Skip to main content
Glama
datanexusmcp

DataNexus MCP

Official
by datanexusmcp
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

security_fetch_cve_risk_summary

Read-onlyIdempotent

Get a CVE risk verdict by combining CVSS severity, CISA KEV status, and EPSS probability. Returns a risk level and patch availability from vendor advisories.

Instructions

Instant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL_EXPLOIT, HIGH_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources were unreachable — not that risk is low. Rate limit: 60/minute. No auth required. For security engineers triaging vulnerabilities after fetch_cve_watch fires. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_cve_risk_summary", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
cve_idYesCVE identifier e.g. CVE-2021-44228. Required.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv2.1.16
    • addedInput schema / properties / cve_id / description
      Added value: +"CVE identifier e.g. CVE-2021-44228. Required."
  2. Addedv2.1.13

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds rate limit (60/min), no auth required, explanation of UNKNOWN status, and parallel call behavior. Annotations already indicate read-only and idempotent, so description complements them well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with main purpose, includes usage and feedback instructions. Slightly lengthy but each sentence adds value; could be more concise but still efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, behavior, usage scenario, error handling, rate limit, auth, and feedback path. With output schema present, no missing critical information for a single-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and description does not add extra parameter details beyond the schema's example. Baseline 3 is appropriate as schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it combines CVSS, CISA KEV, and EPSS to return a risk verdict, with specific levels (CRITICAL_EXPLOIT, etc.). Distinguishes from siblings like security_fetch_cve_detail and security_fetch_cve_epss by being a combined summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Specifies the tool is for security engineers triaging vulnerabilities after fetch_cve_watch fires, and provides a fallback feedback mechanism. Lacks explicit comparison to other CVE tools but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools