MCP server (stateless streamable-HTTP JSON-RPC, keyless)

Model Context Protocol endpoint for AI agents: POST one JSON-RPC 2.0 message, receive one JSON response, no sessions, no SSE (GET returns 405). Protocol versions 2025-06-18 / 2025-03-26 / 2024-11-05; an MCP-Protocol-Version header is validated when present. Tools (all keyless): get_cve, search_cves, get_updates, get_scoreboard, the same shared libraries as the REST endpoints, so answers never drift from the site. An Authorization: Bearer key is honored for attribution only; an offered-but-invalid key returns a tool error instead of a silent downgrade. Per-IP rate limited (60/min). Machine-readable metadata: /.well-known/mcp/server-card.json.

post/api/mcp

Request

  • Base URL: https://cve-security.com
  • URL: https://cve-security.com/api/mcp
  • Auth: none declared

Request body

object required

A single JSON-RPC 2.0 request, notification, or response (batching is not supported, removed in MCP 2025-06-18).

Response

JSON-RPC 2.0 response. Tool-execution failures are MCP tool results with isError:true; JSON-RPC protocol errors mean the message was malformed.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.