Install CVE Security Advisories (NVD High & Critical) — buy per-query in-session (cvewatch) in Goose

What you need first

• Goose, installed.
• Nothing else: the server runs on its publisher's machines and Goose connects to it.

Steps

1. Open ~/.config/goose/config.yaml. On Windows it is %APPDATA%\Block\goose\config\config.yaml.
2. Add this entry. If the file already has extensions, add only the entry inside it.

extensions:
  "data-cve-security-advisory-vulnerability-database":
    type: streamable_http
    name: "data-cve-security-advisory-vulnerability-database"
    enabled: true
    uri: "https://a2awire.com/mcp/data/cvewatch-cve-security-advisories-nvd-high-critical-9a16b6/http"
    headers: {}
    env_keys: []
    envs: {}
    timeout: 300

3. Save the file and start a new Goose session.

Check it worked

Ask Goose: List the tools of data-cve-security-advisory-vulnerability-database.

If it does not start

401 Unauthorized

The endpoint wants a sign-in or a key. Sign in when Goose asks.

Nothing changes after a restart

The file is not valid YAML any more. Check that the entry is indented like the lines around it.