Documentation Overview

Welcome to the CVSS.my.id documentation. This documentation covers two static products and one open-source Model Context Protocol (MCP) server:

CVSS Calculator: Score CVSS 4.0, 3.1, 3.0, and 2.0 vulnerabilities across Base, Threat/Temporal, Environmental, and Supplemental metric groups.
Documentation & Product Hub: Reference guides for CVSS version differences, vector syntax, scoring formulas, and AI agent integrations.
CVSS Calculator MCP (cvss-calculator-mcp): Open-source Go MCP server for Base Score only across CVSS 2.0, 3.0, 3.1, and 4.0. Runs locally over stdio or via the free public Streamable HTTP endpoint.

Documentation Sections

Getting Started & Calculator

Getting Started: Choose the right CVSS version and tool for your workflow.
Full Browser Calculator Guide: Metric group tabs, inline vector editing, keyboard navigation, and built-in reference panes.

CVSS Reference

Version Comparison: Side-by-side comparison of CVSS 4.0, 3.1, 3.0, and 2.0.
CVSS v4.0 Reference: Base, Threat, Environmental, Supplemental groups, MacroVector lookup, and CVSS-B / CVSS-BT / CVSS-BE / CVSS-BTE nomenclature.
CVSS v3.1 Reference: Base, Temporal, and Environmental formulas, Scope rules, and Roundup behavior.
CVSS v3.0 Reference: Historical 3.0 formulas and exact differences from 3.1.
CVSS v2.0 Reference: Access Vector, Authentication (Au), Temporal, Environmental, and the 3-tier severity scale (Low, Medium, High).
Vector String Format: Prefix rules, metric ordering, mandatory vs optional metrics, and validation rules.
Worked Examples: Real-world vulnerability vectors across all four CVSS versions.

MCP Server (`cvss-calculator-mcp`)

MCP Overview: Local stdio vs Remote Streamable HTTP comparison and Base-only scope.
Local MCP Setup (stdio): Recommended zero-rate-limit installation for Linux and macOS.
Remote MCP Setup (HTTP): Connect to https://cvss.my.id/mcp and understand the 5 requests per minute per IP policy.
MCP Tool Reference: Input schema, output fields, and example calls for calculate_cvss.
Security, Privacy & Rate Limits: Offline guarantees, transport notes, and source code verification.
Client Setup Guides: Setup instructions for a selection of MCP clients and editors.

Standards Attribution

CVSS (Common Vulnerability Scoring System) is a free and open industry standard owned and managed by FIRST.Org, Inc. (Forum of Incident Response and Security Teams). Official specifications are published at: