{"slug": "tools-changed-breaking-cve-now-mcp-remote", "title": "Tools changed (breaking): cve.now MCP (remote)", "summary": "Sazabi's hosted cve.now MCP endpoint (https://mcp.cve.now/mcp) scored 90/100 in a five-test review first run on 2026-11-02, passing install, handshake, maintenance and docs but scoring 0/10 on license because the server source is not public. The remote server, version 0.1.0, completed an MCP initialize handshake over streamable-http with protocol 2025-06-18 and no credentials, listing 2 tools (execute, a state-changing write, and search, a read) at an estimated context cost of about 412 tokens. The tool list changed on 2026-11-11, when get_vulnerability and check_stack were removed, so the November 2 passing calls to those tools are historical; the docs-only repo sazabi/cve.now had 116 GitHub stars and was not found in the official MCP registry as of 2026-11-02.", "body_md": "# cve.now MCP (remote)\n\n**90**/100\n\nScore = points from our five tests (install, handshake, maintenance, docs, license). Not a quality or security rating. [Methodology](https://testedmcp.com/methodology/)\n\n- Install20/20\n- Handshake30/30\n- Maintenance25/25\n- Docs15/15\n- License0/10\n\nVendor-hosted New / early find\n\nNew / early find: first tested 2026-11-02. Sazabi's free cve.now vulnerability feed as a hosted MCP endpoint (https://mcp.cve.now/mcp, no sign-in, 2 tools: execute, search). Repo sazabi/cve.now (docs only, created 2026-10-22, 116 GitHub stars when tested). Real read-only calls (no LLM, no credentials) on an earlier tools/list: get_vulnerability CVE-2021-44228, search for MCP vulnerabilities and check_stack lodash 4.17.20 all returned data. Server source is not public, so license scores 0. get_vulnerability and check_stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical.\n\nTool-call test (2026-11-02, direct MCP stdio client, no LLM): **pass**. 3 of 3 read-only calls passed on the live endpoint: get_vulnerability, search and check_stack. No credentials. get_vulnerability and check_stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical. Evidence: live endpoint probe, Nov 2, 2026.\n\nSazabi-hosted public endpoint, no sign-in. The server source isn't public: github.com/sazabi/cve.now holds docs only (synced from Sazabi's private monorepo). Listed as a hosted remote (Our review, Nov 1, 2026).\n\nSources: [https://cve.now/#mcp](https://cve.now/#mcp) · [https://github.com/sazabi/cve.now](https://github.com/sazabi/cve.now) · [https://github.com/sazabi/cve.now/commit/028836f8cf](https://github.com/sazabi/cve.now/commit/028836f8cf)\n\n**Transport (tested 2026-11-02):** Streamable HTTP\n\n**Token cost (estimate):** approx. 412 tokens, cl100k estimate (2 tools, measured 2026-11-11). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.\n\n## Permissions: 1 read, 1 write (state-changing), 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown\n\nAuth: none. Rate limit: unknown. Pricing unit: unknown.\n\n- `execute` — write (state-changing)\n- `search` — read\n\nremote handshake listed tools without credentials; no recorded key or OAuth\n\nScore **90/100** · Tools **2** · Token cost **approx. 412 tokens** (Tool list changed 2026-11-11; count from 2026-11-11 capture) · [Compare](https://testedmcp.com/compare/?s=cve-now-mcp-remote) · Last tested **2026-11-02** · Server version `0.1.0` · Remote endpoint `https://mcp.cve.now/mcp` (streamable-http)\n\nSummary: cve.now MCP (remote) completed an MCP handshake without credentials and exposed 2 tools.\n\n## Evidence summary\n\n- Handshake\n- pass\n- Tools listed\n- 2\n- Context cost\n- approx. 412 tokens, cl100k estimate (2 tools, measured 2026-11-11; an estimate) [ranking](https://testedmcp.com/best/lowest-context-cost-mcp-servers/) ·[add up your servers' context cost](https://testedmcp.com/guides/how-much-context-mcp-servers-cost/)\nTool list changed 2026-11-11; count from 2026-11-11 capture\n- Login\n- No key needed for the tools we called\n- Tested\n- 2026-11-02\n\n## Test results\n\n| Test | Result | Points | Evidence | \n|---|---|---|---|\n| install | pass | 20 | Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers. | \n| handshake | pass | 30 | MCP `initialize` (protocol 2025-06-18, server cve.now 0.1.0) +`tools/list` over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key. | \n| maintenance | pass | 25 | Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC). | \n| docs | pass | 15 | official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now). | \n| license | fail | 0 | A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service). | \n\n## Local-model readiness\n\nToken cost (estimate): **approx. 412 tokens, cl100k estimate** for 2 tools · about 5% of an 8k context. This is an estimate from our testing (counted with cl100k_base).\n\nSmall-model friendly (schema heuristic, not a model result): **unknown**.\n\n## Not tested\n\nSmall-model task runs: Not yet tested.\n\n## What we tested and what we didn't\n\n### Tested on 2026-11-02\n\n- We connected to the vendor's hosted endpoint with no credentials and asked for its tool list: it listed 2 tools (Method details: MCP `initialize` then`tools/list` )\n- Auth response: none. The endpoint answered without any login\n- Vendor docs: official MCP docs page; states the endpoint URL; client setup instructions (15/15)\n- Maintenance: dated vendor source, dated commit in Sazabi's cve.now docs repo 2026-10-31 (25/25)\n- License: a hosted service has no license to cite (0/10)\n- Token cost (estimate)\n\n### Not tested\n\n- Security: **not audited** (hosted service; no code to review, no permission or data-flow analysis)\n- Behaviour after signing in, or with a real account\n- Source code, repository activity or an open-source license (none published for the hosted service)\n- Performance, rate limits or load\n- Real tasks (no functional task runs yet)\n\nMethodology: [how we test](https://testedmcp.com/methodology/) (vendor-hosted rule). A high score means it responds and its vendor documents and dates it, not that giving it access to your data carries no risk.\n\n## Known security issues\n\nNot checked (remote-only): hosted endpoint, version unknown.\n\nMonthly roundup: [MCP security issues, October 2026](https://testedmcp.com/security/2026-10/).\n\n## Tool list changes ↻ Tools changed (breaking) 2026-11-11\n\n**Tool list changed since last test (2026-11-02 → 2026-11-11): 1 tool added: execute; 4 tools removed: check_stack, get_leaderboard, get_vulnerability, list_feed; 1 input schema changed: search.** Confirmed by a re-run with the same arguments.\n\n## Show the diff\n\n- Added: `execute`\n- Removed: `check_stack` (breaking)\n- Removed: `get_leaderboard` (breaking)\n- Removed: `get_vulnerability` (breaking)\n- Removed: `list_feed` (breaking)\n- Changed schema: `search` (breaking)\n\n## Snapshot hash (fingerprint of the tool list)\n\n`c632f33cd96f`: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.\n\n## Raw test record (JSON)\n\n```\n{\n  \"name\": \"cve-now-remote\",\n  \"version\": null,\n  \"registry\": \"remote\",\n  \"status\": \"working\",\n  \"tested\": \"2026-11-02\",\n  \"tools_count\": 2,\n  \"deprecated\": false,\n  \"archived\": null,\n  \"tests\": {\n    \"install\": [\n      \"pass\",\n      20,\n      \"Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers.\"\n    ],\n    \"handshake\": [\n      \"pass\",\n      30,\n      \"MCP `initialize` (protocol 2025-06-18, server cve.now 0.1.0) + `tools/list` over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key.\"\n    ],\n    \"maintenance\": [\n      \"pass\",\n      25,\n      \"Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC).\"\n    ],\n    \"docs\": [\n      \"pass\",\n      15,\n      \"official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now).\"\n    ],\n    \"license\": [\n      \"fail\",\n      0,\n      \"A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service).\"\n    ]\n  }\n}\n```\n\n## Install\n\n`https://mcp.cve.now/mcp`\n\n## Tools listed\n\n`execute`, `search`\n\nTool history: captured Nov 11, 2026. [All tool history](https://testedmcp.com/changes/).\n\n## Quick config\n\n```\n{\n  \"mcpServers\": {\n    \"cve-now-mcp-remote\": {\n      \"type\": \"http\",\n      \"url\": \"https://mcp.cve.now/mcp\"\n    }\n  }\n}\n```\n\n[Add to config](https://testedmcp.com/free-tools/mcp-config-generator/?s=cve-now-mcp-remote) Opens the config generator with this server selected.\n\n## Setup\n\n1. **Install.** No install step: it is a remote server at https://mcp.cve.now/mcp.\n2. **Configure.** Add the mcpServers entry below to your MCP client config.\n3. **Verify.** Restart the client and check that tools/list returns tools (2 in our test).\n\n```\n{\n  \"mcpServers\": {\n    \"cve-now-mcp-remote\": {\n      \"type\": \"http\",\n      \"url\": \"https://mcp.cve.now/mcp\"\n    }\n  }\n}\n```\n\n## Test history\n\n- 2026-11-11: Tools changed (breaking)\n- 2026-11-02: New\n\nRelated: [Best dev MCP servers](https://testedmcp.com/best/dev-mcp-servers/)\n\n## FAQ\n\n### Is cve.now MCP deprecated?\n\nNo. cve-now-remote was not deprecated or archived when we last tested it on 2026-11-02.\n\n### What replaces cve.now MCP?\n\nNothing; cve.now MCP (remote) is not deprecated as of 2026-11-02.\n\n### Does cve.now MCP need an API key?\n\nNo. It completed an MCP handshake with no credentials and listed 2 tools.\n\n## Embed the badge\n\nEvery tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.", "url": "https://wpnews.pro/news/tools-changed-breaking-cve-now-mcp-remote", "canonical_source": "https://testedmcp.com/tools/cve-now-mcp-remote/#tool-changes", "published_at": "2026-11-11 00:00:00+00:00", "updated_at": "2026-11-12 14:23:25.472333+00:00", "lang": "en", "topics": ["agent-protocols", "ai-tools", "developer-tools"], "entities": ["Sazabi", "cve.now", "cve.now MCP", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/tools-changed-breaking-cve-now-mcp-remote", "markdown": "https://wpnews.pro/news/tools-changed-breaking-cve-now-mcp-remote.md", "text": "https://wpnews.pro/news/tools-changed-breaking-cve-now-mcp-remote.txt", "jsonld": "https://wpnews.pro/news/tools-changed-breaking-cve-now-mcp-remote.jsonld"}}