Skip to content
New CVSS Calculator MCP Released for Vulnerability Scoring

New CVSS Calculator MCP Released for Vulnerability Scoring

First seen 31 Oct 2026, 19:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 21:13 UTC
  • •The MCP server calculates Base-only CVSS scores for multiple versions.
  • •It does not assess vulnerabilities or provide CVE lookups.
  • •Users must implement operational protections if exposing the service publicly.

On October 31, 2026, two articles reported the release of a small, offline Model Context Protocol (MCP) server designed to calculate Base-only CVSS scores for versions 2.0, 3.0, 3.1, and 4.0. The tool, named calculate_cvss, allows users to input metrics, which the server validates and scores, but it does not assess vulnerabilities or calculate additional metrics. The server requires Go 1.25 or newer for building from source and can be run locally or via Streamable HTTP. The articles emphasize that the service is not endorsed by FIRST and that users must take precautions if exposing the service publicly. The MCP server is designed for terminal operations and file editing, with an additional plugin for management functionalities. It is crucial for users to retain and publish the input vector alongside the score as per FIRST's usage conditions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-31
MCP server released
The Model Context Protocol server for calculating CVSS scores was announced, allowing offline scoring of vulnerabilities.
Lobehub
2026-10-31
GitHub repository published
The GitHub page for the CVSS Calculator MCP was launched, providing installation instructions and usage details.
github.com

More articles in this cluster (5)

Extracted Entities

1 / 2

Common questions

What versions of CVSS does the MCP server support?
The MCP server supports CVSS versions 2.0, 3.0, 3.1, and 4.0.
Can the MCP server assess vulnerabilities?
No, the MCP server only calculates Base scores and does not assess vulnerabilities or provide CVE lookups.
What precautions should be taken if exposing the MCP server publicly?
Users should implement TLS, access control, rate limiting, and other operational protections to secure the service.