CVSS Calculator MCP

io.github.alfa-rezaPublished by GitHub account alfa-rezav1.0.0Updated Nov 1, 2026

Calculate and validate CVSS 2.0, 3.0, 3.1, and 4.0 base scores.

The publisher's own server: Calculator Tools MCP

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Server details

Identifier: io.github.alfa-reza/cvss-calculator-mcp
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Nov 1, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account alfa-reza for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.alfa-reza%2Fcvss-calculator-mcp.svg)](https://sourceweft.com/mcp/io.github.alfa-reza%2Fcvss-calculator-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A single-tool MCP server that computes CVSS 2.0, 3.0, 3.1 and 4.0 Base scores and severity from a vector string, usable remotely or locally.

What you can do: Calculate a CVSS Base score and severity from a complete vector string for versions 2.0, 3.0, 3.1 or 4.0
Work with the individual metric fields of each version, such as AV, AC, PR, UI, S and C/I/A
Validate that a supplied vector is complete and well formed before scoring
When to use it: Useful when an assistant needs to turn a CVSS vector into a numeric score and severity rating during vulnerability triage, report writing or ticket enrichment, without doing the formula by hand.
Requirements: Either the free remote Streamable HTTP endpoint, which needs no installation or API key, or a local binary installed via the install script, GitHub Releases or go install (Go 1.25+), placed on the PATH and run as a stdio command.

Before you install

The remote endpoint is rate limited to 5 requests per minute per IP address, so heavy use should switch to the local binary. The install script pipes a remote script into a shell, so review it before running. Only complete Base vectors are supported; there are no CVE lookups or vulnerability scanning.

Installation

In SourceWeft

Open CVSS Calculator MCP in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.alfa-reza%2Fcvss-calculator-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "cvss-calculator": {
      "type": "http",
      "url": "https://cvss.my.id/mcp"
    }
  }
}

README

CVSS Calculator MCP

A lightweight CVSS Base Score calculator for AI agents, built with Go.

[Version 1.0.0] [Go version] [CI status] [License] [MCP]

Website · MCP Registry · LobeHub · Glama Server · Glama Connector

Calculate and validate CVSS 2.0, 3.0, 3.1, and 4.0 Base Scores through a single MCP tool: calculate_cvss. Supports local stdio and remote Streamable HTTP.

Quick Start

Option 1 — Install Locally

Linux / macOS:

Add the installed binary to your MCP client (choose one):

bash

# Claude Codeclaude mcp add --scope user cvss-calculator -- cvss-calculator-mcp
# Codexcodex mcp add cvss-calculator -- cvss-calculator-mcp
# OpenCode v2opencode mcp add cvss-calculator --global -- cvss-calculator-mcp

# Claude Codeclaude mcp add --scope user cvss-calculator -- cvss-calculator-mcp
# Codexcodex mcp add cvss-calculator -- cvss-calculator-mcp
# OpenCode v2opencode mcp add cvss-calculator --global -- cvss-calculator-mcp

Also available via GitHub Releases (including Windows) or go install github.com/alfa-reza/cvss-calculator-mcp/cmd/cvss-calculator-mcp@latest (Go 1.25+). Ensure the binary is in your PATH.

Option 2 — Free Remote MCP

No installation or API key required. Connect to https://cvss.my.id/mcp:

bash

# Claude Codeclaude mcp add --scope user --transport http cvss-calculator https://cvss.my.id/mcp
# Codexcodex mcp add cvss-calculator --url https://cvss.my.id/mcp
# OpenCode v2opencode mcp add cvss-calculator --global --url https://cvss.my.id/mcp

# Claude Codeclaude mcp add --scope user --transport http cvss-calculator https://cvss.my.id/mcp
# Codexcodex mcp add cvss-calculator --url https://cvss.my.id/mcp
# OpenCode v2opencode mcp add cvss-calculator --global --url https://cvss.my.id/mcp

Rate limit: 5 requests per minute per IP address. Use the local option to avoid this shared-service limit.

Other MCP clients (Cursor, Claude Desktop, VS Code, etc.)

Use cvss-calculator-mcp as a local stdio command, or https://cvss.my.id/mcp as a remote Streamable HTTP endpoint. Configuration formats depend on the client.

Cursor / Claude Desktop — local configuration (mcpServers):

For Cursor remote, use "url": "https://cvss.my.id/mcp" instead of the command entry.

VS Code — remote configuration (.vscode/mcp.json):

See the client documentation for configuration locations and setup: Cursor · Claude Desktop · VS Code.

Usage

Ask your connected AI assistant:

Calculate the CVSS 3.1 Base Score for CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The calculate_cvss tool accepts version and vector, returning a score and severity (for this example, 9.8 — Critical). Only complete Base vectors are supported; no CVE lookups or vulnerability scanning.

Self-Hosting

The Go binary uses stdio by default. For Streamable HTTP, run cvss-calculator-mcp --transport http (listens on 127.0.0.1:43871/mcp by default; customize with --listen).

License

Apache-2.0. CVSS is maintained by FIRST; this project is independent of FIRST.

Source: README.md at commit 7ef6278

Tools

calculate_cvss

Calculate a CVSS Base-only score for 2.0, 3.0, 3.1 or 4.0. Supply every metric; never guess. v2: AV Access Vector, AC Access Complexity, Au Authentication, C/I/A Confidentiality/Integrity/Availability. v3: AV Attack Vector, AC Attack Complexity, PR Privileges Required, UI User Interaction, S Scope, C/I/A impact. v4: AT Attack Requirements, VC/VI/VA Vulnerable System impact, SC/SI/SA Subsequent System impact. Rejects non-Base metrics.

Parametersvectorrequiredversionrequired

Version history

v1.0.0LatestNov 1, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.