CVE Security

CVE Security MCP API

The Mcp API from CVE Security — 1 operation(s) for mcp.

Documentation GitHub OpenAPI

Operations 1

POST /api/mcp MCP server for assistants (stateless streamable-HTTP JSON-RPC, keyless) #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/cve-security-com:cve-security-com-mcp-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Cve Security Com MCP API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Mcp across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: MCP
paths:
  /api/mcp:
    post:
      operationId: mcp
      summary: MCP server for assistants (stateless streamable-HTTP JSON-RPC, keyless)
      description: 'Model Context Protocol endpoint for assistants working with a person: POST one JSON-RPC 2.0 message, receive one JSON response, no sessions, no SSE (GET returns 405). Protocol versions 2025-06-18 / 2025-03-26 / 2024-11-05; an MCP-Protocol-Version header is validated when present. Tools (all keyless): get_cve, search_cves, query_package, get_updates, get_scoreboard, get_epss_movers, get_sightings, get_chains and table1_read, built on the same shared libraries as the REST endpoints, so answers match the site. A keyless caller gets 100 tool calls per UTC day, and a call past that returns the tool error daily_budget_exceeded; a network Cloudflare verifies as an AI assistant or AI search service shares a pool of 5,000 calls a day. get_updates covers the last 30 days unless scoped to one CVE, get_sightings and get_chains return up to 50 rows and search_cves stops at page 5. An Authorization: Bearer key is honored for attribution and counts calls against the key''s daily limit in place of the budget; an offered-but-invalid key returns a tool error instead of a silent downgrade. Per-IP rate limited (60/min). Machine-readable metadata: /.well-known/mcp/server-card.json.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: A single JSON-RPC 2.0 request, notification, or response (batching is not supported, removed in MCP 2025-06-18).
      responses:
        '200':
          description: JSON-RPC 2.0 response. Tool-execution failures are MCP tool results with isError:true; JSON-RPC protocol errors mean the message was malformed.
          content:
            application/json:
              schema:
                type: object
        '202':
          description: Notification or client-to-server response accepted (no body)
        '400':
          description: Unsupported MCP-Protocol-Version header
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (Retry-After header)
      tags:
      - MCP
    servers:
    - url: https://cve-security.com
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
        detail:
          type: string
      required:
      - error
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml