Guide
How to query the NVD API without hosting a server
You do not need to run the NVD API yourself to use CVE data in an AI assistant. Here is how a hosted CVE brain gives you NVD, CISA KEV, and EPSS over MCP, refreshed daily.
Add the CVE brain to your AI assistant
The NVD API is free and well-documented, but using it to power an AI assistant is more than a single call. You need an API key to get past the low anonymous rate limit, a way to page through hundreds of thousands of records for the initial load, a place to store them, and a service that stays online to answer queries. KBrain does all of that on the ingestion side and hands you a hosted MCP endpoint, so you get NVD data in your assistant without running a server.
What using the NVD API directly involves
- Request an NVD API key, because the anonymous rate limit makes a full backfill impractical.
- Page through the catalog with startIndex and resultsPerPage, respecting the request budget per window.
- Keep data current with incremental pulls using the lastModStartDate and lastModEndDate parameters.
- Store the results and stand up a service that your assistant can call, then keep that service online.
The hosted approach
KBrain performs the backfill and the daily incremental sync against NVD, adds CISA KEV and EPSS, and exposes the combined data through read-only MCP tools. From your side there is no key, no paging, and no server. You connect the endpoint and ask questions.
- get_cve for one record, search_cves for keyword or product search, get_recent_cves for a recent window.
- CISA KEV status and EPSS scores are already joined onto each record.
- A status tool reports the last sync so you can confirm freshness.
This is the same pattern KBrain uses for other public datasets: do the ingestion and hosting once, then expose the result over MCP so no one downstream has to run the pipeline.
When you might still call NVD directly
If you are building a data platform that needs the raw feed, calling NVD directly makes sense. But if your goal is to answer CVE questions inside an AI assistant, or to power an agent, the hosted brain removes the operational work without giving up any of the data.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
Do I need an NVD API key to use the CVE brain?
No. KBrain uses an NVD key on the ingestion side to backfill and sync the data. As a user of the brain you connect the hosted MCP endpoint and query it; there is no key for you to request or rotate.
Is any CVE data lost by going through KBrain instead of NVD directly?
No. The brain ingests the NVD record, including CVSS, CWE, affected products, and references, and adds CISA KEV and EPSS. For assistant and agent use cases you get the same data without the pipeline.
How does KBrain keep the data current?
It runs a daily incremental sync using the NVD lastModified window, plus a full daily refresh of CISA KEV and EPSS. Every record carries a last-updated timestamp.
Can I still call NVD directly if I need the raw feed?
Of course. Direct access makes sense for building a data platform. The hosted brain is aimed at answering CVE questions in an assistant or agent without operating the ingestion yourself.