search_vulnerabilities
Read-onlyIdempotent
Search for CVEs by keyword and filter by severity, exploit availability, CISA KEV status, ransomware, and more to find relevant vulnerabilities with scores and exploitation signals.
Instructions
Search the Exploit Intelligence Platform for vulnerabilities (CVEs). Returns a list of matching CVEs with CVSS scores, EPSS exploitation probability, exploit counts, CISA KEV status, VulnCheck KEV, InTheWild.io exploitation signals, and ransomware attribution. Supports full-text search, severity/vendor/product/ecosystem/CWE filters, CVSS/EPSS thresholds, plus any_exploited and ransomware filters. When sort is omitted, the API may automatically prefer newest exploitation, exploit, or nuclei-template activity based on the filters you set. Examples: query='apache httpd' with has_exploits=true; vendor='fortinet' with severity='critical' and is_kev=true sorted by epss_desc; any_exploited=true with ransomware=true for ransomware-linked CVEs; cwe='89' with min_cvss=9 for critical SQL injection CVEs.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Search keywords (e.g. 'apache httpd', 'log4j'). Optional if filters are provided. | |
| severity | No | Filter by severity level | |
| has_exploits | No | Only return CVEs with public exploit code | |
| is_kev | No | Only return CISA Known Exploited Vulnerabilities | |
| any_exploited | No | Only return CVEs exploited in the wild (CISA KEV + VulnCheck KEV + InTheWild.io) | |
| ransomware | No | Only return CVEs with confirmed ransomware campaign use | |
| has_nuclei | No | Only return CVEs with Nuclei scanner templates | |
| vendor | No | Filter by vendor name (e.g. 'microsoft', 'fortinet') | |
| product | No | Filter by product name (e.g. 'exchange', 'pan-os') | |
| ecosystem | No | Filter by package ecosystem | |
| cwe | No | Filter by CWE ID (e.g. '79' or 'CWE-79') | |
| min_cvss | No | Minimum CVSS v3 score (0-10) | |
| min_score | No | Minimum score for the selected score_version (0-10) | |
| score_version | No | Score family for min_score / score_desc | |
| min_epss | No | Minimum EPSS score (0-1) | |
| year | No | Filter by CVE year (e.g. 2024) | |
| date_from | No | Start date for CVE publication (YYYY-MM-DD) | |
| date_to | No | End date for CVE publication (YYYY-MM-DD) | |
| sort | No | Sort order. Aliases are normalized to the current server schema. | |
| page | No | Page number (default: 1) | |
| per_page | No | Results per page (1-25, default: 10) |
Implementation Reference
- eip_mcp/server.py:218-351 (registration)Tool registration for search_vulnerabilities: defines the Tool object with name, description, inputSchema (all parameters), and read-only annotations.
TOOLS = [ types.Tool( name="search_vulnerabilities", annotations=_ro_annotations("Search Vulnerabilities"), description=( "Search the Exploit Intelligence Platform for vulnerabilities (CVEs). " "Returns a list of matching CVEs with CVSS scores, EPSS exploitation " "probability, exploit counts, CISA KEV status, VulnCheck KEV, " "InTheWild.io exploitation signals, and ransomware attribution. " "Supports full-text search, severity/vendor/product/ecosystem/CWE filters, " "CVSS/EPSS thresholds, plus any_exploited and ransomware filters. " "When sort is omitted, the API may automatically prefer newest " "exploitation, exploit, or nuclei-template activity based on the filters " "you set. " "Examples: query='apache httpd' with has_exploits=true; " "vendor='fortinet' with severity='critical' and is_kev=true sorted by epss_desc; " "any_exploited=true with ransomware=true for ransomware-linked CVEs; " "cwe='89' with min_cvss=9 for critical SQL injection CVEs." ), inputSchema={ "type": "object", "properties": { "query": { "type": "string", "maxLength": 200, "description": "Search keywords (e.g. 'apache httpd', 'log4j'). Optional if filters are provided.", }, "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"], "description": "Filter by severity level", }, "has_exploits": { "type": "boolean", "description": "Only return CVEs with public exploit code", }, "is_kev": { "type": "boolean", "description": "Only return CISA Known Exploited Vulnerabilities", }, "any_exploited": { "type": "boolean", "description": "Only return CVEs exploited in the wild (CISA KEV + VulnCheck KEV + InTheWild.io)", }, "ransomware": { "type": "boolean", "description": "Only return CVEs with confirmed ransomware campaign use", }, "has_nuclei": { "type": "boolean", "description": "Only return CVEs with Nuclei scanner templates", }, "vendor": { "type": "string", "maxLength": 100, "description": "Filter by vendor name (e.g. 'microsoft', 'fortinet')", }, "product": { "type": "string", "maxLength": 100, "description": "Filter by product name (e.g. 'exchange', 'pan-os')", }, "ecosystem": { "type": "string", "enum": ["npm", "pip", "maven", "go", "crates", "nuget", "rubygems", "composer"], "description": "Filter by package ecosystem", }, "cwe": { "type": "string", "pattern": _CWE_PATTERN, "maxLength": 12, "description": "Filter by CWE ID (e.g. '79' or 'CWE-79')", }, "min_cvss": { "type": "number", "minimum": 0, "maximum": 10, "description": "Minimum CVSS v3 score (0-10)", }, "min_score": { "type": "number", "minimum": 0, "maximum": 10, "description": "Minimum score for the selected score_version (0-10)", }, "score_version": { "type": "string", "enum": ["v3", "v4", "effective"], "description": "Score family for min_score / score_desc", }, "min_epss": { "type": "number", "minimum": 0, "maximum": 1, "description": "Minimum EPSS score (0-1)", }, "year": { "type": "integer", "minimum": 1999, "maximum": 2030, "description": "Filter by CVE year (e.g. 2024)", }, "date_from": { "type": "string", "pattern": _DATE_PATTERN, "description": "Start date for CVE publication (YYYY-MM-DD)", }, "date_to": { "type": "string", "pattern": _DATE_PATTERN, "description": "End date for CVE publication (YYYY-MM-DD)", }, "sort": { "type": "string", "enum": [ "newest", "published_newest", "oldest", "published_oldest", "cvss_desc", "score_desc", "epss_desc", "relevance", "signal_newest", "exploit_newest", "nuclei_newest", ], "description": "Sort order. Aliases are normalized to the current server schema.", }, "page": _PAGE_SCHEMA, "per_page": _per_page_schema(maximum=25, default=10), }, }, ), - eip_mcp/server.py:1518-1519 (registration)Dispatch table mapping 'search_vulnerabilities' string to _tool_search handler function.
_TOOLS_WITH_ARGS: dict[str, Callable[[dict[str, Any]], str]] = { "search_vulnerabilities": _tool_search, - eip_mcp/server.py:1245-1256 (handler)Handler function _tool_search(): validates params via declarative field spec, calls api_client.search_vulns(), formats results via formatters.format_search_results().
def _tool_search(args: dict[str, Any]) -> str: params: dict[str, Any] = {} _apply_field_spec(args, params, _VULN_SEARCH_FIELDS) for bool_key in _VULN_SEARCH_BOOL_FIELDS: _copy_bool_arg(args, params, bool_key) params.setdefault("per_page", 10) if not params or all(k in ("per_page", "page") for k in params): raise ValidationError("Provide a search query or at least one filter.") data = api_client.search_vulns(params) return formatters.format_search_results(data) - eip_mcp/server.py:1194-1224 (schema)Field specs _VULN_SEARCH_FIELDS and _VULN_SEARCH_BOOL_FIELDS mapping arg keys to API params with validators.
# Declarative field spec for _tool_search. Each entry is # (arg_key, params_key, validator, present_check). # present_check = "truthy" → only copy if args.get(key) is truthy # present_check = "not_none" → copy if key is present and value is not None # (lets through 0/0.0/False) _VULN_SEARCH_FIELDS: tuple[tuple[str, str, Callable[[Any], Any], str], ...] = ( ("query", "q", validators.validate_query, "truthy"), ("severity", "severity", validators.validate_severity, "truthy"), ("vendor", "vendor", validators.validate_vendor, "truthy"), ("product", "product", validators.validate_product, "truthy"), ("ecosystem", "ecosystem", validators.validate_ecosystem, "truthy"), ("cwe", "cwe", validators.validate_cwe, "truthy"), ("score_version", "score_version", validators.validate_score_version, "truthy"), ("date_from", "date_from", validators.validate_date, "truthy"), ("date_to", "date_to", validators.validate_date, "truthy"), ("sort", "sort", validators.validate_sort, "truthy"), ("min_cvss", "min_cvss", validators.validate_cvss, "not_none"), ("min_score", "min_score", validators.validate_cvss, "not_none"), ("min_epss", "min_epss", validators.validate_epss, "not_none"), ("year", "year", validators.validate_year, "not_none"), ("page", "page", validators.validate_page, "not_none"), ("per_page", "per_page", validators.validate_per_page, "not_none"), ) _VULN_SEARCH_BOOL_FIELDS: tuple[str, ...] = ( "has_exploits", "is_kev", "any_exploited", "ransomware", "has_nuclei", ) - eip_mcp/api_client.py:146-149 (helper)API client search_vulns() - sends GET request to /api/v1/vulns with cleaned parameters.
def search_vulns(params: dict[str, Any]) -> dict[str, Any]: """Search vulnerabilities. Returns raw API response dict.""" clean = {k: v for k, v in params.items() if v is not None} return _request_json("/api/v1/vulns", params=clean)