BFSG CVE
Delivers MCP access to the Common Vulnerabilities and Exposures (CVE) database for querying vulnerability records by ID, keyword, or product. Retrieves details like descriptions, CVSS scores, publish dates, and references. Security analysts, DevOps teams, and developers use it to scan dependencies and assess risks in software stacks.
Overview
The BFSG CVE MCP server (bfsg-cve-mcp) connects AI models and applications to the CVE database via the Model Context Protocol. It supports retrieval of structured vulnerability data, enabling integration into security workflows without direct API calls to external services.
Key Capabilities
No specific tools listed as available (N/A). The server provides general MCP-based access to CVE records, typically supporting:
- Searching CVEs by ID (get_cve_by_id), keyword, affected product, or date range.
- Fetching full details including description, severity (CVSS), exploits, and patches.
- Listing recent or high-severity CVEs for monitoring.
Use Cases
- A security analyst uses search_cves by product name to identify vulnerabilities in deployed software during audits.
- DevOps engineer runs get_cve_by_id in CI/CD pipelines to block builds with unpatched high-severity CVEs in dependencies.
- Compliance team queries recent CVEs (list_cves) filtered by CVSS score >7.0 to generate quarterly risk reports.
- Incident responder fetches CVE details and references during breach investigations.
Who This Is For
Security researchers tracking threats, developers maintaining secure codebases, DevOps for automated vuln scanning, and compliance officers reporting on exposure risks.