---
title: "MCP server (stateless streamable-HTTP JSON-RPC, keyless)"
method: POST
path: "/api/mcp"
---

# MCP server (stateless streamable-HTTP JSON-RPC, keyless)

`POST /api/mcp`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/mcp`
- Auth: none declared

Model Context Protocol endpoint for AI agents: POST one JSON-RPC 2.0 message, receive one JSON response, no sessions, no SSE (GET returns 405). Protocol versions 2025-06-18 / 2025-03-26 / 2024-11-05; an MCP-Protocol-Version header is validated when present. Tools (all keyless): get_cve, search_cves, get_updates, get_scoreboard, the same shared libraries as the REST endpoints, so answers never drift from the site. An Authorization: Bearer key is honored for attribution only; an offered-but-invalid key returns a tool error instead of a silent downgrade. Per-IP rate limited (60/min). Machine-readable metadata: /.well-known/mcp/server-card.json.

## Request body

- object: A single JSON-RPC 2.0 request, notification, or response (batching is not supported, removed in MCP 2025-06-18).

## Response `200`

JSON-RPC 2.0 response. Tool-execution failures are MCP tool results with isError:true; JSON-RPC protocol errors mean the message was malformed.

- object

## Other responses

- `202`: Notification or client-to-server response accepted (no body)
- `400`: Unsupported MCP-Protocol-Version header
- `429`: Rate limited (Retry-After header)

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)