EchelonGraph CVE & Exposure

Vendor advisory detail

get_vendor_advisory

Read-onlyIdempotent

One vendor advisory in full, by vendor and advisory ID (the vendor and vendor_advisory_id of a vendor advisory row, never its advisory_id): title, description, severity, cvss_v3_score, cve_ids and known_cve_ids (in EchelonGraph's CVE feed), affected_products, remediation, references, vendor_modified_at, and withdrawn_at and withdrawn_reason when the vendor withdrew it. remediations: each the vendor lists, with kind (vendor_fix, workaround, mitigation, no_fix_planned, none_available or other: the vendor's category, or may be no_fix_planned if Cisco's summary says none will be released), source_category, text, url, cve_ids and product_ids; each text is the vendor's, verbatim, untested by EchelonGraph. remediation_state none_in_source or not_parsed is not a finding that no fix exists. Each advisory carries vendor_published_at (the vendor's date), our_first_seen_at (when EchelonGraph first recorded it) and withdrawn (true: the vendor rescinded it). Each advisory also carries rejected_cve_ids: the CVE IDs it names whose CVE record was rejected (withdrawn) by its numbering authority, which are not active vulnerabilities. coverage.vendor_window is what EchelonGraph holds of that vendor: earliest_vendor_published_at, latest_vendor_published_at, held_since (where that window begins), history_backfill (in_progress or not_started: older advisories not all held yet), history_scope and feed_held_since; null if unreadable or empty. measured_at is our_first_seen_at. freshness is null; vendor_window.last_success_at is the last successful poll. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. vendor_text_withheld true (Microsoft): title is EchelonGraph's; description, remediation and item texts are empty; cve_records: its first CVEs, each with its CVE-record description or null.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "vendor": "<vendor>",
      "advisory_id": "<advisory_id>"
    },
    "name": "get_vendor_advisory"
  }
}

Input Schema

Name	Required	Description
`full`	No	true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.
`vendor`	Yes	the vendor slug, e.g. microsoft, redhat, github
`advisory_id`	Yes	the vendor's own advisory ID, a row's vendor_advisory_id, e.g. RHSA-2024:1234, GHSA-xxxx-xxxx-xxxx or CVE-2024-3400; not a row's advisory_id, EchelonGraph's internal UUID

Output Schema

Name	Required	Description	Default
No arguments