The NVD API 2.0 compatible endpoints are also available through VulnCheck's open source tooling. Each tool mirrors the API: one method, command or tool per endpoint, and one argument per NVD query parameter, so everything on the other pages in this section applies unchanged. They work with any VulnCheck API token, including community.
| Endpoint | Go SDK (NvdAPI) | Python SDK (NvdApi) | CLI | MCP server |
|---|---|---|---|---|
/rest/json/cves/2.0 | NvdCvesGet | nvd_cves_get | vulncheck nvd cves | search_nvd_cves |
/rest/json/cvehistory/2.0 | NvdCveHistoryGet | nvd_cve_history_get | vulncheck nvd cvehistory | search_nvd_cve_history |
/rest/json/cpes/2.0 | NvdCpesGet | nvd_cpes_get | vulncheck nvd cpes | search_nvd_cpes |
/rest/json/cpematch/2.0 | NvdCpeMatchGet | nvd_cpe_match_get | vulncheck nvd cpematch | search_nvd_cpe_match |
/rest/json/source/2.0 | NvdSourceGet | nvd_source_get | vulncheck nvd source | search_nvd_sources |
Parameter names follow each tool's conventions. NVD's lastModStartDate is .LastModStartDate() in Go, last_mod_start_date in Python and the MCP server, and --last-mod-start-date in the CLI.
Requires sdk-go-v2 v2.1.30 or later.
configuration := vulncheck.NewConfiguration()
client := vulncheck.NewAPIClient(configuration)
auth := context.WithValue(
context.Background(),
vulncheck.ContextAPIKeys,
map[string]vulncheck.APIKey{"Bearer": {Key: os.Getenv("VULNCHECK_API_TOKEN")}},
)
resp, _, err := client.NvdAPI.NvdCvesGet(auth).CveId("CVE-2021-44228").Execute()
if err != nil {
log.Fatal(err)
}
cve := resp.Vulnerabilities[0].GetCve()
fmt.Println(cve.GetId(), cve.GetVulnStatus())
To page with a cursor, send an empty Cursor("") on the first request, then pass each response's GetNextCursor() back until it is empty. The SDK README has a complete example.
Requires vulncheck-sdk 0.1.4 or later.
import os
import vulncheck_sdk
configuration = vulncheck_sdk.Configuration()
configuration.api_key["Bearer"] = os.environ["VULNCHECK_API_TOKEN"]
with vulncheck_sdk.ApiClient(configuration) as api_client:
nvd = vulncheck_sdk.NvdApi(api_client)
response = nvd.nvd_cves_get(cve_id="CVE-2021-44228")
cve = response.vulnerabilities[0].cve
print(cve.id, cve.vuln_status)
To page with a cursor, pass cursor="" on the first request, then each response's next_cursor until it is None. The async client is the same API under vulncheck_sdk.aio. The SDK README has sync and async examples.
Requires the VulnCheck CLI v1.3.0 or later.
vulncheck nvd cves --cve-id CVE-2021-44228 --json
vulncheck nvd cvehistory --event-name "CVE Modified" --change-start-date 2026-09-01T00:00:00.000 --change-end-date 2026-10-01T00:00:00.000 --json
vulncheck nvd cpematch --cve-id CVE-2024-3400 --json
Each command makes one request and prints the endpoint's records, such as vulnerabilities from nvd cves. Add --full for the whole NVD response, including totalResults and nextCursor. To page, pass --cursor "" for the first page and then each nextCursor, or use --start-index, which is the only paging on nvd source. Under --json, stdout carries only the JSON, and a refused request returns the CLI's standard error envelope with the API's reason.
Requires the VulnCheck MCP server v0.2.3 or later.
The five search_nvd_* tools let an agent answer questions about NVD's own data:
search_nvd_cves)search_nvd_cve_history)search_nvd_cpe_match)search_nvd_cpes)search_nvd_sources)The server steers agents to search_cve first for general questions about a CVE, and uses the NVD tools when a question is specifically about NVD, or when the token cannot reach the same data through VulnCheck's own indices. Responses are bounded in size, and a shortened response says what was left out. In CVE records, configurations is NVD's data and vcConfigurations is VulnCheck's.