Skip to main content
Glama
Sign In
vulnerability-exposure-mcp

vulnerability-exposure-mcp

by MRFrazer25
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Version vulnerability check

version_specific_vulnerability_check
Read-onlyIdempotent

Checks whether a specific software version is affected by confirmed CVEs using NVD CPE data, ranks findings by CISA KEV, EPSS and CVSS, and reports patch status and minimum safe version.

Instructions

Best tool for software risk. Finds CVEs whose NVD CPE data confirms they affect this exact product version, ranks them by CISA KEV status, EPSS and CVSS, gives each one's patch status and the minimum safe version, and reports CVEs ruled out. Use for every product with a known version (e.g. from Shodan). software_name e.g. 'nginx', 'Apache httpd', 'OpenSSH'; version e.g. '1.20.1' or '8.9p1' (omit only if unknown).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "software_name": "<software_name>"
    },
    "name": "version_specific_vulnerability_check"
  }
}

Input Schema

NameRequiredDescriptionDefault
versionNoThe exact version, e.g. '1.20.1' or '8.9p1'. Leave it out only when the version is unknown.
software_nameYesThe product name, e.g. 'nginx', 'Apache httpd', 'OpenSSH' or 'Next.js'.
investigation_idNoThe investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv1.0.1
    • addedInput schema / properties / investigation_id / description
      Added value: +"The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own."
    • addedInput schema / properties / software_name / description
      Added value: +"The product name, e.g. 'nginx', 'Apache httpd', 'OpenSSH' or 'Next.js'."
    • addedInput schema / properties / version / description
      Added value: +"The exact version, e.g. '1.20.1' or '8.9p1'. Leave it out only when the version is unknown."
  2. First observedv0.1.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, open-world), so the description's value is in disclosing methodology and output: ranking by KEV/EPSS/CVSS, per-CVE patch status and minimum safe version, plus CVEs explicitly ruled out. That is real added context beyond the annotations, though nothing is said about cost, rate limits, or result size.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and ranking behavior are front-loaded in the first sentence, which is dense but earns its place. The trailing parameter-example clause largely duplicates the schema text and is the one part that could be cut without loss.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must convey return shape — and it does, listing ranked CVEs, patch status, minimum safe version, and ruled-out CVEs. Combined with 100% schema coverage on inputs, an agent has everything needed to call and interpret it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented, and the description's examples ('nginx', '1.20.1') merely echo the schema. The investigation_id parameter, including its effect on evidence and budget, is not mentioned in the description at all; the schema carries it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: finds CVEs whose NVD CPE data confirms they affect this exact product version, then ranks them by KEV/EPSS/CVSS. The CPE-confirmation detail clearly separates it from siblings like nvd_lookup, cve_search and cisa_kev_check, which do not do version-matched correlation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use for every product with a known version (e.g. from Shodan)" gives a concrete trigger, and "omit only if unknown" bounds the fallback case. It does not explicitly name alternatives or state when another sibling (e.g. distro_patch_check) should be preferred, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools