Comparison

Vuln NIST vs com.stackhawk/stackhawk

Vuln NIST is an MCP server published by HaroldFinchIFT. Marketplaces we read that list it: 1 (Docker MCP Catalog). com.stackhawk/stackhawk is an MCP server published by stackhawk.com. Marketplaces we read that list it: 2 (Official MCP Registry, Docker MCP Catalog). As of our marketplace pass on 2026-10-14. This pair was picked by a reader, not by our comparison rule, so search engines are asked not to index the page.

Where each is published

Where each is published
Marketplace	Vuln NIST	com.stackhawk/stackhawk
Docker MCP Catalog	Listed Version: sha256:e5025e66c0d2 Forks (GitHub): 7 Pulls (Docker Hub): 13 597 Stars (Docker Hub): 1 Stars (GitHub): 14 Not marked · First seen 2026-10-11	Listed Version: sha256:f5c273bf008b Forks (GitHub): 8 Pulls (Docker Hub): 31 286 Stars (Docker Hub): 0 Stars (GitHub): 9 Not marked · First seen 2026-10-11
Official MCP Registry	Not listed	Listed Version: 1.1.1 Downloads/month (PyPI): 160 Downloads/week (PyPI): 47 Forks (GitHub): 8 Stars (GitHub): 9 Not marked · First seen 2026-10-11

Each figure is the marketplace's own and is never added up across marketplaces. A marketplace that publishes no figure shows none: no number is not zero.

The facts side by side

Vuln NIST vs com.stackhawk/stackhawk
Fact	Vuln NIST	com.stackhawk/stackhawk
Marketplaces that list it (differs)	1 (worse)	2 (better)
Stars (GitHub) (differs)	14 (better)	9 (worse)
Pulls (Docker Hub) (differs)	13 597 (worse)	31 286 (better)
Forks (GitHub) (differs)	7 (worse)	8 (better)
Last release	Not published	Not published
Where it runs (differs)	On your machine (mcp/vuln-nist-mcp-server)	On your machine (stackhawk-mcp)
Transport	stdio	stdio
Tools it declares (differs)	6	7
Environment variables it asks for (differs)	Not published	1, secrets among them: 1
Licence (differs)	MIT	NOASSERTION
Repository (differs)	github.com/haroldfinchift/vuln-nist-mcp-server	github.com/stackhawk/stackhawk-mcp
Changes in the last 7 days	0	0
First seen	2026-10-11	2026-10-11

Lines where the two differ have a tinted background and bold values. Where the data itself says which value is better (more marketplaces, a larger figure of the same marketplace, a fresher release, a verified mark on a marketplace that lists both), the better one is also marked green with ▲ and the worse one red with ▼. Where it runs, the transport, the tools, the settings, hooks, the bundle's parts, the licence and the week's changes are marked only as different: more or fewer is not better in itself.

What each says it does

Vuln NIST

In its own words, on Docker MCP Catalog:

This MCP server exposes tools to query the NVD/CVE REST API and return formatted text results suitable for LLM consumption via the MCP protocol. It includes automatic query chunking for large date ranges and parallel processing for improved performance.

com.stackhawk/stackhawk

In its own words, on Official MCP Registry:

An MCP server that provides interaction with StackHawk's security scanning platform.

How to run each

Vuln NIST As a local MCP server: Docker image

Claude Code

claude mcp add --transport stdio vuln-nist-mcp-server -- docker run -i --rm mcp/vuln-nist-mcp-server

com.stackhawk/stackhawk As a local MCP server: PyPI package

Claude Code

claude mcp add --env "STACKHAWK_API_KEY=<YOUR_STACKHAWK_API_KEY>" --transport stdio stackhawk -- uvx stackhawk-mcp

Requires: STACKHAWK_API_KEY (secret)

Commands built only from what the marketplaces declare; the full set for every client is on each card.

Tools each declares

Only Vuln NIST declares

cve_change_history
cves_by_cpe
get_cve_by_id
get_temporal_context
kevs_between
search_cves

Only com.stackhawk/stackhawk declares

get_app_findings_for_triage
get_organization_info
list_applications
run_stackhawk_scan
setup_stackhawk_for_project
validate_field_exists
validate_stackhawk_config

Both declare

None

Tool names as each marketplace publishes them. More tools is not better in itself: compare what each needs for the job.

Settings each asks for

The marketplaces of Vuln NIST publish no settings it asks for, so we do not compare settings.

What it can do: Vuln NIST · What it can do: com.stackhawk/stackhawk · Compare two other plugins

Data comes from the Docker MCP Catalog (desktop.docker.com/mcp/catalog) and Docker Hub. Data comes from the Official MCP Registry (registry.modelcontextprotocol.io), CC0 1.0. Figures come from our own regular passes over the marketplaces, last read on 2026-10-14. We publish no contact details for plugin publishers.