action1-mcp-server

Detailed information on a specific vulnerability in general (not for an…

action1_get_cve_description

Read-onlyIdempotent

Retrieve detailed information about a specific CVE, including attack vector and vulnerability details, to understand security exposure by CVE ID.

Instructions

Detailed information on a specific vulnerability in general (not for an organization), including CVE details like attack vector. Perm: view_vulnerabilities.

Input Schema

Name	Required	Description
`cve_id`	Yes	The unique identifier of a CVE (Common Vulnerabilities and Exposures), e.g. CVE-2005-2300
`verbose`	No	Skip per-item compactor.
`response_format`	No	Output format. Default markdown.

Output Schema

Name	Required	Description	Default
`scope`	No
`cve_id`	No
`safety`	No
`version`	No
`cisa_kev`	No
`recovery`	No
`cve_origin`	No
`cvss_score`	No
`automatable`	No
`description`	No
`impact_score`	No
`access_vector`	No
`attack_vector`	No
`base_severity`	No
`value_density`	No
`vector_string`	No
`authentication`	No
`published_date`	No
`exploit_maturity`	No
`integrity_impact`	No
`provider_urgency`	No
`user_interaction`	No
`access_complexity`	No
`attack_complexity`	No
`attack_requirements`	No
`availability_impact`	No
`privileges_required`	No
`exploitability_score`	No
`integrity_requirement`	No
`confidentiality_impact`	No
`modified_attack_vector`	No
`availability_requirement`	No
`modified_user_interaction`	No
`modified_attack_complexity`	No
`confidentiality_requirement`	No
`modified_attack_requirements`	No
`modified_privileges_required`	No
`vulnerability_response_effort`	No
`cisa_known_ransomware_campaign_use`	No
`subsequent_system_integrity_impact`	No
`vulnerable_system_integrity_impact`	No
`modified_subsequent_system_integrity`	No
`modified_vulnerable_system_integrity`	No
`subsequent_system_availability_impact`	No
`vulnerable_system_availability_impact`	No
`modified_subsequent_system_availability`	No
`modified_vulnerable_system_availability`	No
`subsequent_system_confidentiality_impact`	No
`vulnerable_system_confidentiality_impact`	No
`modified_subsequent_system_confidentiality`	No
`modified_vulnerable_system_confidentiality`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed54 schema fields changedv0.6.0Oct 26, 2026
- changedInput schema / $schema
```
Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
```
- changedOutput schema / $schema
```
Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
```
- changedOutput schema / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / access_complexity
```
Added value: +{}
```
- addedOutput schema / properties / access_vector
```
Added value: +{}
```
- addedOutput schema / properties / attack_complexity
```
Added value: +{}
```
- addedOutput schema / properties / attack_requirements
```
Added value: +{}
```
- addedOutput schema / properties / attack_vector
```
Added value: +{}
```
- addedOutput schema / properties / authentication
```
Added value: +{}
```
- addedOutput schema / properties / automatable
```
Added value: +{}
```
- addedOutput schema / properties / availability_impact
```
Added value: +{}
```
- addedOutput schema / properties / availability_requirement
```
Added value: +{}
```
- addedOutput schema / properties / base_severity
```
Added value: +{}
```
- addedOutput schema / properties / cisa_kev
```
Added value: +{}
```
- addedOutput schema / properties / cisa_known_ransomware_campaign_use
```
Added value: +{}
```
- addedOutput schema / properties / confidentiality_impact
```
Added value: +{}
```
- addedOutput schema / properties / confidentiality_requirement
```
Added value: +{}
```
- addedOutput schema / properties / cve_id
```
Added value: +{}
```
- addedOutput schema / properties / cve_origin
```
Added value: +{}
```
- addedOutput schema / properties / cvss_score
```
Added value: +{}
```
- addedOutput schema / properties / description
```
Added value: +{}
```
- addedOutput schema / properties / exploit_maturity
```
Added value: +{}
```
- addedOutput schema / properties / exploitability_score
```
Added value: +{}
```
- addedOutput schema / properties / impact_score
```
Added value: +{}
```
- addedOutput schema / properties / integrity_impact
```
Added value: +{}
```
- addedOutput schema / properties / integrity_requirement
```
Added value: +{}
```
- addedOutput schema / properties / modified_attack_complexity
```
Added value: +{}
```
- addedOutput schema / properties / modified_attack_requirements
```
Added value: +{}
```
- addedOutput schema / properties / modified_attack_vector
```
Added value: +{}
```
- addedOutput schema / properties / modified_privileges_required
```
Added value: +{}
```
- addedOutput schema / properties / modified_subsequent_system_availability
```
Added value: +{}
```
- addedOutput schema / properties / modified_subsequent_system_confidentiality
```
Added value: +{}
```
- addedOutput schema / properties / modified_subsequent_system_integrity
```
Added value: +{}
```
- addedOutput schema / properties / modified_user_interaction
```
Added value: +{}
```
- addedOutput schema / properties / modified_vulnerable_system_availability
```
Added value: +{}
```
- addedOutput schema / properties / modified_vulnerable_system_confidentiality
```
Added value: +{}
```
- addedOutput schema / properties / modified_vulnerable_system_integrity
```
Added value: +{}
```
- addedOutput schema / properties / privileges_required
```
Added value: +{}
```
- addedOutput schema / properties / provider_urgency
```
Added value: +{}
```
- addedOutput schema / properties / published_date
```
Added value: +{}
```
- addedOutput schema / properties / recovery
```
Added value: +{}
```
- addedOutput schema / properties / safety
```
Added value: +{}
```
- addedOutput schema / properties / scope
```
Added value: +{}
```
- addedOutput schema / properties / subsequent_system_availability_impact
```
Added value: +{}
```
- addedOutput schema / properties / subsequent_system_confidentiality_impact
```
Added value: +{}
```
- addedOutput schema / properties / subsequent_system_integrity_impact
```
Added value: +{}
```
- addedOutput schema / properties / user_interaction
```
Added value: +{}
```
- addedOutput schema / properties / value_density
```
Added value: +{}
```
- addedOutput schema / properties / vector_string
```
Added value: +{}
```
- addedOutput schema / properties / version
```
Added value: +{}
```
- addedOutput schema / properties / vulnerability_response_effort
```
Added value: +{}
```
- addedOutput schema / properties / vulnerable_system_availability_impact
```
Added value: +{}
```
- addedOutput schema / properties / vulnerable_system_confidentiality_impact
```
Added value: +{}
```
- addedOutput schema / properties / vulnerable_system_integrity_impact
```
Added value: +{}
```
First observedv0.5.0Jun 27, 2026

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, and non-destructive, so the safety profile is covered. The description adds one genuinely useful non-annotation fact, the required permission view_vulnerabilities, but says nothing about response shape or what the non-verbose path does.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tightly packed sentence with the scope qualifier and permission clause front-loaded. Minor waste in that it largely restates the title's phrasing rather than adding new information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists and parameters are fully documented, so the baseline need is met. The missing element is disambiguation from the closely named action1_get_cve sibling, which is the main thing an agent would need to choose correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across all three parameters, so the schema carries parameter meaning. The description adds no extra semantics such as when to set verbose or how response_format affects the returned payload.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: retrieves detailed CVE information for a specific vulnerability at the global level, not organization-scoped, including attributes like attack vector. This distinguishes it from the org-scoped siblings, but it does not differentiate from action1_get_cve, which reads on the same resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical '(not for an organization)' implies when to prefer this over org-scoped vulnerability tools, but no alternative is named. An agent facing action1_get_cve, action1_list_cve_endpoints, and action1_list_cve_remediations has no explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server