Tools changed (breaking): cve.now MCP (remote)

Sazabi's hosted cve.now MCP endpoint (https://mcp.cve.now/mcp) scored 90/100 in a five-test review first run on 2026-11-02, passing install, handshake, maintenance and docs but scoring 0/10 on license because the server source is not public. The remote server, version 0.1.0, completed an MCP initialize handshake over streamable-http with protocol 2025-06-18 and no credentials, listing 2 tools (execute, a state-changing write, and search, a read) at an estimated context cost of about 412 tokens. The tool list changed on 2026-11-11, when get_vulnerability and check_stack were removed, so the November 2 passing calls to those tools are historical; the docs-only repo sazabi/cve.now had 116 GitHub stars and was not found in the official MCP registry as of 2026-11-02.

cve.now MCP remote 90 /100 Score = points from our five tests install, handshake, maintenance, docs, license . Not a quality or security rating. Methodology https://testedmcp.com/methodology/ - Install20/20 - Handshake30/30 - Maintenance25/25 - Docs15/15 - License0/10 Vendor-hosted New / early find New / early find: first tested 2026-11-02. Sazabi's free cve.now vulnerability feed as a hosted MCP endpoint https://mcp.cve.now/mcp, no sign-in, 2 tools: execute, search . Repo sazabi/cve.now docs only, created 2026-10-22, 116 GitHub stars when tested . Real read-only calls no LLM, no credentials on an earlier tools/list: get vulnerability CVE-2021-44228, search for MCP vulnerabilities and check stack lodash 4.17.20 all returned data. Server source is not public, so license scores 0. get vulnerability and check stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical. Tool-call test 2026-11-02, direct MCP stdio client, no LLM : pass . 3 of 3 read-only calls passed on the live endpoint: get vulnerability, search and check stack. No credentials. get vulnerability and check stack were removed on 2026-11-11, so the Nov 2 passing calls of those tools are historical. Evidence: live endpoint probe, Nov 2, 2026. Sazabi-hosted public endpoint, no sign-in. The server source isn't public: github.com/sazabi/cve.now holds docs only synced from Sazabi's private monorepo . Listed as a hosted remote Our review, Nov 1, 2026 . Sources: https://cve.now/ mcp https://cve.now/ mcp · https://github.com/sazabi/cve.now https://github.com/sazabi/cve.now · https://github.com/sazabi/cve.now/commit/028836f8cf https://github.com/sazabi/cve.now/commit/028836f8cf Transport tested 2026-11-02 : Streamable HTTP Token cost estimate : approx. 412 tokens, cl100k estimate 2 tools, measured 2026-11-11 . This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k base. Permissions: 1 read, 1 write state-changing , 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown Auth: none. Rate limit: unknown. Pricing unit: unknown. - execute — write state-changing - search — read remote handshake listed tools without credentials; no recorded key or OAuth Score 90/100 · Tools 2 · Token cost approx. 412 tokens Tool list changed 2026-11-11; count from 2026-11-11 capture · Compare https://testedmcp.com/compare/?s=cve-now-mcp-remote · Last tested 2026-11-02 · Server version 0.1.0 · Remote endpoint https://mcp.cve.now/mcp streamable-http Summary: cve.now MCP remote completed an MCP handshake without credentials and exposed 2 tools. Evidence summary - Handshake - pass - Tools listed - 2 - Context cost - approx. 412 tokens, cl100k estimate 2 tools, measured 2026-11-11; an estimate ranking https://testedmcp.com/best/lowest-context-cost-mcp-servers/ · add up your servers' context cost https://testedmcp.com/guides/how-much-context-mcp-servers-cost/ Tool list changed 2026-11-11; count from 2026-11-11 capture - Login - No key needed for the tools we called - Tested - 2026-11-02 Test results | Test | Result | Points | Evidence | |---|---|---|---| | install | pass | 20 | Endpoint https://mcp.cve.now/mcp reachable over streamable-http HTTP 200 in 0.6s; no install step for remote servers. | | handshake | pass | 30 | MCP initialize protocol 2025-06-18, server cve.now 0.1.0 + tools/list over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key. | | maintenance | pass | 25 | Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 https://github.com/sazabi/cve.now/commit/028836f8cf , 2 days before test. Registry: Not found in the official MCP registry checked 2026-11-02 UTC . | | docs | pass | 15 | official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs https://cve.now/ mcp, https://github.com/sazabi/cve.now . | | license | fail | 0 | A public Apache-2.0 repo exists https://github.com/sazabi/cve.now , but it holds metadata only and its license does not cover the hosted service, so 0 rule: no points without a cited license for the service . | Local-model readiness Token cost estimate : approx. 412 tokens, cl100k estimate for 2 tools · about 5% of an 8k context. This is an estimate from our testing counted with cl100k base . Small-model friendly schema heuristic, not a model result : unknown . Not tested Small-model task runs: Not yet tested. What we tested and what we didn't Tested on 2026-11-02 - We connected to the vendor's hosted endpoint with no credentials and asked for its tool list: it listed 2 tools Method details: MCP initialize then tools/list - Auth response: none. The endpoint answered without any login - Vendor docs: official MCP docs page; states the endpoint URL; client setup instructions 15/15 - Maintenance: dated vendor source, dated commit in Sazabi's cve.now docs repo 2026-10-31 25/25 - License: a hosted service has no license to cite 0/10 - Token cost estimate Not tested - Security: not audited hosted service; no code to review, no permission or data-flow analysis - Behaviour after signing in, or with a real account - Source code, repository activity or an open-source license none published for the hosted service - Performance, rate limits or load - Real tasks no functional task runs yet Methodology: how we test https://testedmcp.com/methodology/ vendor-hosted rule . A high score means it responds and its vendor documents and dates it, not that giving it access to your data carries no risk. Known security issues Not checked remote-only : hosted endpoint, version unknown. Monthly roundup: MCP security issues, October 2026 https://testedmcp.com/security/2026-10/ . Tool list changes ↻ Tools changed breaking 2026-11-11 Tool list changed since last test 2026-11-02 → 2026-11-11 : 1 tool added: execute; 4 tools removed: check stack, get leaderboard, get vulnerability, list feed; 1 input schema changed: search. Confirmed by a re-run with the same arguments. Show the diff - Added: execute - Removed: check stack breaking - Removed: get leaderboard breaking - Removed: get vulnerability breaking - Removed: list feed breaking - Changed schema: search breaking Snapshot hash fingerprint of the tool list c632f33cd96f : SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed. Raw test record JSON { "name": "cve-now-remote", "version": null, "registry": "remote", "status": "working", "tested": "2026-11-02", "tools count": 2, "deprecated": false, "archived": null, "tests": { "install": "pass", 20, "Endpoint https://mcp.cve.now/mcp reachable over streamable-http HTTP 200 in 0.6s; no install step for remote servers." , "handshake": "pass", 30, "MCP initialize protocol 2025-06-18, server cve.now 0.1.0 + tools/list over streamable-http succeeded with no credentials; 2 tools listed in 0.6s. Tool calls may still need a key." , "maintenance": "pass", 25, "Vendor-hosted rule: scored from dated commit in Sazabi's cve.now docs repo 2026-10-31 https://github.com/sazabi/cve.now/commit/028836f8cf , 2 days before test. Registry: Not found in the official MCP registry checked 2026-11-02 UTC ." , "docs": "pass", 15, "official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs https://cve.now/ mcp, https://github.com/sazabi/cve.now ." , "license": "fail", 0, "A public Apache-2.0 repo exists https://github.com/sazabi/cve.now , but it holds metadata only and its license does not cover the hosted service, so 0 rule: no points without a cited license for the service ." } } Install https://mcp.cve.now/mcp Tools listed execute , search Tool history: captured Nov 11, 2026. All tool history https://testedmcp.com/changes/ . Quick config { "mcpServers": { "cve-now-mcp-remote": { "type": "http", "url": "https://mcp.cve.now/mcp" } } } Add to config https://testedmcp.com/free-tools/mcp-config-generator/?s=cve-now-mcp-remote Opens the config generator with this server selected. Setup 1. Install. No install step: it is a remote server at https://mcp.cve.now/mcp. 2. Configure. Add the mcpServers entry below to your MCP client config. 3. Verify. Restart the client and check that tools/list returns tools 2 in our test . { "mcpServers": { "cve-now-mcp-remote": { "type": "http", "url": "https://mcp.cve.now/mcp" } } } Test history - 2026-11-11: Tools changed breaking - 2026-11-02: New Related: Best dev MCP servers https://testedmcp.com/best/dev-mcp-servers/ FAQ Is cve.now MCP deprecated? No. cve-now-remote was not deprecated or archived when we last tested it on 2026-11-02. What replaces cve.now MCP? Nothing; cve.now MCP remote is not deprecated as of 2026-11-02. Does cve.now MCP need an API key? No. It completed an MCP handshake with no credentials and listed 2 tools. Embed the badge Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.