# Tools changed (breaking): cve.now MCP (remote) > Source: > Published: 2026-11-11 00:00:00+00:00 # cve.now MCP (remote) **90**/100 Score = points from our five tests (install, handshake, maintenance, docs, license). Not a quality or security rating. [Methodology](https://testedmcp.com/methodology/) - Install20/20 - Handshake30/30 - Maintenance25/25 - Docs15/15 - License0/10 Vendor-hosted New / early find New / early find: first tested 2026-11-02. Sazabi's free cve.now vulnerability feed as a hosted MCP endpoint (https://mcp.cve.now/mcp, no sign-in, 2 tools: execute, search). Repo sazabi/cve.now (docs only, created 2026-10-22, 116 GitHub stars when tested). Real read-only calls (no LLM, no credentials) on an earlier tools/list: get_vulnerability CVE-2021-44228, search for MCP vulnerabilities and check_stack lodash 4.17.20 all returned data. Server source is not public, so license scores 0. get_vulnerability and check_stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical. Tool-call test (2026-11-02, direct MCP stdio client, no LLM): **pass**. 3 of 3 read-only calls passed on the live endpoint: get_vulnerability, search and check_stack. No credentials. get_vulnerability and check_stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical. Evidence: live endpoint probe, Nov 2, 2026. Sazabi-hosted public endpoint, no sign-in. The server source isn't public: github.com/sazabi/cve.now holds docs only (synced from Sazabi's private monorepo). Listed as a hosted remote (Our review, Nov 1, 2026). Sources: [https://cve.now/#mcp](https://cve.now/#mcp) · [https://github.com/sazabi/cve.now](https://github.com/sazabi/cve.now) · [https://github.com/sazabi/cve.now/commit/028836f8cf](https://github.com/sazabi/cve.now/commit/028836f8cf) **Transport (tested 2026-11-02):** Streamable HTTP **Token cost (estimate):** approx. 412 tokens, cl100k estimate (2 tools, measured 2026-11-11). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base. ## Permissions: 1 read, 1 write (state-changing), 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown Auth: none. Rate limit: unknown. Pricing unit: unknown. - `execute` — write (state-changing) - `search` — read remote handshake listed tools without credentials; no recorded key or OAuth Score **90/100** · Tools **2** · Token cost **approx. 412 tokens** (Tool list changed 2026-11-11; count from 2026-11-11 capture) · [Compare](https://testedmcp.com/compare/?s=cve-now-mcp-remote) · Last tested **2026-11-02** · Server version `0.1.0` · Remote endpoint `https://mcp.cve.now/mcp` (streamable-http) Summary: cve.now MCP (remote) completed an MCP handshake without credentials and exposed 2 tools. ## Evidence summary - Handshake - pass - Tools listed - 2 - Context cost - approx. 412 tokens, cl100k estimate (2 tools, measured 2026-11-11; an estimate) [ranking](https://testedmcp.com/best/lowest-context-cost-mcp-servers/) ·[add up your servers' context cost](https://testedmcp.com/guides/how-much-context-mcp-servers-cost/) Tool list changed 2026-11-11; count from 2026-11-11 capture - Login - No key needed for the tools we called - Tested - 2026-11-02 ## Test results | Test | Result | Points | Evidence | |---|---|---|---| | install | pass | 20 | Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers. | | handshake | pass | 30 | MCP `initialize` (protocol 2025-06-18, server cve.now 0.1.0) +`tools/list` over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key. | | maintenance | pass | 25 | Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC). | | docs | pass | 15 | official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now). | | license | fail | 0 | A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service). | ## Local-model readiness Token cost (estimate): **approx. 412 tokens, cl100k estimate** for 2 tools · about 5% of an 8k context. This is an estimate from our testing (counted with cl100k_base). Small-model friendly (schema heuristic, not a model result): **unknown**. ## Not tested Small-model task runs: Not yet tested. ## What we tested and what we didn't ### Tested on 2026-11-02 - We connected to the vendor's hosted endpoint with no credentials and asked for its tool list: it listed 2 tools (Method details: MCP `initialize` then`tools/list` ) - Auth response: none. The endpoint answered without any login - Vendor docs: official MCP docs page; states the endpoint URL; client setup instructions (15/15) - Maintenance: dated vendor source, dated commit in Sazabi's cve.now docs repo 2026-10-31 (25/25) - License: a hosted service has no license to cite (0/10) - Token cost (estimate) ### Not tested - Security: **not audited** (hosted service; no code to review, no permission or data-flow analysis) - Behaviour after signing in, or with a real account - Source code, repository activity or an open-source license (none published for the hosted service) - Performance, rate limits or load - Real tasks (no functional task runs yet) Methodology: [how we test](https://testedmcp.com/methodology/) (vendor-hosted rule). A high score means it responds and its vendor documents and dates it, not that giving it access to your data carries no risk. ## Known security issues Not checked (remote-only): hosted endpoint, version unknown. Monthly roundup: [MCP security issues, October 2026](https://testedmcp.com/security/2026-10/). ## Tool list changes ↻ Tools changed (breaking) 2026-11-11 **Tool list changed since last test (2026-11-02 → 2026-11-11): 1 tool added: execute; 4 tools removed: check_stack, get_leaderboard, get_vulnerability, list_feed; 1 input schema changed: search.** Confirmed by a re-run with the same arguments. ## Show the diff - Added: `execute` - Removed: `check_stack` (breaking) - Removed: `get_leaderboard` (breaking) - Removed: `get_vulnerability` (breaking) - Removed: `list_feed` (breaking) - Changed schema: `search` (breaking) ## Snapshot hash (fingerprint of the tool list) `c632f33cd96f`: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed. ## Raw test record (JSON) ``` { "name": "cve-now-remote", "version": null, "registry": "remote", "status": "working", "tested": "2026-11-02", "tools_count": 2, "deprecated": false, "archived": null, "tests": { "install": [ "pass", 20, "Endpoint https://mcp.cve.now/mcp reachable over streamable-http (HTTP 200) in 0.6s; no install step for remote servers." ], "handshake": [ "pass", 30, "MCP `initialize` (protocol 2025-06-18, server cve.now 0.1.0) + `tools/list` over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key." ], "maintenance": [ "pass", 25, "Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 (https://github.com/sazabi/cve.now/commit/028836f8cf), 2 days before test. Registry: Not found in the official MCP registry (checked 2026-11-02 UTC)." ], "docs": [ "pass", 15, "official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://cve.now/#mcp, https://github.com/sazabi/cve.now)." ], "license": [ "fail", 0, "A public Apache-2.0 repo exists (https://github.com/sazabi/cve.now), but it holds metadata only and its license does not cover the hosted service, so 0 (rule: no points without a cited license for the service)." ] } } ``` ## Install `https://mcp.cve.now/mcp` ## Tools listed `execute`, `search` Tool history: captured Nov 11, 2026. [All tool history](https://testedmcp.com/changes/). ## Quick config ``` { "mcpServers": { "cve-now-mcp-remote": { "type": "http", "url": "https://mcp.cve.now/mcp" } } } ``` [Add to config](https://testedmcp.com/free-tools/mcp-config-generator/?s=cve-now-mcp-remote) Opens the config generator with this server selected. ## Setup 1. **Install.** No install step: it is a remote server at https://mcp.cve.now/mcp. 2. **Configure.** Add the mcpServers entry below to your MCP client config. 3. **Verify.** Restart the client and check that tools/list returns tools (2 in our test). ``` { "mcpServers": { "cve-now-mcp-remote": { "type": "http", "url": "https://mcp.cve.now/mcp" } } } ``` ## Test history - 2026-11-11: Tools changed (breaking) - 2026-11-02: New Related: [Best dev MCP servers](https://testedmcp.com/best/dev-mcp-servers/) ## FAQ ### Is cve.now MCP deprecated? No. cve-now-remote was not deprecated or archived when we last tested it on 2026-11-02. ### What replaces cve.now MCP? Nothing; cve.now MCP (remote) is not deprecated as of 2026-11-02. ### Does cve.now MCP need an API key? No. It completed an MCP handshake with no credentials and listed 2 tools. ## Embed the badge Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.