ZEN SecDB

cwe_info

Read-onlyIdempotent

Get information about a specific weakness (CWE), its related attack patterns (CAPEC) and ATT&CK techniques.

What this tool does

Returns the name and description of a CWE, its type, the related CAPEC attack patterns, the ATT&CK techniques mapped to those attack patterns, and the number of CVEs linked to it, with how many of them are in the CISA KEV and EU KEV catalogs.

When to use this tool

Use this tool when the user asks:

"What is CWE-79?"
"Which attack patterns are related to this weakness?"
"Which ATT&CK techniques are related to this weakness?"
"How often is this weakness exploited in the wild?"

Inputs

cwe_id: CWE identifier (CWE-79 or 79).

Outputs

id, name, type, description
capec: related attack patterns, each with id and name
attack: ATT&CK techniques mapped to these attack patterns (active techniques only), each with id, name and via (the CAPEC it comes from)
cve_count: number of CVEs linked to this CWE
cisa_kev_count: how many of these CVEs are in the CISA KEV catalog
eu_kev_count: how many of these CVEs are in the EU KEV catalog
kev_count: how many of these CVEs are in at least one of the two catalogs
url: link to the CWE on SecDB

LLM usage guidelines

Do not explain a CWE from memory when the user needs the official definition: use this tool.
Do not add cisa_kev_count and eu_kev_count: a CVE can be in both catalogs. Use kev_count for the total.
Use attack_info for the details of an ATT&CK technique.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "cwe_id": "<cwe_id>"
    },
    "name": "cwe_info"
  }
}

Input Schema

Name	Required	Description	Default
`cwe_id`	Yes	CWE identifier (CWE-79 or 79)

Output Schema

Name	Required	Description
`id`	Yes	CWE identifier
`url`	Yes	Link to the CWE on SecDB
`name`	Yes	CWE name
`type`	Yes	Type (weakness, category, view)
`capec`	Yes
`attack`	Yes
`cve_count`	Yes	CVEs linked to this CWE
`kev_count`	Yes	Linked CVEs in at least one KEV catalog (CISA or EU)
`description`	No	Description
`eu_kev_count`	Yes	Linked CVEs in the EU KEV catalog
`cisa_kev_count`	Yes	Linked CVEs in the CISA KEV catalog

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedNov 10, 2026

addedOutput schema / properties / attack

Added value: +{
+  "items": {
+    "properties": {
+      "id": {
+        "description": "ATT&CK technique identifier",
+        "type": "string"
+      },
+      "name": {
+        "description": "Technique name",
+        "type": "string"
+      },
+      "via": {
+        "description": "CAPEC it comes from",
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      }
+    },
+    "type": "object"
+  },
+  "type": "array"
+}

changedOutput schema / required

Previous value: -[
-  "id",
-  "name",
-  "type",
-  "capec",
-  "cve_count",
-  "cisa_kev_count",
-  "eu_kev_count",
-  "kev_count",
-  "url"
-]New value: +[
+  "id",
+  "name",
+  "type",
+  "capec",
+  "attack",
+  "cve_count",
+  "cisa_kev_count",
+  "eu_kev_count",
+  "kev_count",
+  "url"
+]

Changed3 schema fields changedNov 4, 2026

addedOutput schema / properties / eu_kev_count

Added value: +{
+  "description": "Linked CVEs in the EU KEV catalog",
+  "type": "integer"
+}

addedOutput schema / properties / kev_count

Added value: +{
+  "description": "Linked CVEs in at least one KEV catalog (CISA or EU)",
+  "type": "integer"
+}

changedOutput schema / required

Previous value: -[
-  "id",
-  "name",
-  "type",
-  "capec",
-  "cve_count",
-  "cisa_kev_count",
-  "url"
-]New value: +[
+  "id",
+  "name",
+  "type",
+  "capec",
+  "cve_count",
+  "cisa_kev_count",
+  "eu_kev_count",
+  "kev_count",
+  "url"
+]

AddedNov 3, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare a read-only, idempotent, closed-world read, but the description adds real behavioral detail beyond them: ATT&CK results are filtered to active techniques only, each carries a 'via' CAPEC provenance field, and CISA/EU KEV counts overlap so kev_count must be used for the union. These are genuine gotchas an agent could not infer from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Headers make it scannable and the purpose/what/when ordering is front-loaded, but the long 'Outputs' enumeration largely duplicates the existing output schema, which costs space without adding decision-relevant information. Still, almost every remaining line contributes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though an output schema exists, the description explains the derivation of the KEV count fields and the active-only ATT&CK filtering, which the schema alone would not convey. For a single-parameter lookup with sibling routing included, nothing an agent needs is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With a single parameter at 100% schema description coverage, the schema already documents cwe_id and its pattern. The description's 'CWE-79 or 79' note merely restates the schema regex and adds no new meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Get information about a specific weakness (CWE)') and enumerates exactly what is returned: name/description/type, related CAPEC attack patterns, mapped ATT&CK techniques, and CVE/KEV counts. It also distinguishes itself from the sibling attack_info, which covers ATT&CK technique details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit trigger questions ('What is CWE-79?', 'Which attack patterns are related...') plus a clear when-not rule ('Do not explain a CWE from memory') and routes the agent to attack_info for deeper ATT&CK technique detail. There is even an exclusion about not summing the two KEV counts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ZEN SecDB tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?