation and sanitization of all inputs

## Installation

```bash
npm install @cyreslab/circl-cve-search-mcp-server
```

## Usage

Add this server to your MCP client configuration:

```json
{
  "mcpServers": {
    "circl-cve-search": {
      "command": "npx",
      "args": ["@cyreslab/circl-cve-search-mcp-server"]
    }
  }
}
```

## Available Tools

### get_cve
Get detailed information about a specific CVE by its ID.

**Parameters:**
- `cve_id` (required): CVE identifier (e.g., "CVE-2021-44228")

**Example:**
```json
{
  "name": "get_cve",
  "arguments": {
    "cve_id": "CVE-2021-44228"
  }
}
```

**Response Format:**
- Structured CVE data with key information highlighted
- Summary, publication dates, CVSS scores
- Associated weakness types (CWE) and reference counts
- Full raw data for detailed analysis

### browse_vendor
Browse known products for a vendor, sorted by most recent vulnerability activity.

**Parameters:**
- `vendor` (required): Vendor name (e.g., "apache", "microsoft", "google")
- `limit` (optional): Number of results to return (default: 10, max: 50)

**Example:**
```json
{
  "name": "browse_vendor",
  "arguments": {
    "vendor": "apache",
    "limit": 15
  }
}
```

**Response Format:**
- List of known products for the specified vendor, each with a last-change timestamp
- Total count and displayed count
- Vendor name normalization

### get_cwe
Get Common Weakness Enumeration (CWE) information by ID.

**Parameters:**
- `cwe_id` (required): CWE identifier (e.g., "CWE-79", "CWE-89")

**Example:**
```json
{
  "name": "get_cwe",
  "arguments": {
    "cwe_id": "CWE-79"
  }
}
```

**Response Format:**
- CWE name and detailed description
- Extended descriptions and weakness ordinalities
- Likelihood of exploit information
- Full raw data for comprehensive analysis

### get_capec
Get Common Attack Pattern Enumeration and Classification (CAPEC) information by ID.

**Parameters:**
- `capec_id` (required): CAPEC identifier (e.g., "CAPEC-66", "CAPEC-89")

**Example:**
```json
{
  "name": "get_capec",
  "arguments": {
    "capec_id": "CAPEC-66"
  }
}
```

**Response Format:**
- Attack pattern name and description
- Typical severity and likelihood of attack
- Prerequisites and related weaknesses
- Complete raw data for in-depth analysis

### get_recent_vulnerabilities
Get the most recently published/updated vulnerabilities, correlated across all sources tracked by the platform (e.g. NVD, GitHub, PySec, GSD, CSAF advisories from various vendors).

**Parameters:**
- `limit` (optional): Number of results to return (default: 10, max: 50)

**Example:**
```json
{
  "name": "get_recent_vulnerabilities",
  "arguments": {
    "limit": 10
  }
}
```

**Response Format:**
- List of recently changed vulnerabilities, normalized across the platform's different native record formats (OSV-style records, CVE 5.x records, and CSAF advisories)
- Identifier(s), publication/modification dates, a truncated summary, severity, and reference count for each

## Data Source

This server uses CIRCL's [Vulnerability-Lookup platform](https://vulnerability.circl.lu/api/), which superseded the legacy cve-search service formerly hosted at `cve.circl.lu`. It provides:
- Cross-source correlated vulnerability data (NVD, GitHub, PySec, GSD, CSAF advisories from various vendors, and more)
- Common Platform Enumeration (CPE) information
- Common Weakness Enumeration (CWE) data
- Common Attack Pattern Enumeration and Classification (CAPEC) data
- Continuous updates with the latest vulnerability information

## Rate Limiting

The CIRCL Vulnerability-Lookup API is free to use and doesn't require authentication. However, please use it responsibly and avoid making excessive requests that could impact the service.

## Error Handling

The server handles various error conditions:
- Invalid CVE/CWE/CAPEC ID formats
- Empty search queries
- API rate limiting
- Network errors
- Invalid parameters

## Development

### Building
```bash
npm run build
```

### Running in Development
```bash
npm run dev
```

## License

MIT License - see LICENSE file for details.

## Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

## Support

For issues and questions:
- GitHub Issues: [Report an issue](https://github.com/cyreslab/circl-cve-search-mcp-server/issues)
- CIRCL Vulnerability-Lookup API Documentation: https://vulnerability.circl.lu/api/