winsecure-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| WSMD_CONFIG | No | Path to the config file (overrides default config file location) | |
| WSMD_OFFLINE | No | Switch the network off — set to 1 for the offline test | |
| WSMD_DATA_DIR | No | Data directory for store, caches and config (overrides default) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_inventoryA | Refresh the installed-software inventory from the registry, |
| get_programC | Detail view of one inventory entry: every source that reported it, its paths, versions and the CVEs assigned to it. |
| check_cvesA | Match the stored inventory against the CVE sources (per-product NVD lookup, CISA KEV, EPSS) and fill the ToDo list. Answers come from the per-product cache when it is fresh; the network is only touched for what changed. A cold keyed start is paced by NVD's rate limit: the call answers within a time budget and the rest of the queue drains in the background — read |
| cve_detailA | Look up a single CVE at NVD API 2.0: description, CVSS, references. Cached for a day. |
| list_todosA | The CVE to-do list, sorted confirmed-KEV first, then confirmed findings, then severity/EPSS. Filterable by status. |
| assess_todoA | Effort assessment for one to-do on axes a-d. With a sampling-capable client the server asks it directly and stores the verdict; otherwise it returns an evidence package for |
| save_assessmentA | Write an effort assessment back to a to-do (the non-sampling path). Sets the status to assessed. |
| reset_todosA | Clear the to-do list back to empty, or reset one entry to open. The way back to a clean list without editing the JSON file. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| winsecure.json | The server's own JSON store: inventory and to-do list. |
TDQS
Scored across 8 tools
Each tool targets a distinct action: inventory scanning, CVE matching, CVE lookup, to-do listing/resetting, assessment, and program detail. The only mild overlap is between assess_todo and save_assessment (assessment generation vs. storage) and between check_cves and cve_detail, but descriptions clearly delineate them.
All names use snake_case and mostly follow verb_noun (check_cves, save_assessment, assess_todo, get_program, list_todos, reset_todos, scan_inventory). The lone deviation is cve_detail, which is noun-based but still consistent with snake_case.
8 tools is well-scoped for a vulnerability management server covering inventory, CVE matching, to-do workflow, and assessment. No tool appears redundant or out of scope.
Core lifecycle is covered: scan inventory, match CVEs, list/reset to-dos, assess, save, and view program/CVE detail. Minor gaps include no explicit tool to add or edit inventory entries manually and no dedicated inventory list endpoint (though scan_inventory returns results), but these are workable.