cve-cache

io.github.weiseerPublished by GitHub account weiseerv0.1.1Updated Oct 24, 2026

Recent CVE + GHSA cache for AI agents auditing dependencies (npm/PyPI/Cargo/Maven/Go).

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local stdio MCP server serving a cached snapshot of recent CVE and GHSA advisories so an assistant can audit dependencies and screen packages.

What you can do
  • Look up the full record for a single CVE or GHSA identifier
  • Find all advisories affecting a package by ecosystem (npm, PyPI, Cargo, Maven, Go)
  • List recent high-severity CVEs, defaulting to the last 7 days with CVSS 7 or above
  • Summarize advisory counts by severity bucket
When to use it
Useful when an assistant is auditing project dependencies or screening new packages and needs fast, pre-normalized vulnerability data across ecosystems without querying NVD or GHSA directly on every question.
Requirements
Runs locally over stdio, installed from the npm package @weiseer/cve-cache-mcp (Node.js, typically via npx). No authentication is declared. Optional environment variables CVE_CACHE_LOCAL_ONLY to skip remote fetching and CVE_CACHE_URL to override the remote snapshot URL; network access is needed unless local-only mode is set.
Before you install
The data is a cached snapshot, so very recent advisories may be missing; verify critical findings against the original source. Setting CVE_CACHE_URL points the server at a third-party snapshot location, and remote fetching sends requests off the machine. The README mentions a paid option alongside a free one, so check for any cost before relying on it.

Installation

In SourceWeft

  1. Open cve-cache in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@weiseer/cve-cache-mcp

Recent CVE + GHSA cache as a stdio MCP server.

Probe P-005 by weiseer.

What it does

Cached, structured snapshot of recent CVE + GitHub Security Advisory records — for AI agents auditing dependencies or screening new packages.

Your agent can:

  • lookup_cve — full record for one CVE/GHSA ID
  • find_for_package — all CVEs affecting a package by ecosystem (npm/PyPI/Cargo/Maven/Go)
  • list_recent_critical — recent high-severity CVEs (default: 7-day, CVSS ≥ 7)
  • severity_summary — counts by severity bucket

Why use this instead of your agent querying NVD itself

Agent DIYcve-cache
Source queryNVD JSON feeds + GHSA GraphQL1 MCP call
Token cost (NVD records are large)$0.05-0.20$0 free / $0.00005 paid
Latency2-10 seconds<100ms
Cross-ecosystem normalizationPer-source schemaPre-normalized

Install

bash
npm install -g @weiseer/cve-cache-mcp

Use with Claude Desktop / Cursor / Cline / Continue / Windsurf

json
{  "mcpServers": {    "cve-cache": {      "command": "npx",      "args": ["-y", "@weiseer/cve-cache-mcp"]    }  }}

License

Apache-2.0. Catalog data: derived from public CVE/NVD/GHSA feeds (CC0/public domain).

Source: README.md at commit b8bb34f

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.