NVD records mentioning the Model Context Protocol, 1 January - 25 September 2026: data and code

Data and code behind the NVD analysis in Section 4.2 and Figure 2 of Securing AI Agents in Cyber-Physical Systems: A Survey of Environmental Interactions, Deepfake Threats, and Defenses (submitted to ACM Computing Surveys). The record holds the query parameters, the archived raw NVD API 2.0 responses (retrieved 26 September 2026), the list of 561 CVE records, the three exclusions with reasons, the CWE-to-family rules, and the scripts that reproduce every count the paper reports. The result is a dated, keyword-derived sample, not a census of MCP vulnerabilities; see the README for the method and limitations. Code: MIT License. Data and results: CC BY 4.0. NVD and CVE data are used under their own terms (see README).