cisa-cybersecurity-mcp-server

cisa_get_ssvc

cisa_get_ssvc

Read-onlyIdempotent

Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`cveIds`	Yes	CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check.
`assetExposure`	No	Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. "unknown" returns both arms so the spread is visible without guessing.	unknown

Output Schema

TableJSON Schema

Name	Required	Description
`echo`	No	The request as the server parsed it.
`error`	No	Present when the call failed. Absent on success.
`notice`	No	Guidance when nothing was enriched, or when a decision timestamp predates KEV.
`results`	No	One result per requested CVE, in the order supplied.
`foundCount`	No	How many CVEs carry published SSVC decision points.
`notFoundCount`	No	How many CVEs do not.

Schema Changelog

Changes observed during successful MCP inspections.

First observedSep 20, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly and idempotent annotations, the description discloses important behaviors: misses return 'found false with guidance rather than an error,' the computed timeline is not CISA's own due-date assignment and can differ when the CVE is in KEV, and the lookup uses live enrichment per CVE. These are substantive behavioral details that help an agent set expectations correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than a typical one-liner, but every sentence adds necessary context: core function, computed-timeline limitations, miss behavior, and vocabulary reference. It is front-loaded with the primary action and structured so caveats follow naturally.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema, the description covers the essential context: what data is fetched, how the timeline is computed, what is excluded, how misses behave, and where to get supporting vocabulary. An agent has enough guidance to invoke the tool correctly and interpret unexpected results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description boosts understanding by explaining how assetExposure is the one BOD 26-04 decision point CISA cannot publish and that the supplied exposure drives the timeline computation. It also ties cveIds to per-CVE enrichment, reinforcing why the cap is lower than the sibling status tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: 'Fetch the SSVC decision points CISA publishes per CVE' and 'compute the BOD 26-04 remediation timeline.' It clearly distinguishes the tool from siblings by focusing on SSVC enrichment plus timeline computation, not on generic CVE status, advisories, or KEV search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool, including what it does and key caveats such as 'not every CVE is enriched' and 'not a compliance determination.' It also explicitly routes users to cisa_list_reference for decision-point vocabulary, but it does not contrast this tool with cisa_check_cve_status or cisa_search_kev as directly as it could.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All cisa-cybersecurity-mcp-server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.