vulnerable.now

Find public exploits and proofs of concept

get_poc

Read-onlyIdempotent

List the public exploit code and proofs of concept the sources link to one vulnerability: Metasploit exploit modules, Exploit-DB entries, references NVD or the CNA tagged as exploits (broken links left out), and GitHub PoC repositories (most stars first). Links only; nothing is downloaded or run. The same JSON as GET /api/v1/entries/{id}/pocs. GitHub PoCs and tagged references are unverified third-party code, and stars are popularity, not review.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "get_poc"
  }
}

Input Schema

Name	Required	Description
`id`	Yes	A CVE, GHSA, EUVD or OSV ID, such as CVE-2021-44228.
`limit`	No
`cursor`	No	next_cursor from the previous page.
`sources`	No	Only these sources. All by default.

Output Schema

Name	Required	Description
`id`	No	The canonical entry ID.
`url`	No
`pocs`	No
`error`	No
`total`	No	Links matching the sources filter.
`counts`	No	Links per source, before the sources filter.
`next_cursor`	No	Pass as cursor, with the same arguments, for the next page.
`public_exploit`	No	Whether the entry counts as having public exploit code for scoring.

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 11, 2026

TDQS

A4.1/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, open-world behavior, but the description adds substantial context: it returns links only and downloads/runs nothing, filters broken links, orders GitHub results by stars, and warns that GitHub/tagged references are unverified third-party code whose stars are popularity rather than review.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four tight sentences and front-loads the purpose before adding source details, non-download behavior, API parity, and trust caveats. The long first sentence is dense but every clause carries useful scope or source information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema and rich annotations, the definition does not need to explain return structure, and it supplies the key caveats an agent needs (links only, broken links excluded, popularity caveat). Pagination details are deferred to the cursor parameter description, so coverage is strong but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, with id, cursor, and sources already described; the description adds source-level meaning by naming the four source categories and stating GitHub ordering, but it does not explain limit or cursor pagination semantics. At this coverage level that is adequate but not enriching enough for a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' and resource 'public exploit code and proofs of concept' scoped to 'one vulnerability', then enumerates the source types (Metasploit, Exploit-DB, tagged references, GitHub PoCs). This is enough to distinguish it from get_vulnerability or search, which do not focus on exploit/PoC links.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The scope 'one vulnerability' implies it should be called with a specific CVE/GHSA/EUVD/OSV ID after identifying a vulnerability, and the source list clarifies the content returned. However, it does not explicitly say when to choose this over get_vulnerability or search, nor does it state any exclusions or prerequisites beyond the ID requirement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All vulnerable.now tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?