Search Microsoft security updates (Patch Tuesday) from the official MSRC API.
Combines keyword search, CVE/KB lookup, and product/severity/exploitation
filtering into a single flexible tool. All filter parameters are optional
and can be combined. When no filters are provided, returns the most urgent
vulnerabilities from the most recent *released* Patch Tuesday (CISA-KEV-
listed or exploited first, then by EPSS exploitation probability, severity,
and CVSS score). The upcoming month's document exists before its Patch
Tuesday but only holds early Chromium/third-party and out-of-band entries;
it is skipped by default and served only when requested via month=.
Results are enriched with EPSS scores (FIRST.org daily exploit
prediction, 0-1) and CISA KEV (Known Exploited Vulnerabilities) catalog
data when available.
Use this tool to:
- Get the latest Patch Tuesday overview (include_stats=True, limit=0)
- Browse the most urgent fixes this month (no filters)
- Look up a specific CVE with full detail (cve="CVE-2026-41108") -- works
across all months, returns KBs, affected products, CVSS, description,
FAQs, EPSS score, and KEV status
- Find which CVEs a KB article fixes (kb="5094123" or kb="KB5094123") --
scans recent months, or a specific month when combined with month=
- Look up many KBs in one call (kb=["5094123", "KB5094127", ...], up to
30) -- e.g. a machine's installed-update list; returns one grouped
per-KB result entry each, with per-KB found/not-found status
- Check whether a KB has been superseded by newer patches (kb="5087538",
include_chain=True) -- walks Microsoft-stated supersedence links
- See what Microsoft has confirmed an update breaks (kb=...,
include_known_issues=True) -- known issues from the KB's public support
page: symptoms, workarounds, and the resolving update when stated
- See what an update changes (kb=..., include_update_summary=True) -- the
KB support page's summary and improvements highlights, beyond the
security fixes already listed in the MSRC data
- Find KEV-listed CVEs this month (kev=True) -- confirmed exploited, with
federal remediation due dates
- High exploitation probability (min_epss=0.5) -- EPSS >= 50%
- Search by keyword (query="Exchange" or query="DNS spoofing")
- Filter to a product (product="Windows Server 2022") -- partial match
- Filter to a product watchlist (product_profile="identity-core", or
products=["Exchange Server", "Windows Server"] /
product_families=["Windows", "Azure"]) -- keeps vulns matching any listed
product or family; matching is local and profiles never leave the host
- Filter by severity (severity="Critical") -- Critical/Important/Moderate/Low
- Find actively exploited vulnerabilities (exploited=True)
- Find publicly disclosed zero-days (publicly_disclosed=True)
- Filter by CVSS score (min_cvss=8.0)
- Look at a past month (month="2026-Apr" or month="2026-04")
- Combine filters (product="Exchange" + severity="Critical" + month="2026-05")
- Search a historical range (query="HTTP.sys" + months_back=6, or
start_month="2026-Jan" + end_month="2026-Jun") -- aggregates matching
CVEs across released months with per-month trend counts
- Paginate with offset (offset=10, limit=10 for page 2)
Args:
query: Optional keyword; case-insensitive match across CVE ID, title,
description, component tag, and affected product names.
cve: Optional CVE ID (e.g. "CVE-2026-41108"). Fast path: ignores other
filters and returns full detail for that single CVE, searching
across all months automatically.
kb: Optional KB article number (e.g. "5094123" or "KB5094123") or a
list of up to 30 of them for a batched lookup. Fast path: returns
the CVEs fixed by that KB, scanning the most recent months (up to
6), or only the given month when month= is also set. A list input
returns a grouped response instead: a results array with one entry
per KB ("kb", "found", and on success the same body as a
single-KB lookup; on a miss "error"/"error_kind"), deduplicated,
order preserved. limit/offset apply per KB; other filters are
ignored. Accepts numeric KB ids only (any malformed list entry
fails the whole call); kb_articles in results may also contain
non-KB vendor-fix labels such as "Release Notes", which cannot be
looked up here.
month: Optional monthly release to search, formatted "2026-Apr" or
"2026-04". Defaults to the most recent release whose Patch
Tuesday (second Tuesday of the month) has already occurred; pass
the upcoming month explicitly to see its pre-release entries.
Combined with kb=, restricts the KB lookup to that month.
product: Optional product name filter (case-insensitive partial match
against affected product names, e.g. "Windows Server 2022").
product_profile: Optional named watchlist (e.g. "identity-core") that
expands locally into product/family matchers. Built-in profiles can
be overridden/extended via a JSON file at MSRC_PROFILES_PATH. An
unknown name returns an invalid_input error listing the available
profiles. Profile contents are matched locally and never sent to
MSRC, FIRST.org, CISA, or telemetry.
products: Optional list of product-name partial matchers. A vulnerability
is kept if any entry matches one of its affected products.
product_families: Optional list of product-family partial matchers. A
vulnerability is kept if any entry matches one of its product
families. Combined with products/product_profile as a union (match
any listed product OR family).
severity: Optional maximum-severity filter. Valid values: Critical,
Important, Moderate, Low.
exploited: Optional filter for vulnerabilities known to be exploited
in the wild (True) or not (False), per Microsoft's assessment.
publicly_disclosed: Optional filter for publicly disclosed
vulnerabilities.
kev: Optional filter for CVEs on (True) or off (False) the CISA Known
Exploited Vulnerabilities catalog.
ransomware: Optional filter for CVEs whose CISA KEV entry reports
known ransomware campaign use (True) or not / not on KEV (False).
exploitation_likely: Optional filter on Microsoft's latest-release
exploitation assessment: True matches "Exploitation More Likely"
or "Exploitation Detected"; False matches everything else
(including unassessed entries). Matching results include an
exploitation_assessment field.
cwe: Optional weakness filter; case-insensitive substring match
against CWE entries (e.g. "CWE-416" or "use after free").
Matching results include their cwe list.
min_epss: Optional minimum EPSS score (0-1), the probability of
exploitation in the next 30 days (e.g. 0.5 for >= 50%).
min_cvss: Optional minimum CVSS base score (0-10).
attack_vector: Optional CVSS attack-vector filter, one of N (network),
A (adjacent), L (local), P (physical). Matches the parsed CVSS v3.x
vector; entries without a parseable vector are excluded.
privileges_required: Optional CVSS privileges-required filter, one of
N (none), L (low), H (high).
user_interaction: Optional CVSS user-interaction filter, one of
N (none), R (required).
scope: Optional CVSS scope filter, one of U (unchanged), C (changed).
include_chain: When True together with kb=, adds a supersedence_chain
showing which KBs this KB replaces (newest to oldest), walked from
Microsoft-stated supersedence links. Ignored without kb=.
include_guidance: When True together with cve=, adds a guidance list to
the CVE detail output with any Microsoft-provided mitigations,
workarounds, and will-not-fix advisories (type/description/url).
Omitted by default to keep responses lean. Ignored without cve=.
include_references: When True, adds deterministic reference links
(MSRC, NVD, EPSS, and KEV when listed) to each result row in
month/KB/trend lists. CVE detail lookups always include them.
include_kb_details: When True, kb_articles entries become full objects
(per-KB url, fixed_build, supersedence, sub_type, and
restart_required) instead of bare KB numbers; on cve= lookups it
additionally adds restart_required to each KB entry.
include_kev_details: When True, KEV-listed rows carry the full KEV
entry (due_date, ransomware_use, required_action, vendor_project,
product, vulnerability_name) instead of a boolean flag; on cve=
lookups it extends the kev block with the extra catalog fields.
include_known_issues: When True together with kb=, adds a known_issues
block per KB with the issues Microsoft has publicly confirmed for
that update (title, symptoms, workaround, and the resolving KB
when stated), scraped best-effort from the KB's support page on
support.microsoft.com. This reports what Microsoft has confirmed
breaks -- it does not predict behavior in a specific environment.
The block's status field is honest about coverage: "published"
(issues listed), "none_published" (Microsoft publishes no
known-issues data for this KB -- the norm for most non-Windows
products; Windows cumulative/preview updates are the main
source), or "unavailable" (the page could not be fetched or
parsed; NOT the same as no issues). Attached even when the KB is
not found in MSRC security releases (e.g. preview-only updates).
Ignored without kb=.
include_update_summary: When True together with kb=, adds an
update_summary block per KB describing what the update changes,
scraped best-effort from the same support.microsoft.com KB page:
the page's Summary/Highlights text plus its Improvements bullet
list (size-capped; truncated=True marks a capped block). The
status field is honest like known_issues: "published" (a summary
exists), "none_published" (Microsoft publishes no summary section
for this KB), or "unavailable" (the page could not be fetched or
parsed; NOT the same as no summary). Attached even when the KB is
not found in MSRC security releases; combines freely with
include_known_issues -- both blocks are served by a single fetch
of the same page. Ignored without kb=.
include_temporal: When True, cvss blocks gain the CVSS temporal score
Microsoft publishes (exploit-code maturity adjusted). Applies to
cve= detail and to list rows that carry a cvss block.
list_months: When True, ignore other filters and return the catalog of
available monthly releases (id, title, initial/current release
dates, newest first) — useful for discovering valid month= values
and spotting same-month revisions.
format: Output format for a monthly/filtered search: "json" (default,
most complete), "markdown", or "csv". "markdown" adds a prioritized
triage briefing (executive summary + table) under a markdown key;
"csv" adds a spreadsheet-ready table under a csv key plus a columns
list. The JSON vulnerabilities list is always included. Ignored for
cve=/kb= fast-path lookups.
report: Optional report profile for format="markdown"/"csv". Currently
only "triage" (the default rendering) is supported; reserved for
future report shapes.
force_refresh: When True, bypass the in-process caches for this request
and re-fetch the MSRC document and EPSS/KEV enrichment from source.
Use to pick up a same-day MSRC revision or fresh EPSS/KEV data.
Only the data needed for this request is refreshed; unrelated cached
months are left intact.
include_freshness: When True (or when force_refresh is used), add a
freshness block to the response reporting the cache age and TTL of
the MSRC document and the EPSS/KEV enrichment data.
months_back: Optional historical-trend control; search the N most recent
released months (N >= 1) instead of a single month, aggregating
matches with per-month counts. Mutually exclusive with
start_month/end_month. Capped at 12 months per request.
start_month: Optional start of a historical-trend range (e.g. "2026-Jan"
or "2026-01"), inclusive. When end_month is omitted the range runs
through the latest released month. Capped at 12 months.
end_month: Optional end of a historical-trend range (inclusive); requires
start_month (or months_back). Pre-release months are excluded.
limit: Maximum number of results to return (default: 10, max: 100).
Set to 0 with include_stats=True for a stats-only month overview.
offset: Number of results to skip for pagination (default: 0).
include_stats: When True, includes aggregate counts (by severity,
impact, product family, exploited, KEV, publicly disclosed) for
the filtered result set.
Returns:
Dictionary with:
- month: Release ID (e.g. "2026-Jun") and title/release date
- total_found: Number of vulnerabilities matching the filters
- vulnerabilities: List of compact vulnerability summaries (up to
limit) with epss_score and kev flag when available; full detail
(epss_percentile, KEV due dates) returned for cve= lookups
- filters_applied: Summary of which filters were used
- stats: (only when include_stats=True) aggregate counts
- supersedence_chain / chain_complete: (only for kb= lookups with
include_chain=True) the walked chain, newest to oldest
- known_issues: (only for kb= lookups with include_known_issues=True)
per-KB block with status ("published" / "none_published" /
"unavailable"), an issues list (title, symptoms, workaround,
resolution, resolved_by) when published, a note otherwise, and the
source_url of the Microsoft support page
- update_summary: (only for kb= lookups with
include_update_summary=True) per-KB block with status ("published"
/ "none_published" / "unavailable"), the page title, a summary
string and an improvements list of what the update changes when
published (truncated=True when size caps trimmed content), a note
otherwise, and the source_url of the Microsoft support page
- total_kbs / results: (only when kb= is a list) grouped batch output;
results holds one entry per KB with kb, found, and either the
single-KB response body or a per-KB error/error_kind, while the
top-level total_found sums across all KBs
- guidance: (only for cve= lookups with include_guidance=True) list of
mitigation/workaround/will-not-fix advisories, when Microsoft
provides them
- format / markdown / csv / columns: (only when format="markdown" or
"csv") the chosen format plus the rendered triage view; csv also
carries the stable column-name list
- freshness: (only with include_freshness=True or force_refresh=True)
cache age/TTL for the MSRC document and EPSS/KEV enrichment
- range / months_searched / trend: (only for historical-trend searches
via months_back or start_month/end_month) the resolved month range,
the number of months searched, and per-month aggregate counts
(total, by_severity, exploited, publicly_disclosed, kev)
- available_months: (only with list_months=True) the release catalog,
newest first
- error / error_kind: (only on failure) a message plus a category
(invalid_input, not_found, upstream, internal)
- note: (when relevant) explains month selection, e.g. that a newer
pre-Patch-Tuesday document was skipped, or (with
release_status="pre-patch-tuesday") that the requested month has
not had its Patch Tuesday yet
Deployment status: deprecated. This endpoint stops serving on 2026-08-11; the current endpoint is https://patch-tuesday-mcp.agreeabledesert-d0b8e491.eastus2.azurecontainerapps.io/mcp.