Skip to main content
Glama

first-epss-mcp-server

Epss Get Scores

epss_get_scores
Read-onlyIdempotent

Retrieve latest available or historically dated FIRST EPSS probability and percentile for supplied CVEs. Process up to 500 unique entries from batchOffset; response byte limits can return fewer whole entries. Resume with nextBatchOffset as batchOffset, the original cves and returned score date as date. deferredCves were not queried; withheldCves were processed but omitted, and either list can be a declared preview. Missing scores remain unknown; use epss_list_reference for coverage and interpretation.

Input Schema

NameRequiredDescriptionDefault
cvesYesOne to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted.
dateNoUTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data.
batchOffsetNoResume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs.

Output Schema

NameRequiredDescriptionDefault
errorNoPresent when the call failed. Absent on success.
noticeNoMissing-data, deferred-work or model-metadata caveats.
scoresNoForecasts ordered by EPSS descending then CVE.
provenanceNoSource and model attribution.
batchOffsetNoStarting offset in the original normalized unique input.
deferredCvesNoNever-queried identifiers beyond this call workload cap; complete unless deferredCvesComplete is false. Resume using nextBatchOffset and the original submission.
unscoredCvesNoRetained processed identifiers without scores, in request order.
withheldCvesNoAlready processed identifiers withheld by the byte budget, in original input order; may be a preview.
budgetLimitedNoTrue when whole entries or accounting lists were shortened to fit the serialized response budget.
deferredCountNoIdentifiers beyond this call workload cap, not queried.
returnedCountNoProcessed identifiers whose complete score, history or unscored entry is included.
withheldCountNoProcessed identifiers withheld by the response byte budget; queried valid entries are included in processedCount.
duplicateCountNoDuplicate submitted entries removed.
processedCountNoUnique identifiers processed, including invalid formats.
requestedCountNoUnique normalized identifiers submitted.
nextBatchOffsetNoResume with this batchOffset and the original cves, returned date and original severity/policy inputs.
deferredCvesCompleteNoTrue when deferredCves includes every never-queried deferred identifier.
withheldCvesCompleteNoTrue when withheldCves includes every withheld identifier.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/idempotent annotations: discloses the 500-unique-entry processing cap, that response byte limits can return fewer whole entries, the exact resume protocol, and the semantics of deferredCves, withheldCves, previews, and unknown scores. These are non-obvious batch behaviors an agent cannot infer from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It leads with the core purpose and then packs pagination, response-partitioning, and alternative-tool guidance into short clauses without filler. It is dense – several concepts per sentence – but every sentence carries operational information for a batch tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, yet the description still explains the response partitioning (deferred/withheld/missing) and how to continue iterating, which is exactly the extra context an agent needs for a paginated batch call. Nothing required to invoke or resume it correctly is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: batchOffset is a resume cursor into first-occurrence normalized unique order, capped at 500 processed entries, and must be paired with the original cves and returned score date. That constrains usage in a way the schema's plain integer description does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (retrieve) and resource (FIRST EPSS probability and percentile) for supplied CVEs, and immediately scopes it to either latest or historically dated data. This distinguishes it from epss_get_timeseries (temporal series) and from epss_list_reference, which it names as the coverage/interpretation tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operational guidance: resume with nextBatchOffset as batchOffset, resubmit original cves and returned score date, and use epss_list_reference for coverage and interpretation. It does not explicitly say when to prefer epss_get_timeseries or epss_prioritize_cves instead, so the sibling routing is partial rather than complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.