90/100
Score = points from our five tests (install, handshake, maintenance, docs, license). Not a quality or security rating. Methodology
- Install20/20
- Handshake30/30
- Maintenance25/25
- Docs15/15
- License0/10
Vendor-hosted New / early find
New / early find: first tested 2026-11-02. Sazabi's free cve.now vulnerability feed as a hosted MCP endpoint (https://mcp.cve.now/mcp, no sign-in, 2 tools: execute, search). Repo sazabi/cve.now (docs only, created 2026-10-22, 116 GitHub stars when tested). Real read-only calls (no LLM, no credentials) on an earlier tools/list: get_vulnerability CVE-2021-44228, search for MCP vulnerabilities and check_stack lodash 4.17.20 all returned data. Server source is not public, so license scores 0. get_vulnerability and check_stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical.
Tool-call test (2026-11-02, direct MCP stdio client, no LLM): pass. 3 of 3 read-only calls passed on the live endpoint: get_vulnerability, search and check_stack. No credentials. get_vulnerability and check_stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical. Evidence: live endpoint probe, Nov 2, 2026.
Sazabi-hosted public endpoint, no sign-in. The server source isn't public: github.com/sazabi/cve.now holds docs only (synced from Sazabi's private monorepo). Listed as a hosted remote (Our review, Nov 1, 2026).
Sources: https://cve.now/#mcp · https://github.com/sazabi/cve.now · https://github.com/sazabi/cve.now/commit/028836f8cf
Transport (tested 2026-11-02): Streamable HTTP
Token cost (estimate): approx. 412 tokens, cl100k estimate (2 tools, measured 2026-11-11). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.
Permissions: 1 read, 1 write (state-changing), 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown #
Auth: none. Rate limit: unknown. Pricing unit: unknown.
execute— write (state-changing)search— read
remote handshake listed tools without credentials; no recorded key or OAuth
Score 90/100 · Tools 2 · Token cost approx. 412 tokens (Tool list changed 2026-11-11; count from 2026-11-11 capture) · Compare · Last tested 2026-11-02 · Server version 0.1.0 · Remote endpoint https://mcp.cve.now/mcp (streamable-http)
Summary: cve.now MCP (remote) completed an MCP handshake without credentials and exposed 2 tools.
Evidence summary #
- Handshake
- pass
- Tools listed
- 2
- Context cost
- approx. 412 tokens, cl100k estimate (2 tools, measured 2026-11-11; an estimate) ranking ·add up your servers' context cost Tool list changed 2026-11-11; count from 2026-11-11 capture
- Login
- No key needed for the tools we called
- Tested
- 2026-11-02
Test results #
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers. |
| handshake | pass | 30 | MCP initialize (protocol 2025-06-18, server cve.now 0.1.0) +tools/list over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key. |
| maintenance | pass | 25 | Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC). |
| docs | pass | 15 | official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now). |
| license | fail | 0 | A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service). |
Local-model readiness #
Token cost (estimate): approx. 412 tokens, cl100k estimate for 2 tools · about 5% of an 8k context. This is an estimate from our testing (counted with cl100k_base).
Small-model friendly (schema heuristic, not a model result): unknown.
Not tested #
Small-model task runs: Not yet tested.
What we tested and what we didn't #
Tested on 2026-11-02
- We connected to the vendor's hosted endpoint with no credentials and asked for its tool list: it listed 2 tools (Method details: MCP
initializethentools/list) - Auth response: none. The endpoint answered without any login
- Vendor docs: official MCP docs page; states the endpoint URL; client setup instructions (15/15)
- Maintenance: dated vendor source, dated commit in Sazabi's cve.now docs repo 2026-10-31 (25/25)
- License: a hosted service has no license to cite (0/10)
- Token cost (estimate)
Not tested
- Security: not audited (hosted service; no code to review, no permission or data-flow analysis)
- Behaviour after signing in, or with a real account
- Source code, repository activity or an open-source license (none published for the hosted service)
- Performance, rate limits or load
- Real tasks (no functional task runs yet)
Methodology: how we test (vendor-hosted rule). A high score means it responds and its vendor documents and dates it, not that giving it access to your data carries no risk.
Known security issues #
Not checked (remote-only): hosted endpoint, version unknown.
Monthly roundup: MCP security issues, October 2026.
Tool list changes ↻ Tools changed (breaking) 2026-11-11 #
Tool list changed since last test (2026-11-02 → 2026-11-11): 1 tool added: execute; 4 tools removed: check_stack, get_leaderboard, get_vulnerability, list_feed; 1 input schema changed: search. Confirmed by a re-run with the same arguments.
Show the diff #
- Added:
execute - Removed:
check_stack(breaking) - Removed:
get_leaderboard(breaking) - Removed:
get_vulnerability(breaking) - Removed:
list_feed(breaking) - Changed schema:
search(breaking)
Snapshot hash (fingerprint of the tool list) #
c632f33cd96f: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.
Raw test record (JSON) #
{
"name": "cve-now-remote",
"version": null,
"registry": "remote",
"status": "working",
"tested": "2026-11-02",
"tools_count": 2,
"deprecated": false,
"archived": null,
"tests": {
"install": [
"pass",
20,
"Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers."
],
"handshake": [
"pass",
30,
"MCP `initialize` (protocol 2025-06-18, server cve.now 0.1.0) + `tools/list` over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key."
],
"maintenance": [
"pass",
25,
"Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC)."
],
"docs": [
"pass",
15,
"official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now)."
],
"license": [
"fail",
0,
"A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service)."
]
}
}
Install #
https://mcp.cve.now/mcp
Tools listed #
execute, search
Tool history: captured Nov 11, 2026. All tool history.
Quick config #
{
"mcpServers": {
"cve-now-mcp-remote": {
"type": "http",
"url": "https://mcp.cve.now/mcp"
}
}
}
Add to config Opens the config generator with this server selected.
Setup #
- Install. No install step: it is a remote server at https://mcp.cve.now/mcp.
- Configure. Add the mcpServers entry below to your MCP client config.
- Verify. Restart the client and check that tools/list returns tools (2 in our test).
{
"mcpServers": {
"cve-now-mcp-remote": {
"type": "http",
"url": "https://mcp.cve.now/mcp"
}
}
}
Test history #
- 2026-11-11: Tools changed (breaking)
- 2026-11-02: New
Related: Best dev MCP servers
FAQ #
Is cve.now MCP deprecated?
No. cve-now-remote was not deprecated or archived when we last tested it on 2026-11-02.
What replaces cve.now MCP?
Nothing; cve.now MCP (remote) is not deprecated as of 2026-11-02.
Does cve.now MCP need an API key?
No. It completed an MCP handshake with no credentials and listed 2 tools.
Embed the badge #
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.