psirt-exposure
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NETBOX_URL | No | Base URL of the NetBox instance with scheme and no /api suffix, e.g. http://127.0.0.1:8000; needed for --netbox inventory. | |
| NETBOX_TOKEN | No | NetBox API token (v1: 40 hex chars, or v2: nbt_<key>.<secret>); needed for --netbox inventory. | |
| CISCO_CLIENT_ID | No | Client ID of a free Cisco API Console app with the PSIRT openVuln API; needed for live advisory/version data (check without --offline). | |
| CISCO_CLIENT_SECRET | No | Client secret of a free Cisco API Console app with the PSIRT openVuln API; needed for live advisory/version data (check without --offline). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_devicesA | List inventory devices with platform (PID) and IOS XE version. inventory: "files" (sample config directory) or "netbox". netbox_filter: NetBox device query parameters, e.g. {"site": "psirt-lab"}. |
| list_rulesA | List the reviewed advisory rules: id, advisory, CVEs, title and exposure summary. |
| checkA | Match advisory rules against device configs; one verdict per device and rule. Verdicts: AFFECTED, NOT_AFFECTED_FEATURE_DISABLED, FIXED_VERSION, MITIGATED, INDETERMINATE. Each item has the reason, redacted evidence lines, runtime checks to run on the device and CISA KEV entries. devices / rules: names from list_devices / list_rules (default: all). versions: "csaf" (local CSAF files, offline), "openvuln" (live Cisco API) or "none". kev: "none" or "cisa" (download the CISA KEV feed). only_findings: keep only AFFECTED, INDETERMINATE and MITIGATED items. |
| reportB | Render a Markdown or HTML report: summary, per-device counts, and findings with evidence and mitigation / remediation config snippets. Arguments as for check. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool has a clearly distinct role: listing advisory rules, listing inventory devices, matching rules to configs, and rendering a report. The check/report pair share arguments, but their outputs and purposes are clearly separated.
Names are all lowercase snake_case and readable, with list_rules/list_devices following a verb_noun pattern. check and report are bare verbs, which is a minor deviation but not confusing.
Four tools are well-scoped for a PSIRT exposure workflow: discover rules, discover devices, analyze exposure, and report findings. Each tool earns its place without redundancy.
The surface covers the core lifecycle from inventory and advisory listing through assessment and reporting. Minor gaps exist, such as no standalone advisory-detail or runtime-check execution tool, but these are not critical for the stated purpose.