MCP.Market

cve-cache MCP server

by weiseer·io.github.weiseer/cve-cache·v0.1.1
No reviews yet

Recent CVE + GHSA cache for AI agents auditing dependencies (npm/PyPI/Cargo/Maven/Go).

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed cve-cache yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

cve-cache tools (4)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • find_for_package

    All CVEs affecting a package. Optionally filter by ecosystem.

  • list_recent_critical

    Recent CVEs with CVSS >= threshold. Default: 7-day high-severity feed.

  • lookup_cve

    Full record for one CVE by ID. Cited NVD + GHSA URLs.

  • severity_summary

    Counts by severity bucket across the snapshot. Quick agent triage view.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 118 days ago8/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How cve-cache compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 61% of 915 Security servers
Tools
4
the typical Security server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 4 read

Install cve-cache in Claude Code, Cursor or VS Code

Runs npx -y @weiseer/cve-cache-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add cve-cache -- npx -y @weiseer/cve-cache-mcp
Add to Cursor

What the publisher says

From the cve-cache repository's README, as published. We do not edit it. Read it on GitHub

@weiseer/cve-cache-mcp

Recent CVE + GHSA cache as a stdio MCP server.

Probe P-005 by weiseer.

What it does

Cached, structured snapshot of recent CVE + GitHub Security Advisory records — for AI agents auditing dependencies or screening new packages.

Your agent can:

  • lookup_cve — full record for one CVE/GHSA ID
  • findforpackage — all CVEs affecting a package by ecosystem (npm/PyPI/Cargo/Maven/Go)
  • listrecentcritical — recent high-severity CVEs (default: 7-day, CVSS ≥ 7)
  • severity_summary — counts by severity bucket

Why use this instead of your agent querying NVD itself

Install

npm install -g @weiseer/cve-cache-mcp

Use with Claude Desktop / Cursor / Cline / Continue / Windsurf

{
  "mcpServers": {
    "cve-cache": {
      "command": "npx",
      "args": ["-y", "@weiseer/cve-cache-mcp"]
    }
  }
}

License

Apache-2.0. Catalog data: derived from public CVE/NVD/GHSA feeds (CC0/public domain).

Nothing above is checked by us. What we check is on the safety report.

cve-cache: common questions

Is cve-cache MCP server safe?
Mostly: it is graded B (78/100). Read the cve-cache safety report
How do I install cve-cache?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does cve-cache need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is cve-cache maintained?
The last commit was 156 days ago (2026-06-01). The latest release is v0.1.1.
What can I use instead of cve-cache?
Servers from other publishers that do the same job: Dependency Auditor MCP server, Dependency Auditor MCP server and Dep Scope MCP server.
How does cve-cache compare with other Security MCP servers?
safety score 78/100 (higher than 61% of 915 Security servers); tools 4 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to cve-cache

Same job from other publishers: the closest match first, then the best rated.

  • Dependency Auditor
    CVE scanning for npm/pip/cargo dependencies via OSV
    A
  • Dependency Auditor
    CVE scanning for npm/pip/cargo dependencies via OSV
    A
  • Dep Scope
    Symbol-level npm dependency analysis: scan verdicts, native alternatives, migration prompts.
    A
  • npm Registry MCP Server
    npm registry MCP server — package intelligence, security audits, dependency analysis
    B
  • SafeWeave
    Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
    C

More from weiseer →