vuln_kev_latest

Instructions

Implementation Reference

• servers/cybersecurity-vuln-mcp/src/main.ts:248-295 (handler)

  Primary handler registration for the 'vuln_kev_latest' tool using McpServer.tool(). Calls getLatestKevEntries() helper, formats response with attribution, and includes gateway authentication.

  // ---- Tool 3: Recent KEV Entries ----
  
  mcpServer.tool(
    "vuln_kev_latest",
    "Get recently added entries from the CISA Known Exploited Vulnerabilities (KEV) catalog. These are vulnerabilities confirmed to be actively exploited in the wild and require immediate remediation for federal agencies.",
    {
      days: z.number().int().min(1).max(365).default(7).describe("Look back N days (default 7)"),
      limit: z.number().int().min(1).max(100).default(20),
      _gatewayToken: z.string().optional().describe("Internal gateway token"),
    },
    async ({ days, limit, _gatewayToken }) => {
      if (!_gatewayToken || _gatewayToken !== GATEWAY_SECRET) {
        await Actor.charge({ eventName: "tool-request" });
      }
  
      try {
        const entries = await getLatestKevEntries(days, limit);
  
        const response = {
          period: `Last ${days} days`,
          count: entries.length,
          entries: entries.map((e) => ({
            cveId: e.cveID,
            vendor: e.vendorProject,
            product: e.product,
            name: e.vulnerabilityName,
            dateAdded: e.dateAdded,
            dueDate: e.dueDate,
            requiredAction: e.requiredAction,
            ransomwareUse: e.knownRansomwareCampaignUse,
            description: e.shortDescription,
          })),
          attribution: { kev: ATTRIBUTION.kev },
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(response, null, 2) }],
          structuredContent: response,
          isError: false,
        };
      } catch (error) {
        const msg = error instanceof Error ? error.message : String(error);
        return {
          content: [{ type: "text" as const, text: `Error fetching KEV entries: ${msg}` }],
          isError: true,
        };
      }
    },

• servers/cybersecurity-vuln-mcp/src/stdio.ts:192-218 (handler)

  Alternative stdio-based handler registration for 'vuln_kev_latest' tool. Similar logic but without gateway token/charging, used for stdio transport mode.

  mcpServer.tool(
    "vuln_kev_latest",
    "Get recently added CISA KEV entries (actively exploited vulnerabilities).",
    {
      days: z.number().int().min(1).max(365).default(7).describe("Look back N days"),
      limit: z.number().int().min(1).max(100).default(20),
    },
    async ({ days, limit }) => {
      try {
        const entries = await getLatestKevEntries(days, limit);
        const response = {
          period: `Last ${days} days`,
          count: entries.length,
          entries: entries.map((e) => ({
            cveId: e.cveID, vendor: e.vendorProject, product: e.product,
            name: e.vulnerabilityName, dateAdded: e.dateAdded, dueDate: e.dueDate,
            requiredAction: e.requiredAction, ransomwareUse: e.knownRansomwareCampaignUse,
            description: e.shortDescription,
          })),
          attribution: { kev: ATTRIBUTION.kev },
        };
        return { content: [{ type: "text" as const, text: JSON.stringify(response, null, 2) }], isError: false };
      } catch (error) {
        const msg = error instanceof Error ? error.message : String(error);
        return { content: [{ type: "text" as const, text: `Error fetching KEV entries: ${msg}` }], isError: true };
      }
    },

• servers/cybersecurity-vuln-mcp/src/lib/kev.ts:56-69 (helper)

  Core helper function getLatestKevEntries() that loads the CISA KEV JSON catalog, filters entries added within the given number of days, sorts by date descending, and returns up to 'limit' entries.

  export async function getLatestKevEntries(
    days: number,
    limit: number,
  ): Promise<KevEntry[]> {
    const catalog = await loadCatalog();
    const cutoff = new Date();
    cutoff.setDate(cutoff.getDate() - days);
    const cutoffStr = cutoff.toISOString().slice(0, 10);
  
    return catalog.vulnerabilities
      .filter((v) => v.dateAdded >= cutoffStr)
      .sort((a, b) => b.dateAdded.localeCompare(a.dateAdded))
      .slice(0, limit);
  }

• servers/cybersecurity-vuln-mcp/src/main.ts:253-257 (schema)

  Zod schema definitions for the tool: days (1-365, default 7), limit (1-100, default 20), and optional _gatewayToken.

  {
    days: z.number().int().min(1).max(365).default(7).describe("Look back N days (default 7)"),
    limit: z.number().int().min(1).max(100).default(20),
    _gatewayToken: z.string().optional().describe("Internal gateway token"),
  },

• gateway/src/routes/cyber.ts:51-69 (registration)

  Gateway Express route that forwards GET /kev/latest requests to the MCP tool 'vuln_kev_latest' with optional 'days' and 'limit' query parameters.

  // GET /api/v1/cyber/kev/latest
  router.get("/kev/latest", async (req: Request, res: Response) => {
      const start = Date.now();
      const tool = "vuln_kev_latest";
      try {
          const data = await callMcpTool({
              serverName: SERVER,
              toolName: tool,
              args: {
                  ...(req.query.days && { days: Number(req.query.days) }),
                  ...(req.query.limit && { limit: Number(req.query.limit) }),
              },
          });
          res.json(successResponse(data, tool, Date.now() - start, SERVER));
      } catch (error) {
          const msg = error instanceof Error ? error.message : String(error);
          res.status(502).json(errorResponse(msg, tool, Date.now() - start, SERVER));
      }
  });