CME MCP Server Reference

Connect to and query the Common Mitigation Enumeration taxonomy through MCP.

Connect

Public endpoint: https://cmetaxonomy.org/mcp

For local use, run uv run python -m src.server. For shared HTTP deployment, set CME_TRANSPORT=streamable-http; use CME_DB_BACKEND=postgres for PostgreSQL.

Evidence model

State	Meaning	Scoring behavior
`deterministic`	Verified preventive effect.	Eligible for a guaranteed CVSS environmental metric shift.
`quantified`	Measured conditional effect, with probability and evidence.	Returned as a conditional adjustment, never a guaranteed shift.
`unquantified`	Plausible effect with incomplete evidence.	Discoverable, but never changes a score automatically.

Every entry also identifies its primary effect as preventive, detective, or corrective. CVSS is optional; EPSS is not a control mapping.

Query tools

Tool	Required inputs	Purpose
`get_cme_entry`	`cme_id`	Return one full CME entry.
`search_cme`	None	Search by tactic, category, category ID, control layer, or keyword.
`get_mitigations_for_weakness`	`cwe_id`	Find controls for a CWE, including applicable ancestor-CWE coverage.
`get_coverage_assessments`	`namespace`, `target_id`	Return evidence-backed coverage assessments for a CWE, CVE, or capability.
`get_mitigations_for_cvss_vector`	`cvss_vector`	Discover controls with transitions matching a CVSS vector.
`get_mitigations_for_product`	One product filter	Match controls by CPE, PURL, vendor/product, or platform.
`get_mitigations_for_scf`	`scf_id`	Find controls mapped to an SCF control or domain.
`list_cme_taxonomy`	None	Return tactics, categories, and function registry data.
`get_cme_coverage_summary`	None	Return aggregate CWE, CVSS-transition, tactic, and category coverage.
`get_verification_commands`	`cme_id`	Return attached target verification instructions.

Risk analysis tools

Tool	Required inputs	Purpose
`calculate_attenuation`	`active_cme_ids`	Aggregate effects of verified active controls. Separates deterministic attenuation, quantified adjustments, and unquantified effects.
`simulate_cve_risk`	`base_score`, `base_vector`, `active_cme_ids`	Apply applicable effects to a vector. The base score is retained for context; CME does not numerically recalculate CVSS.

Curation tools

Tool	Required inputs	Purpose
`propose_cme_entry`	`control_name`, `description`, `tactic`, `effect_mode`, `evidence_state`, `efficacy_json`, and a category or category ID	Validate and save a proposal; it does not modify the live taxonomy.
`list_proposals`	None	List proposals awaiting review.
`approve_cme_proposal`	`cme_id`	Publish a proposal, load it into the database, and rebuild the static site.

For propose_cme_entry, quantified evidence requires probability, an evidence basis, and conditions. Unquantified evidence requires conditions. Optional data includes CVSS impacts, CWE IDs, verification instructions, platforms, and external framework bindings.

Resources

URI	Contents
`cme://taxonomy`	Full taxonomy structure.
`cme://entry/{cme_id}`	Full entry by CME ID.
`cme://schema`	Current CME JSON Schema.

Operational notes

Review verification commands for platform and privilege requirements before executing them.
Negative coverage conclusions require an assessment that records considered candidates and supporting evidence.
Runtime configuration uses CME_TRANSPORT, CME_DB_BACKEND, CME_HTTP_HOST, and CME_HTTP_PORT.