Classify the severity of a vulnerability based on its description.

Uses CIRCL's fine-tuned transformer models:

• English descriptions: RoBERTa-base model (low/medium/high/critical)

• Chinese descriptions: MacBERT-base model (low/medium/high)

• Russian descriptions: ruRoBERTa-large model (low/medium/high/critical)

Language is auto-detected from the text unless explicitly specified.

Classify a vulnerability description into CWE categories.

Uses CIRCL's fine-tuned RoBERTa model to predict the most likely CWE (Common Weakness Enumeration) categories, mapped to their parent CWEs.

Fetch the 3 most recent vulnerabilities for a given CWE ID from Vulnerability Lookup.

Get detailed information about a vulnerability by its ID from Vulnerability Lookup.

The base URL defaults to https://vulnerability.circl.lu and can be overridden with the VULNMCP_LOOKUP_URL environment variable.

Search vulnerabilities on Vulnerability Lookup with filters.

The base URL defaults to https://vulnerability.circl.lu and can be overridden with the VULNMCP_LOOKUP_URL environment variable.

Search sightings to identify actively discussed or exploited vulnerabilities.

Create a sighting for a vulnerability.

Requires an API key on most Vulnerability Lookup instances. Set VULNMCP_API_KEY to authenticate automatically.

Get vulnerabilities ranked by sighting activity.

This helps quickly prioritize vulnerabilities with high real-world activity and distinguish potentially important issues from minor ones.

List and filter Known Exploited Vulnerability (KEV) entries.

Use this tool to browse KEV catalogs, check if a specific vulnerability is in a KEV catalog, or find recently added KEV entries.

KEV catalogs are identified by the UUID of their Vulnerability-Lookup origin instance. Use the list_gcve_references tool to discover available KEV catalogs and their UUIDs. Known catalogs include:

• CISA KEV: 405284c2-e461-4670-8979-7fd2c9755a60

• CIRCL: 1a89b78e-f703-45f3-bb86-59eb712668bd

• EUVD KEV (ENISA): cce329bf-df49-4c6e-a027-80be2e6483bd

The base URL defaults to https://vulnerability.circl.lu and can be overridden with the VULNMCP_LOOKUP_URL environment variable.

Search comments related to vulnerabilities on Vulnerability Lookup.

Comments are community-contributed notes, analyses, or discussions attached to specific vulnerabilities.

Search bundles related to vulnerabilities on Vulnerability Lookup.

Bundles are curated collections of related vulnerabilities, useful for grouping CVEs that affect the same campaign, product, or incident.

Guess CPE values from product-related keywords using cpe-guesser.

The base URL defaults to https://cpe-guesser.cve-search.org and can be overridden with the VULNMCP_CPE_GUESSER_URL environment variable.

List all Global Numbering Authorities (GNA) from the GCVE registry.

Downloads and verifies the registry if not already cached locally.

Returns: A dict with the total count and list of all GNA entries, each containing id, short_name, full_name, cpe_vendor_name, and URLs.

Get a specific GNA entry by its numeric ID or exact short name.

Exactly one of id or short_name must be provided.

Search for GNA entries by name (case-insensitive substring match).

List GCVE references (vulnerability dataset sources and their GNA mappings).

This includes KEV catalog entries with their Vulnerability-Lookup origin UUIDs, which can be used with the list_kev_entries tool's vulnerability_lookup_origin parameter to query a specific catalog.

Downloads references if not already cached locally.

Returns: A dict with the reference categories and their entries, including KEV catalogs with uuid, short_name, and optional gna_id fields.