The CVE MCP server has a single tool with critical definition quality gaps. The tool `query_cve` lacks a meaningful description (null in schema), parameter descriptions are missing entirely, and the output schema is undocumented. While the tool name is reasonably clear (starts with verb 'query'), the implementation exposes fundamental issues: the parameter has no description, error handling is minimal, and there is no documentation of what the JSON response contains. The server uses FastMCP which should support proper schema registration, but the definitions are incomplete.

• Add a docstring to @mcp.tool() decorator: @mcp.tool() with a description parameter or Python docstring. Example: 'Fetch CVE vulnerability details from MITRE CVE database. Returns metadata, severity, references, and available proof-of-concept. Use when you need to research a specific CVE vulnerability.'
• Add parameter description to cve_id: 'The CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-1234). Required. The server will fetch details from the MITRE CVE database.'
• Document the response schema in the docstring. Example: 'Returns a JSON object with fields: id (string), cna (object with title, affected, descriptions), nuclei_poc (string, YAML POC if available, null if not found). Returns null if CVE not found or API error.'
• Add explicit error handling that returns structured error responses. Instead of 'null', return {'error': 'CVE not found', 'cve_id': '<input>', 'suggestion': 'Verify the CVE ID format is CVE-YYYY-NNNNN'}.
• Add timeout parameter to requests.get() calls: requests.get(url, timeout=10). Set a reasonable limit (5-10 seconds) and catch timeout exceptions with recovery guidance.
• Add input validation: check that cve_id matches pattern CVE-\d{4}-\d{4,} before calling external API. Return clear validation error if format is wrong.
• Filter CVE response to essential fields only (id, title, severity, affected software, references). Strip out verbose internal metadata (timestamps, raw metrics objects) to reduce token waste.
• Consider renaming to 'get_cve_details' to align with production baselines where 'get_*' is the dominant pattern for retrieval tools.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry