vulnerability-exposure-mcp

Overview Schema Source Related Servers Discussions Admin

CISA KEV check

cisa_kev_check

Read-onlyIdempotent

Check CVE IDs or software names against CISA's Known Exploited Vulnerabilities catalog to confirm KEV history for exposure investigations. Product matches show prior exploitation, not version impact.

Instructions

Check CVE IDs and/or product names against CISA's Known Exploited Vulnerabilities catalog. Product matches only show the product has been exploited before, not that a version is affected. Version checks and CVE lookups already give KEV status for their CVEs: use this once per product for its KEV history, or for CVE IDs from elsewhere.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "cisa_kev_check"
  }
}

Input Schema

Name	Required	Description
`cve_ids`	No	CVE IDs, e.g. ['CVE-2021-44228'].
`software_list`	No	Product names, e.g. ['nginx', 'Exchange Server'].
`investigation_id`	No	The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own.

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedv1.0.1Oct 29, 2026

addedInput schema / properties / cve_ids / description
```
Added value: +"CVE IDs, e.g. ['CVE-2021-44228']."
```

addedInput schema / properties / investigation_id / description

Added value: +"The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own."

addedInput schema / properties / software_list / description

Added value: +"Product names, e.g. ['nginx', 'Exchange Server']."

First observedv0.1.0Oct 25, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/openWorld, so safety is covered; the description adds the genuinely important semantic caveat that a product match means historical exploitation, not that a specific version is affected. Remaining gaps are minor (how CVE and product results are merged or returned, given no output schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the verb and target, then the caveat, then the routing guidance. Three sentences with no filler, each carrying decision-relevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers what the tool checks, the key interpretation pitfall for product matches, and when to use it versus version/CVE lookups. With no output schema, some indication of what a hit/miss result looks like would make it fully self-contained, but nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter carries its own description including the investigation_id evidence/budget effect. The description only adds that cve_ids and software_list can be supplied 'and/or' together, which is a small increment over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (check) and two concrete resources (CVE IDs and product names) against a named external catalog. It also pre-empts confusion with the sibling tools (version_specific_vulnerability_check, cve_search/nvd_lookup) by noting those already return KEV status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: 'use this once per product for its KEV history, or for CVE IDs from elsewhere,' and warns that version checks and CVE lookups already supply KEV status so this tool should not be used for that path. Both the when and the when-not are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.