AVL Code
All cases
#007 · R&D & Testing

Case study · R&D & Testing

Smart Installation and Setup of cve-mcp-server

You are a developer or ops person wiring a threat-intelligence MCP into your AVL Code, with only a GitHub repo address and one open-ended instruction. Work through this article and your AVL Code will have a cve-mcp-server that is registered and ready, with 27 tools callable directly — dependency errors and network stalls never need your intervention.

Target: the GitHub open-source project cve-mcp-server (Python MCP Server)· Environment: Windows workspace · Python 3.14.5· Model: Landi N2.5 (AVL-Zero)· Deliverable: 27 threat-intelligence tools · 21 data sources· Duration: about 10 minutes · one instruction end to end

View session Download session archive Import into your AVL Code workspace to replay the full conversation View live result

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Scout and pull — the repo lands in the workspace

    You drop the GitHub address to AVL Code; it first reads the README and project config to learn what this is and how to install it, probes the local environment, then clones the repo — and if cloning fails it switches execution method on its own.

  2. 02

    Install dependencies with self-healing — pip gets through on the Tsinghua mirror

    Dependency installation is the most accident-prone step of the whole run: network stalls and slow C-extension builds take turns; you will watch the agent kill processes, switch mirrors and fall back to wheel installs in a chain of self-healing.

  3. 03

    Register and verify — 27 tools ready in AVL Code

    Installed is not the same as usable: the agent first runs an import test, then registers the MCP via mcp.add_server in two steps — dry-run preview, then confirmed execution — and finally inventories the 27 tools and probes liveness with a health check.

Task for AVL Code

I have enabled unlimited mode for you. Install this MCP, https://github.com/mukul975/cve-mcp-server, in the workspace for me; after installing, configure it in AVL Code — I will need it later

Prerequisites: AVL Code installed and usable (unlimited mode enabled in the session); Python, pip and Git on the machine (the session environment was Python 3.14.5; the case report separately lists pip 26.1.1 / Git 2.52.0); network access to GitHub, with pip using a reachable mirror

Reproduction materials at the end of this article Try it yourself ↓

Recon and Clone

The first step for an open-ended instruction is figuring out "what is this and how to install it":

You type → AVL Code 
I have enabled unlimited mode for you. Install https://github.com/mukul975/cve-mcp-server in my workspace as an MCP. After installing, configure it in AVL Code — I will need it later
AVL Code runs → you see
Reads the README and project config → establishes the project structure and install method
→ Probes the local environment (Python 3.14.5 · pip · Git)
→ git clones the repo (on clone failure it switches execution methods on its own)

Dependency Self-Healing

Dependency installation is the most failure-prone step of the whole run — the self-healing chain plays out:

You type → AVL Code 
(the same instruction still running, no new input)
AVL Code runs → you see
pip network stalls → kills the process
→ Switches to a reachable mirror (Tsinghua) and retries
→ C-extension compiles slowly → switches to wheel installs
→ All dependencies installed

Registration and Verification

Installed is not the same as usable — registration, inventory and health checks are all mandatory:

You type → AVL Code 
(the same instruction still running, no new input)
AVL Code runs → you see
Python import test passes
→ mcp.add_server (stdio · python -m cve_mcp.server): dry-run preview → confirm execution
→ Inventories 27 cve-mcp.* tools (21 data sources) + Health check (NVD / KEV / SQLite cache)

Try it yourself

To reproduce this task you only need the sentence from step 1; the manual-equivalent commands that follow come from the session’s final "change list", for you to check each thing the agent did step by step.

View session Download session archive Import into your AVL Code workspace to replay the full conversation View live result 
› I have enabled unlimited mode for you. Install this MCP, https://github.com/mukul975/cve-mcp-server, in the workspace for me; after installing, configure it in AVL Code — I will need it later
git clone https://github.com/mukul975/cve-mcp-server.git <workspace directory>
pip install "mcp[cli]" httpx aiosqlite cvss python-dotenv pydantic defusedxml -i <reachable PyPI mirror>
pip install -e <cve-mcp-server directory>
  • Step 1: type the single instruction above into the AVL Code conversation (the whole task is this one instruction).
  • Step 2: manual-equivalent path check (from the session’s change list) — the git clone / pip install above are tidied values; the exact wheel-install command line has no original text in the session.
  • Step 3: register in AVL Code — mcp.add_server (stdio, command python -m cve_mcp.server), with a dry-run preview before confirmed execution.
  • Step 4: verify — a Python import test + mcp.list_tools should show the 27 cve-mcp.* prefixed tools + a health check (NVD / KEV / SQLite cache).
  • Two limitations stated honestly:
  • ① The session export contains no raw command lines or return JSON for tool calls; the duo right column’s action sequence is compiled from the assistant’s narration and the case report’s recap, and since the exact wheel-install command line has no original text in the session, the repro section does not copy it verbatim;
  • ② "About 10 minutes / 2.5–3.5x" comes from the case’s existing data and case report; the session export itself contains no per-step timing.

Next question: With the service ready, the natural next step is to take a real CVE (say CVE-2024-3400) through lookup_cve + check_kev + get_epss_score and wire the threat intelligence into your vulnerability-triage workflow.