Skip to main content
Glama
K4PXD

cve-mcp-server

by K4PXD
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

Fetch PoC repository contents

cve_fetch_poc_code
Read-onlyIdempotent

Fetch proof-of-concept code from a GitHub repository, including top-level files and README, to inspect exploit implementations for authorized security research and validation.

Instructions

Fetch the actual proof-of-concept material from a GitHub repository: its top-level file listing plus the decoded README (bounded in size).

Use after cve_get_pocs to inspect a specific PoC. Intended for authorized security research and defensive validation. Set GITHUB_TOKEN to raise rate limits and access more repos.

Args:

  • repo (string): 'owner/repo' or a full github.com URL.

  • response_format ('markdown'|'json', default 'markdown').

Returns (json): { fullName, htmlUrl, files[], readme, readmeTruncated }.

Examples:

Errors:

  • "GitHub rate limit exceeded (429)" — set GITHUB_TOKEN.

  • "GitHub has no record for that identifier (404)" — repo not found or private.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repoYesGitHub repo as 'owner/repo' or a full github.com URL (typically from cve_get_pocs).
response_formatNoOutput format: 'markdown' (default, human-readable) or 'json' (full structured data).markdown

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/idempotentHint annotations, the description discloses important runtime behavior: rate-limit errors and the GITHUB_TOKEN remedy, 404 behavior for missing/private repos, bounded README retrieval, and exact return fields. These are meaningful behavioral details an agent needs before invoking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core behavior, then organized into Args, Returns, Examples, and Errors sections. Every section earns its place and there is no filler or repetition of annotation data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With two params, 100% schema coverage, and no output schema, the description fully compensates by documenting return fields, error cases, authentication guidance, and concrete examples. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds practical meaning: repo can be 'owner/repo' or a full github.com URL, examples are given for both forms, and the response_format default and behavior are clarified. This goes beyond the schema's property descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the action: fetching top-level file listing plus decoded README from a GitHub repository, which clearly distinguishes it from sibling tools like cve_get_pocs or cve_get_details. It names the exact resource and scope, and even mentions bounded README size.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use after cve_get_pocs to inspect a specific PoC,' giving clear sequencing against a sibling tool. It also adds intended-use context for authorized security research, though it does not enumerate exclusions for all other sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools