@cyanheads/nist-nvd-mcp-server 0.1.3

package/dist/services/nvd-http/nvd-http-client.js

@@ -0,0 +1,175 @@
+/**
+ * @fileoverview HTTP client for the NIST NVD API 2.0 with token-bucket rate limiting.
+ * Manages API key injection, queue-based rate limiting, retry with backoff, and Retry-After header parsing.
+ * @module services/nvd-http/nvd-http-client
+ */
+import { rateLimited, serviceUnavailable, timeout } from '@cyanheads/mcp-ts-core/errors';
+import { withRetry } from '@cyanheads/mcp-ts-core/utils';
+const NVD_BASE_URL = 'https://services.nvd.nist.gov/rest/json';
+/**
+ * Sliding-window rate-limit config per NVD documentation:
+ * - Without API key: 5 requests per 30-second window
+ * - With API key: 50 requests per 30-second window
+ */
+const RATE_LIMIT_WINDOW_MS = 30_000;
+const RATE_LIMIT_WITHOUT_KEY = 5;
+const RATE_LIMIT_WITH_KEY = 50;
+/** Minimum gap between requests in milliseconds derived from window/limit. */
+function minGapMs(hasKey) {
+    const limit = hasKey ? RATE_LIMIT_WITH_KEY : RATE_LIMIT_WITHOUT_KEY;
+    return Math.ceil(RATE_LIMIT_WINDOW_MS / limit);
+}
+export class NvdHttpClient {
+    apiKey;
+    timeoutMs;
+    lastRequestAt = 0;
+    queue = [];
+    draining = false;
+    constructor(apiKey, timeoutMs) {
+        this.apiKey = apiKey;
+        this.timeoutMs = timeoutMs;
+    }
+    /**
+     * Enqueue and execute a request to the NVD API.
+     * Enforces minimum inter-request gap to stay within NVD rate limits.
+     */
+    // biome-ignore lint/suspicious/useAwait: returns Promise via new Promise() constructor — async typing is correct
+    async get(endpoint, params, ctx) {
+        return new Promise((resolve, reject) => {
+            const task = () => {
+                this.executeRequest(endpoint, params, ctx)
+                    .then(resolve)
+                    .catch(reject)
+                    .finally(() => this.drainNext());
+            };
+            this.queue.push(task);
+            if (!this.draining)
+                this.drainNext();
+        });
+    }
+    drainNext() {
+        const task = this.queue.shift();
+        if (!task) {
+            this.draining = false;
+            return;
+        }
+        this.draining = true;
+        const gap = minGapMs(!!this.apiKey);
+        const now = Date.now();
+        const elapsed = now - this.lastRequestAt;
+        const delay = Math.max(0, gap - elapsed);
+        if (delay > 0) {
+            setTimeout(() => {
+                this.lastRequestAt = Date.now();
+                task();
+            }, delay);
+        }
+        else {
+            this.lastRequestAt = Date.now();
+            task();
+        }
+    }
+    // biome-ignore lint/suspicious/useAwait: delegates to withRetry() which returns a Promise — async typing is correct
+    async executeRequest(endpoint, params, ctx) {
+        return withRetry(async () => {
+            const url = this.buildUrl(endpoint, params);
+            ctx.log.debug('NVD API request', { endpoint, url: url.toString() });
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+            // Chain caller's signal
+            const onAbort = () => controller.abort();
+            ctx.signal.addEventListener('abort', onAbort, { once: true });
+            let response;
+            try {
+                response = await fetch(url.toString(), {
+                    headers: this.buildHeaders(),
+                    signal: controller.signal,
+                });
+            }
+            catch (err) {
+                if (err.name === 'AbortError') {
+                    if (ctx.signal.aborted)
+                        throw timeout('NVD request cancelled by caller.');
+                    throw timeout(`NVD request timed out after ${this.timeoutMs}ms.`);
+                }
+                throw serviceUnavailable(`NVD API network error: ${err.message}`, { endpoint }, { cause: err });
+            }
+            finally {
+                clearTimeout(timer);
+                ctx.signal.removeEventListener('abort', onAbort);
+            }
+            if (response.status === 403) {
+                const retryAfter = response.headers.get('Retry-After');
+                throw rateLimited(`NVD rate limit exceeded. ${retryAfter ? `Retry after ${retryAfter}s.` : ''}`, {
+                    reason: 'rate_limited',
+                    retryAfter: retryAfter ? Number(retryAfter) : 30,
+                    recovery: {
+                        hint: 'The NVD rate limit was exceeded. Wait for the retry window to reset or add an API key via NVD_API_KEY.',
+                    },
+                });
+            }
+            if (response.status === 404) {
+                // NVD returns 404 for malformed/invalid request parameters.
+                // Callers translate this to domain-appropriate errors via catch blocks.
+                throw new Error('NVD returned HTTP 404.');
+            }
+            if (!response.ok) {
+                throw serviceUnavailable(`NVD API returned HTTP ${response.status}.`, {
+                    endpoint,
+                    status: response.status,
+                });
+            }
+            const text = await response.text();
+            if (/^\s*<(!DOCTYPE\s+html|html[\s>])/i.test(text)) {
+                throw serviceUnavailable('NVD API returned HTML instead of JSON — likely rate-limited or a temporary outage.');
+            }
+            try {
+                return JSON.parse(text);
+            }
+            catch (err) {
+                throw serviceUnavailable('NVD API returned malformed JSON.', { endpoint }, { cause: err });
+            }
+        }, {
+            operation: `NvdHttpClient.get:${endpoint}`,
+            baseDelayMs: 2_000,
+            signal: ctx.signal,
+        });
+    }
+    buildUrl(endpoint, params) {
+        const url = new URL(`${NVD_BASE_URL}/${endpoint}`);
+        for (const [key, value] of Object.entries(params)) {
+            if (value === undefined || value === null)
+                continue;
+            if (typeof value === 'boolean') {
+                // Boolean flag params are sent without a value (e.g., &hasKev)
+                if (value)
+                    url.searchParams.append(key, '');
+            }
+            else {
+                url.searchParams.set(key, String(value));
+            }
+        }
+        return url;
+    }
+    buildHeaders() {
+        const headers = {
+            Accept: 'application/json',
+        };
+        if (this.apiKey) {
+            headers.apiKey = this.apiKey;
+        }
+        return headers;
+    }
+}
+// --- Init/accessor pattern ---
+let _client;
+export function initNvdHttpClient(apiKey, timeoutMs) {
+    _client = new NvdHttpClient(apiKey, timeoutMs);
+}
+export function getNvdHttpClient() {
+    if (!_client) {
+        throw new Error('NvdHttpClient not initialized — call initNvdHttpClient() in setup()');
+    }
+    return _client;
+}
+//# sourceMappingURL=nvd-http-client.js.map

package/dist/services/nvd-http/nvd-http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-http-client.js","sourceRoot":"","sources":["../../../src/services/nvd-http/nvd-http-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,MAAe;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACpE,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,aAAa;IACP,MAAM,CAAqB;IAC3B,SAAS,CAAS;IAC3B,aAAa,GAAG,CAAC,CAAC;IAClB,KAAK,GAAsB,EAAE,CAAC;IAC9B,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,MAA0B,EAAE,SAAiB;QACvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,iHAAiH;IACjH,KAAK,CAAC,GAAG,CACP,QAAgB,EAChB,MAA6D,EAC7D,GAAY;QAEZ,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,IAAI,CAAC,cAAc,CAAI,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC;qBAC1C,IAAI,CAAC,OAAO,CAAC;qBACb,KAAK,CAAC,MAAM,CAAC;qBACb,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;QAEzC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,cAAc,CAC1B,QAAgB,EAChB,MAA6D,EAC7D,GAAY;QAEZ,OAAO,SAAS,CACd,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEpE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnE,wBAAwB;YACxB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAE9D,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBACrC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;oBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACzC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,MAAM,OAAO,CAAC,+BAA+B,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,kBAAkB,CACtB,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAClD,EAAE,QAAQ,EAAE,EACZ,EAAE,KAAK,EAAE,GAAY,EAAE,CACxB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACvD,MAAM,WAAW,CACf,4BAA4B,UAAU,CAAC,CAAC,CAAC,eAAe,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAC7E;oBACE,MAAM,EAAE,cAAc;oBACtB,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;oBAChD,QAAQ,EAAE;wBACR,IAAI,EAAE,wGAAwG;qBAC/G;iBACF,CACF,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,4DAA4D;gBAC5D,wEAAwE;gBACxE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,kBAAkB,CAAC,yBAAyB,QAAQ,CAAC,MAAM,GAAG,EAAE;oBACpE,QAAQ;oBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,MAAM,kBAAkB,CACtB,oFAAoF,CACrF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,kBAAkB,CACtB,kCAAkC,EAClC,EAAE,QAAQ,EAAE,EACZ,EAAE,KAAK,EAAE,GAAY,EAAE,CACxB,CAAC;YACJ,CAAC;QACH,CAAC,EACD;YACE,SAAS,EAAE,qBAAqB,QAAQ,EAAE;YAC1C,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,QAAgB,EAChB,MAA6D;QAE7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YACpD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,+DAA+D;gBAC/D,IAAI,KAAK;oBAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,gCAAgC;AAEhC,IAAI,OAAkC,CAAC;AAEvC,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,SAAiB;IAC7E,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,91 @@
+{
+  "name": "@cyanheads/nist-nvd-mcp-server",
+  "mcpName": "io.github.cyanheads/nist-nvd-mcp-server",
+  "version": "0.1.3",
+  "description": "Search and audit CVEs by keyword, severity, CWE, CISA KEV status, and CPE via the NIST National Vulnerability Database. STDIO or Streamable HTTP.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "nist-nvd-mcp-server": "dist/index.js"
+  },
+  "files": [
+    "changelog/",
+    "dist/",
+    "README.md",
+    "LICENSE",
+    "CLAUDE.md",
+    "AGENTS.md",
+    "Dockerfile",
+    "server.json"
+  ],
+  "scripts": {
+    "build": "tsx scripts/build.ts",
+    "rebuild": "tsx scripts/clean.ts && tsx scripts/build.ts",
+    "clean": "tsx scripts/clean.ts",
+    "devcheck": "tsx scripts/devcheck.ts",
+    "audit:refresh": "rm -f bun.lock && bun install && bun audit",
+    "tree": "tsx scripts/tree.ts",
+    "list-skills": "tsx scripts/list-skills.ts",
+    "format": "biome check --write --unsafe .",
+    "lint:mcp": "tsx scripts/lint-mcp.ts",
+    "lint:packaging": "tsx scripts/lint-packaging.ts",
+    "bundle": "bun run build && npx -y @anthropic-ai/mcpb pack . dist/nist-nvd-mcp-server.mcpb",
+    "changelog:build": "tsx scripts/build-changelog.ts",
+    "changelog:check": "tsx scripts/build-changelog.ts --check",
+    "test": "vitest run",
+    "start": "node dist/index.js",
+    "start:stdio": "MCP_TRANSPORT_TYPE=stdio node dist/index.js",
+    "start:http": "MCP_TRANSPORT_TYPE=http node dist/index.js"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "typescript",
+    "bun",
+    "stdio",
+    "streamable-http",
+    "nist",
+    "nvd",
+    "cve",
+    "cpe",
+    "vulnerability",
+    "security",
+    "cvss",
+    "cwe",
+    "cisa-kev"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cyanheads/nist-nvd-mcp-server.git"
+  },
+  "homepage": "https://github.com/cyanheads/nist-nvd-mcp-server#readme",
+  "bugs": {
+    "url": "https://github.com/cyanheads/nist-nvd-mcp-server/issues"
+  },
+  "author": "cyanheads <casey@caseyjhand.com> (https://github.com/cyanheads/nist-nvd-mcp-server#readme)",
+  "license": "Apache-2.0",
+  "engines": {
+    "bun": ">=1.3.0",
+    "node": ">=24.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@cyanheads/mcp-ts-core": "^0.9.9",
+    "pino-pretty": "^13.1.3",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.7",
+    "@types/node": "^25.6.0",
+    "depcheck": "^1.4.7",
+    "ignore": "^7.0.5",
+    "tsc-alias": "^1.8.16",
+    "tsx": "^4.19.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  }
+}

package/server.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.cyanheads/nist-nvd-mcp-server",
+  "description": "Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.",
+  "repository": {
+    "url": "https://github.com/cyanheads/nist-nvd-mcp-server",
+    "source": "github"
+  },
+  "version": "0.1.3",
+  "packages": [
+    {
+      "registryType": "npm",
+      "registryBaseUrl": "https://registry.npmjs.org",
+      "identifier": "@cyanheads/nist-nvd-mcp-server",
+      "runtimeHint": "bun",
+      "version": "0.1.3",
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "run"
+        },
+        {
+          "type": "positional",
+          "value": "start:stdio"
+        }
+      ],
+      "environmentVariables": [
+        {
+          "name": "NVD_API_KEY",
+          "description": "NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key.",
+          "format": "string",
+          "isRequired": false
+        },
+        {
+          "name": "NVD_REQUEST_TIMEOUT_MS",
+          "description": "Per-request timeout in milliseconds. Raise to 60000 when using nvd_get_cve_history without an API key.",
+          "format": "string",
+          "isRequired": false,
+          "default": "10000"
+        },
+        {
+          "name": "MCP_LOG_LEVEL",
+          "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').",
+          "format": "string",
+          "isRequired": false,
+          "default": "info"
+        }
+      ],
+      "transport": {
+        "type": "stdio"
+      }
+    },
+    {
+      "registryType": "npm",
+      "registryBaseUrl": "https://registry.npmjs.org",
+      "identifier": "@cyanheads/nist-nvd-mcp-server",
+      "runtimeHint": "bun",
+      "version": "0.1.3",
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "run"
+        },
+        {
+          "type": "positional",
+          "value": "start:http"
+        }
+      ],
+      "environmentVariables": [
+        {
+          "name": "NVD_API_KEY",
+          "description": "NVD API key. Without it, rate limit is 5 req/30s; with it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key.",
+          "format": "string",
+          "isRequired": false
+        },
+        {
+          "name": "NVD_REQUEST_TIMEOUT_MS",
+          "description": "Per-request timeout in milliseconds. Raise to 60000 when using nvd_get_cve_history without an API key.",
+          "format": "string",
+          "isRequired": false,
+          "default": "10000"
+        },
+        {
+          "name": "MCP_HTTP_HOST",
+          "description": "The hostname for the HTTP server.",
+          "format": "string",
+          "isRequired": false,
+          "default": "127.0.0.1"
+        },
+        {
+          "name": "MCP_HTTP_PORT",
+          "description": "The port to run the HTTP server on.",
+          "format": "string",
+          "isRequired": false,
+          "default": "3010"
+        },
+        {
+          "name": "MCP_HTTP_ENDPOINT_PATH",
+          "description": "The endpoint path for the MCP server.",
+          "format": "string",
+          "isRequired": false,
+          "default": "/mcp"
+        },
+        {
+          "name": "MCP_AUTH_MODE",
+          "description": "Authentication mode to use: 'none', 'jwt', or 'oauth'.",
+          "format": "string",
+          "isRequired": false,
+          "default": "none"
+        },
+        {
+          "name": "MCP_LOG_LEVEL",
+          "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').",
+          "format": "string",
+          "isRequired": false,
+          "default": "info"
+        }
+      ],
+      "transport": {
+        "type": "streamable-http",
+        "url": "http://localhost:3010/mcp"
+      }
+    }
+  ]
+}