Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/nist-nvd-mcp-server/issues.md or /mcp/nist-nvd-mcp-server/issues.json, or Pod over MCP.

Reported issues for nist-nvd-mcp-server

Pod holds 18 of 44 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to nist-nvd-mcp-server.

Most discussed

feat(nvd_search_cves): signal that more results remain on a partial page

nvd_search_cves gives a caller no indication that more results exist beyond the page it just returned. nvd_search_cpes does:

// src/mcp-server/tools/definitions/nvd-search-cpes.tool.ts:170
} else if (result.totalResults > result.offset + result.returned) {
  ctx.enrich.notice(
    `Results truncated — ${result.totalResults} entries match; set offset to ${result.offset + result.returned} for the next page.`,
  );
}

The CVE search tool emits total and offset in its enrichment b

Read the thread · 2026-07-27 · closed · 3 comments

bug(nvd_search_cves): empty page always reported as "offset past the end", whatever the offset

Server version

0.1.16

mcp-ts-core version

0.11.0

Runtime

Bun

Runtime version

Bun 1.3.x

Transport

stdio

Description

nvd_search_cves emits the past-the-end pagination notice for any empty page where totalResults > 0, without checking whether the offset is actually past the end:

// src/mcp-server/tools/definitions/nvd-search-cves.tool.ts:493
if (result.cves.length === 0) {
  if (result.totalResults > 0) {
    ctx.enrich.notice(
      `Offset ${result.

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/34) · 2026-07-27 · closed · 3 comments

### feat(enrichment): surface active filter context in nvd_search_cves and nvd_audit_cpe

Two tools omit active filter context needed to diagnose zero-result or unexpectedly-narrow result sets without re-reading the caller's own input.

**nvd_search_cves** — a zero-result response reports the query's totals but not which filter (keyword, severity/severityVersion, CWE, date range, KEV-only) drove the result to empty.

**nvd_audit_cpe** — when `severityMin` is active, the response reports `totalCount` (NVD's pre-filter count) and `returned` (post-filter count) with no explanation of th

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/19) · 2026-05-29 · closed · 3 comments

### refactor(nvd_get_cve): brief mode rebuilds toBriefCve's row shape inline

`nvd_get_cve`'s `brief: true` branch hand-builds each row instead of calling the service's `toBriefCve()`, so two places construct the same shape:

```ts
// src/mcp-server/tools/definitions/nvd-get-cve.tool.ts:139
cves: result.cves.map((cve) => {
  const description = briefDescription(cve.descriptions);
  return {
    cveId: cve.cveId,
    vulnStatus: cve.vulnStatus,
    published: cve.published,
    ...(description && { description }),
    ...(cve.severity && { severity: cve.severity }),
    ..

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/35) · 2026-07-27 · closed · 2 comments

### bug(nvd-cve-service): invalid_cve_id_format and cve_not_found ship no recovery hint

### Server version

0.1.14

### mcp-ts-core version

0.10.14

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

http

### Description

`nvd_get_cve` and `nvd_get_cve_history` declare `recovery` text for `invalid_cve_id_format` and `cve_not_found`, but neither reaches the caller. Both are thrown from `NvdCveService` via bare `validationError()` / `notFound()` rather than `ctx.fail`, so `data.recovery.hint` is never populated and no `Recovery:` line is mirrored into `content[]`.

E

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/33) · 2026-07-27 · closed · 2 comments

### feat(nvd_search_cves): include a description snippet on each result row

`nvd_search_cves` result rows carry `cveId`, `vulnStatus`, `published`, `severity`, and the CISA KEV name — no prose. A keyword search returns identifiers with nothing describing what any of them are, so picking which CVEs matter requires a follow-up `nvd_get_cve` on candidates chosen essentially at random.

## Proposal

Add a truncated English description to `BriefCveRecord`, rendered in both `structuredContent` and `format()`. The data is already in hand: `searchCves` calls `normalizeCve` on e

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/32) · 2026-07-27 · closed · 2 comments

### bug(nvd_audit_cpe, nvd_search_cpes): no offset parameter — results past the first page are unreachable

### Server version

0.1.14

### mcp-ts-core version

0.10.14

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

http

### Description

`nvd_audit_cpe` and `nvd_search_cpes` both report a `totalCount` far exceeding what they return, and neither exposes an `offset`. Both services hardcode `startIndex: 0`, so the only lever is `limit` — and past its ceiling the remainder is unreachable by any input. `nvd_search_cves` and `nvd_get_cve_history` both take `offset`; these two are the ou

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/31) · 2026-07-27 · closed · 2 comments

### bug(nvd_get_cve): format() omits CPE configurations, most references, and non-English descriptions

### Server version

0.1.14

### mcp-ts-core version

0.10.14

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

http

### Description

`nvd_get_cve`'s `format()` drops data that `structuredContent` carries. Clients that forward `content[]` rather than `structuredContent` see a materially different record, and none of the dropped data is retrievable through any other tool or parameter.

Three separate omissions in the same formatter:

| Data | structuredContent | content[] |
|:---

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/30) · 2026-07-27 · closed · 2 comments

## Most recent

### feat(nvd_get_cve, nvd_audit_cpe): resolve NVD source identifiers instead of emitting raw GUIDs

### Use case

`weaknesses[].source` and `references[].source` carry NVD's raw source identifier. For a CNA-contributed entry that is a readable email (`security@apache.org`, `product-security@apple.com`), but the two most common contributors on modern records are opaque GUIDs:

| Identifier | Resolves to |
|:---|:---|
| `af854a3a-2127-422b-91ae-364da2661108` | `CVE` (MITRE's CVE Program ADP) |
| `134c704f-9b21-4f2e-91b3-4a467353bcc0` | `CISA-ADP` |

Across a 34-CVE `nvd_get_cve` full-mode call, 

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/46) · 2026-07-31 · closed · 1 comment

### bug(nvd_audit_cpe, nvd_search_cpes): NVD's CPE parameter rejection surfaces as nvd_request_rejected with no recovery hint

### Server version

0.1.17

### mcp-ts-core version

0.11.0

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

HTTP (Streamable HTTP)

### OS

macOS 26.1

### Description

`nvd_audit_cpe` and `nvd_search_cpes` validate that a CPE string starts with `cpe:2.3:` and stop there. A string that clears that prefix check but is not a complete CPE — `cpe:2.3:a:zzznotavendor` — reaches NVD, which answers HTTP 404 with `Invalid cpeName parameter, see documentation.` when passed as `cpeName`

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/45) · 2026-07-31 · closed · 1 comment

### feat(nvd_search_cves): expose NVD's keywordExactMatch for phrase search

### Use case

`keyword` maps to NVD's `keywordSearch`, which ANDs the supplied words and matches them anywhere in a description independently. The parameter description already states this ("AND-semantics across words") but the tool exposes no way to opt out, so a multi-word phrase cannot be searched as a phrase.

NVD's `keywordExactMatch` flag switches the same parameter to exact-phrase matching. It is a valueless flag on `cves/2.0`, alongside `hasKev` and `noRejected`, both of which this serve

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/44) · 2026-07-31 · closed · 1 comment

### docs(design): error contracts documented as InvalidParams; the wire returns ValidationError

### Server version

0.1.17

### mcp-ts-core version

0.11.0

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

HTTP (Streamable HTTP)

### OS

macOS 26.1

### Description

`docs/design.md` documents every validation failure as `InvalidParams`, in both the tool summary table (lines 9–13) and the per-tool error contract blocks (lines 244, 292, 295, 345, 348, 351, 393, 429). The definitions use `JsonRpcErrorCode.ValidationError` and the wire returns `-32007`. 0.1.7 changed the contr

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/43) · 2026-07-31 · closed · 1 comment

### feat(nvd_get_cve_history): no notice on an empty or partial page, unlike the other four tools

### Use case

`nvd_get_cve_history` is the only tool of the five with no `notice` field in its enrichment. `nvd_search_cves`, `nvd_search_cpes`, and `nvd_audit_cpe` all distinguish an offset past the end from an empty page inside a range NVD says has matches, and all three name the offset that reaches the next page. History paginates over the same shape and says nothing.

An empty page renders as a bare heading with no explanation:

Change History: CVE-2014-0160


```json
{ "cveId": "C

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/42) · 2026-07-31 · closed · 1 comment

### bug(nvd-cve-service): cpe_not_found ships no recovery hint

### Server version

0.1.17

### mcp-ts-core version

0.11.0

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

HTTP (Streamable HTTP)

### OS

macOS 26.1

### Description

`nvd_audit_cpe` declares a recovery for `cpe_not_found` — "Use nvd_search_cpes to verify the exact CPE name exists in the NVD dictionary before auditing" — but the `notFound(...)` throw in `auditCpe` omits `...ctx.recoveryFor('cpe_not_found')`, so the hint never reaches the wire and `content[0].text` carries no

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/41) · 2026-07-31 · closed · 1 comment

### bug(nvd_audit_cpe): a product with no CVEs errors as cpe_not_found instead of reporting a clean audit

### Server version

0.1.17

### mcp-ts-core version

0.11.0

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

HTTP (Streamable HTTP)

### OS

macOS 26.1

### Description

`auditCpe` throws `cpe_not_found` whenever NVD returns `totalResults === 0` for a `cpeName`, with the message "The CPE may be misspelled or not in NVD." A CPE that exists in the dictionary and simply has no vulnerabilities is indistinguishable from a typo, so the most valuable answer a vulnerability audit can g

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/40) · 2026-07-31 · closed · 1 comment

### bug(nvd-cve-service): CVSS entries scored 0.0 are dropped, and NVD's v2 baseSeverity is read from the wrong path

### Server version

0.1.17

### mcp-ts-core version

0.11.0

### Runtime

Bun

### Runtime version

Bun 1.3.14

### Transport

HTTP (Streamable HTTP)

### OS

macOS 26.1

### Description

`extractCvssScores` in `src/services/nvd-cve/nvd-cve-service.ts` has two defects in the same guard, both reachable on real NVD records.

**1. A base score of `0.0` is discarded.** The guard is `if (!m.cvssData?.baseScore) continue;` — a falsy test, so a legitimate `0.0` is skipped along with a missing score. Ev

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/39) · 2026-07-31 · closed · 1 comment

### docs(nvd_get_cve): advertised item schema describes brief mode only, but brief defaults to false

`nvd_get_cve`'s advertised output item schema names `description` and `cisaVulnerabilityName` — fields that appear only when `brief: true`. Full mode carries `descriptions[]` and `cisaKev` instead, and none of its seven full-record fields are declared at all.

Since `brief` defaults to `false`, a schema-driven client reading the default surface sees two fields it will never receive and none of the ones it will. The item description does say so in prose, and the loose catchall means nothing is re

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/38) · 2026-07-27 · closed · 1 comment

### refactor(nvd_audit_cpe): duplicate CveRecord schema declaration

`nvd_audit_cpe` declares its own `CveRecordSchema` (`src/mcp-server/tools/definitions/nvd-audit-cpe.tool.ts:41`) for the same `CveRecord` domain type that `nvd_get_cve` full mode describes separately. One shape, two independent declarations — they can drift without anything failing.

The brief-row half of this was consolidated in 0.1.17: `BriefCveRecordSchema` now lives in `src/mcp-server/tools/schemas/brief-cve.ts` and both brief surfaces build from it. The full-record shape has no equivalent h

[Read the thread](https://github.com/cyanheads/nist-nvd-mcp-server/issues/37) · 2026-07-27 · closed · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/cyanheads/nist-nvd-mcp-server/issues).