Skip to main content
Glama

ZEN SecDB

by cloud.nttzen.secdb
OverviewDiscussionsAdmin

vulnerability_search

Read-onlyIdempotent

Perform a full-text vulnerability search in SecDB.

What this tool does

Searches across:

  • CVE entries

  • Security advisories

  • Exploit references

  • Product and vendor vulnerability data

Results are formatted in Markdown and include a search summary.

Searchable fields (Lucene syntax supported):

  • type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei

  • id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234)

  • title: resource title or name

  • summary: short summary

  • description: full description text

  • alias: known vulnerability names (e.g. alias:log4shell)

  • severity: critical, high, medium, low

  • kev: true/false — CISA KEV catalog membership

  • status: NVD status (CVE only) e.g. analyzed, modified

  • published: publication date (e.g. published:[2026-01-01 TO 2026-12-31])

  • modified: last modification date

  • source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet)

  • cve: related CVE ID (e.g. cve:CVE-2026-44827)

  • cwe: related CWE ID (e.g. cwe:CWE-79)

  • tag: advisory tag (e.g. tag:scada, tag:ics)

  • attack_vector: network, adjacent, local, physical

  • cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0])

Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards.

Examples:

  • "apache struts rce" → RCE vulnerabilities in Apache Struts

  • "id:CVE-2026-44827" → exact CVE lookup

  • "source:fortinet AND severity:critical" → critical Fortinet advisories

  • "alias:log4shell" → Log4Shell by alias

  • "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE

  • "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs

  • "tag:scada AND severity:high" → high severity ICS/SCADA advisories

When to use this tool

Use this tool when the user asks:

  • to look up a CVE, advisory, exploit, or product

  • "show vulnerabilities for X"

  • "search for advisories about Y"

  • exploratory or broad vulnerability discovery

Inputs

  • query: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.)

Outputs

  • results: array of Markdown-formatted search hits

  • summary: Markdown summary with counts and a link to continue searching on SecDB

LLM usage guidelines

  • Use this tool instead of assuming whether a CVE/advisory/exploit exists.

  • Present results and summary directly to the user-they are already Markdown.

  • Combine with vulnerability_score, epss_timeseries, or sightings_search for deeper analysis.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
queryYesCVE ID, vulnerability name, Advisory ID, Exploit, etc.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultsNo
summaryNoSearch summary with found records (ID) and link for continue the search on SecDB

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive, and closed-world behavior. The description adds substantial behavioral context beyond that: the exact searchable fields, supported Lucene syntax, default AND operator, result formatting as Markdown, and the presence of a search summary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is long but well structured with headings and front-loaded purpose, making it easy to scan. Some sections, particularly Inputs and Outputs, repeat what the schema and output schema already convey, so it is not maximally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter search tool with rich annotations and an output schema, the description is highly complete: it explains scope, syntax, examples, output format, and usage guidance. An agent has everything needed to call and interpret the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and there is only one parameter, but the description dramatically enriches its meaning by explaining Lucene syntax, listing searchable fields with examples, and showing concrete query patterns. This goes far beyond the schema's brief parameter note.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource — performing a full-text vulnerability search in SecDB — and enumerates the exact content types covered. It further distinguishes its exploratory search role from sibling analysis tools by naming vulnerability_score, epss_timeseries, and sightings_search as complementary functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear when-to-use guidance with concrete user request examples such as looking up a CVE, advisory, exploit, or product, and labels the tool for exploratory or broad discovery. It does not explicitly name a when-not or a direct alternative for detailed single-record lookups, though it does route deeper analysis to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ZEN SecDB toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources