Start here. Classifies the target (public IP, domain or URL, CVE ID, or "software version" such as "nginx 1.20.1") and runs the baseline lookups in code: Shodan, VirusTotal, AbuseIPDB, the registry owner and the keyless threat lists for an IP; DNS, VirusTotal, and the same IP checks for a domain's primary IP. Returns an investigation_id to pass to every other tool, the baseline results and next_steps.

depth sets the tool-call budget and detail: "Quick Scan" (8 calls), "Standard Analysis" (15), "Comprehensive Investigation" (25), "Expert Deep Dive" (40). Private, reserved and cloud-metadata IPs are refused.

Resolve a domain to its public IPv4/IPv6 addresses. Already run for a domain target; use it for other domains you discover.

Shodan host lookup: open ports, services, product versions, hosting org/ASN. Accepts a public IP or a domain (its primary IP is used). Quota-limited: call once per distinct IP. Without SHODAN_API_KEY it falls back to Shodan's free InternetDB: open ports, software, OS and CVEs, but no banners or organisation.

VirusTotal reputation: how many security engines flag the IP/domain as malicious or suspicious. Needs VIRUSTOTAL_API_KEY.

AbuseIPDB abuse reports and confidence score for a public IP address (not domains). Needs ABUSEIPDB_API_KEY.

Best tool for software risk. Finds CVEs whose NVD CPE data confirms they affect this exact product version, ranks them by CISA KEV status, EPSS and CVSS, gives each one's patch status and the minimum safe version, and reports CVEs ruled out. Use for every product with a known version (e.g. from Shodan). software_name e.g. 'nginx', 'Apache httpd', 'OpenSSH'; version e.g. '1.20.1' or '8.9p1' (omit only if unknown).

Is my software affected? Give the products and versions you run (typed, or pasted from a banner or Server header), a lockfile (pinned requirements.txt, package-lock.json) or a CycloneDX SBOM. With cve_id, answers whether that one CVE (e.g. one in the news) affects each of them; without it, lists the confirmed CVEs for each. Every product gets AFFECTED, NOT_AFFECTED or CANT_CONFIRM with the NVD range, package advisory or distro fix that decided it. Lockfile and SBOM packages are checked in one OSV.dev batch call. 'nginx 1.24.0 -> 1.26.2' also shows what the upgrade fixes.

A saved list of the software the user runs, kept in a file on their own machine. 'check' runs am_i_affected on every entry and reports only what changed since the last check: newly confirmed CVEs, CVEs newly added to CISA KEV, EPSS jumps and changed verdicts. The same check runs from a scheduler with the 'vulnerability-exposure-mcp watch' command.

What got exploited recently? CVEs CISA added to its Known Exploited Vulnerabilities catalog in the last few days, newest first, with CISA's required action, the US federal due date, known ransomware use and EPSS. Give products to keep only those that name them (a product match is Related; confirm with am_i_affected). No key.

Who a public IP's network is registered to (organisation, range, country, abuse contact), from the regional internet registry over RDAP. Already run for an IP target; use it for other IPs you find. No key.

Keyless reputation for a public IP: Spamhaus DROP (networks hijacked or run by criminals) and GreyNoise (whether it scans the internet, or is a known business service). Already run for an IP target. GreyNoise allows a limited number of lookups without GREYNOISE_API_KEY.

Hostnames under a domain that have had TLS certificates, from public certificate transparency logs (crt.sh, or Cert Spotter if crt.sh is down). Use it to find other hosts a domain runs; they may no longer exist. No key needed.

Check an Ubuntu or Debian package version against the distro's own security data (via OSV.dev), which counts fixes the distro backports without changing the upstream version. Use it when Shodan lists distro_packages (e.g. OpenSSH_8.9p1 Ubuntu-3ubuntu0.6 gives package 'openssh', package_version '8.9p1-3ubuntu0.6'), or when the user gives an installed package version. Pass the version check's affected_cve_ids as cve_ids. release (e.g. '22.04', '12') is found automatically when possible. No key needed.

Full NVD record for one CVE (e.g. 'CVE-2021-44228'): description, CVSS, CWE, affected product ranges, CISA KEV and EPSS. Not needed for CVEs a version check already returned (they carry severity, EPSS, KEV, exploit and fix): use it for a CVE you have no record of, or to read one's full description and references.

Check CVE IDs and/or product names against CISA's Known Exploited Vulnerabilities catalog. Product matches only show the product has been exploited before, not that a version is affected. Version checks and CVE lookups already give KEV status for their CVEs: use this once per product for its KEV history, or for CVE IDs from elsewhere.

Keyword search of NVD returning the most recent matching CVEs (e.g. 'grafana' or 'log4j'). Not version-aware; prefer version_specific_vulnerability_check when a version is known. Search real product or vendor names, at most twice per product (product, then vendor), never fragments of a name.

Facts computed directly from this investigation's tool results, with no model involved, so they are the same on every run: open ports, network, reputation, version check results, upgrade target, end-of-life, CISA's required action, and the CISA KEV split into "confirmed for this target" (NVD version match, or the CVE being analysed) and "related" (product family or vendor). Also a remediation checklist in priority order and the sources used, with when each was queried. Base the report's claims on these. Values contain third-party text.

Run before giving the final report. Compares your draft with this investigation's tool results and key facts, with no model involved, and lists what they don't support: CVE or advisory IDs no lookup returned, version numbers and EPSS-style percentages that appear nowhere in the data, claims such as "end-of-life", "no patch available" or "internet-facing" that no source makes, unconfirmed CVEs filed as confirmed (and the reverse), misquoted fix versions, upgrade versions named when no version was given, and exploit claims the data doesn't back. Fix or remove each one.

Shows which data-source API keys are configured (never their values) and where to get missing ones. Most lookups work without keys: NVD (just slower), CISA KEV, EPSS, OSV.dev, DNS, the registries, Spamhaus, GreyNoise, SANS ISC, certificate logs, and Shodan's free InternetDB in place of Shodan.