cra-exploit-clock
CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock — Takes a CycloneDX or SPDX JSON SBOM (or a purl list), asks OSV.dev for the advisories that affect each exact component version (OSV evaluates the version ranges per ecosystem), then checks each CVE against the CISA Known Exploited Vulnerabilities catalog and the ENISA EUVD exploited-vulnerability index, and adds FIRST EPSS scores. Returns a per-component verdict, the evidence with source URLs and
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "cra-exploit-clock"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sbom | No | CycloneDX 1.4-1.6 or SPDX 2.2/2.3 JSON SBOM, as an object or a JSON string, up to 5 MB. Components need a purl with a version (SPDX: a purl externalRef). Exactly one of sbom or purls. | |
| purls | No | Alternative to sbom: versioned package URLs, e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Ecosystems: npm, pypi, maven, golang, cargo, nuget, gem, composer, hex, pub, swift. | |
| product | No | Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name). | |
| issue_record | No | Default false. When true, adds a standalone awareness_record (evidence snapshot, SBOM digest, evaluation time; signed with the hub attestation key when configured) for you to retain. It does not switch off the hub's standard signed response credential, which every response carries and which already binds the output and input digests to a timestamp. | |
| awareness_time | No | When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it. | |
| fix_available_at | No | When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date. |