SiteCheck Web Intel

EPSS for one CVE from FIRST's public API: the estimated

security_epss_exploit_score

Read-only

EPSS (Exploit Prediction Scoring System) for one CVE from FIRST's public API: the estimated probability (0 to 1) of exploitation in the next 30 days, its percentile among all scored CVEs and the scoring date. EPSS predicts; it does not say an exploit exists (see cisa-known-exploits). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "cveId": "<cveId>"
    },
    "name": "security_epss_exploit_score"
  }
}

Input Schema

Name	Required	Description	Default
`cveId`	Yes	CVE identifier such as CVE-2021-44228 (required)

Output Schema

Name	Required	Description	Default
`date`	No
`epss`	No
`cveId`	No
`scored`	No
`source`	No
`checkedAt`	No
`percentile`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint; the description adds behavior the agent genuinely needs — data source (FIRST public API), the scoring semantics, and a full billing model: $0.002 USDC per successful call via x402 on Base/Solana/Arc, with failed calls uncharged. The price and charge-on-success distinction are exactly the kind of non-obvious operational fact annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose and return values before the pricing caveat and the sibling pointer. Every clause carries information; only the payment-rail enumeration (Base, Solana or Arc) is slightly more than an agent needs to pick and call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only lookup with an output schema present, the definition covers what the tool does, what it returns conceptually, what it does not establish, the alternative, and the cost model. Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage including a concrete example (CVE-2021-44228), so the schema already does the work. The description's "for one CVE" confirms single-identifier scope but adds no format, casing, or validation detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific resource and verb: EPSS score for one CVE from FIRST's public API, and immediately enumerates the three returned values (probability 0-1, percentile, scoring date). It also explicitly separates itself from the sibling security_cisa_known_exploits, so an agent can choose between them without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause "EPSS predicts; it does not say an exploit exists (see cisa-known-exploits)" names the closest alternative and the condition that distinguishes them, which is real routing guidance. It stops short of stating the forward use case (e.g., prioritization/triage) that would tell an agent when to reach for EPSS in the first place.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteCheck Web Intel tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?