"A search for information on Common Vulnerabilities and Exposures (CVE)" matching MCP tools:

• search_cveA

  Ansvar: EU Compliance & Legal IntelligenceA

  Search CVEs by keyword, severity, score range, and filters. Returns matching CVE records with CVSS scores, KEV status, and EPSS data. Use get_cve_details for full information on a specific CVE. Supports full-text search on descriptions.

  ConnectorOAuth

• list_public_cve_recordsA

  Hacker Bob public recordsA

  List cleared public Hacker Bob Common Vulnerabilities and Exposures records with cursor pagination and optional project or publication-status filters.

  ConnectorNo auth

• bulk_cve_lookupA

  ContrastAPIA

  Batch query multiple CVEs (up to 50 per call, same for Free and Pro): retrieve full CVE details for all in 1 request instead of N. By default each CVE's affected_products is truncated to the first 20 entries (total_products reports honest count) and references to the first 10 (total_references reports honest count); pass include_affected_products=true / include_full_references=true to return full lists. Pass include_reference_tags=true to receive references_full=[{url, tags, source}] per CVE in the batch. Pass include_severity_breakdown=true to receive severity_sources/consensus/disagreement per CVE. Use for dependency audits or bulk vulnerability enrichment; use cve_lookup for single CVE. Each successful item carries next_calls — chain with kev_detail (when kev.in_kev=true), cwe_lookup (when cwe_id is present), or exploit_lookup. Free: 30/hr (1 per item), Pro: 500/hr. Returns {results, total, successful, failed, timed_out, partial, summary}.

  ConnectorNo auth

• vulnerability_searchA

  ZEN SecDBA

  Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:[2026-01-01 TO 2026-12-31]) - modified: last modification date - source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet) - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - tag: advisory tag (e.g. tag:scada, tag:ics) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0]) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "source:fortinet AND severity:critical" → critical Fortinet advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs - "tag:scada AND severity:high" → high severity ICS/SCADA advisories ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.

  ConnectorNo auth

• get_vulnerabilitiesA

  devstack-mcpA

  Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.

  ConnectorNo auth

• get_advisoryA

  dependency-trustA

  Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.

  ConnectorNo auth

• prioritize_remediationA

  NPMScanA

  Given a batch of vulnerability findings already flagged elsewhere (e.g. from batch_query_vulnerabilities, analyze_transitive_dependencies, or query_vulnerabilities across a whole package.json/lockfile audit), ranks them by what to actually fix first. Combines CISA KEV status (confirmed active exploitation in the wild — an automatic top-priority override), FIRST.org EPSS (probability of exploitation in the next 30 days — the primary ranking signal, since it measures likelihood rather than just impact), and severity (a secondary/fallback signal, most useful for a GHSA finding with no CVE alias) into one composite score and a remove-now/patch-now/patch-soon/scheduled/monitor tier per finding. A finding with `findingType: "malware"` (or a MAL-* advisoryId, auto-detected even when findingType is omitted) always lands in `remove-now` — the tier above patch-now — regardless of score: a confirmed-malicious package needs removal/replacement, not an "urgent patch" (there often isn't a fixed version to patch TO), and EPSS/severity don't meaningfully apply to "how malicious" the way they do to a genuine vulnerability. When EPSS data isn't available at all (no CVE id, or a real CVE that just isn't in FIRST.org's database) severity becomes the sole usable signal and is scored on its own scale instead of being diluted to a ~10% sliver of the composite — a bare CRITICAL/HIGH GHSA finding with no CVE alias lands in patch-soon/scheduled, not monitor, the way it would if severity kept its normal secondary weight with nothing else to combine it with. This does NOT re-query OSV/NVD itself — pass in the severity/CVE id findings other tools already returned; it only adds KEV/EPSS enrichment (the same data get_cve returns per-CVE) and ranks the batch. A CVE id shared by multiple findings in the same call is only looked up once.

  ConnectorNo auth

• prioritize_remediationA

  NPMScanA

  Given a batch of vulnerability findings already flagged elsewhere (e.g. from batch_query_vulnerabilities, analyze_transitive_dependencies, or query_vulnerabilities across a whole package.json/lockfile audit), ranks them by what to actually fix first. Combines CISA KEV status (confirmed active exploitation in the wild — an automatic top-priority override), FIRST.org EPSS (probability of exploitation in the next 30 days — the primary ranking signal, since it measures likelihood rather than just impact), and severity (a secondary/fallback signal, most useful for a GHSA finding with no CVE alias) into one composite score and a remove-now/patch-now/patch-soon/scheduled/monitor tier per finding. A finding with `findingType: "malware"` (or a MAL-* advisoryId, auto-detected even when findingType is omitted) always lands in `remove-now` — the tier above patch-now — regardless of score: a confirmed-malicious package needs removal/replacement, not an "urgent patch" (there often isn't a fixed version to patch TO), and EPSS/severity don't meaningfully apply to "how malicious" the way they do to a genuine vulnerability. When EPSS data isn't available at all (no CVE id, or a real CVE that just isn't in FIRST.org's database) severity becomes the sole usable signal and is scored on its own scale instead of being diluted to a ~10% sliver of the composite — a bare CRITICAL/HIGH GHSA finding with no CVE alias lands in patch-soon/scheduled, not monitor, the way it would if severity kept its normal secondary weight with nothing else to combine it with. This does NOT re-query OSV/NVD itself — pass in the severity/CVE id findings other tools already returned; it only adds KEV/EPSS enrichment (the same data get_cve returns per-CVE) and ranks the batch. A CVE id shared by multiple findings in the same call is only looked up once.

  ConnectorNo auth

• cisa_check_cve_statusA

  cisa-cybersecurity-mcp-serverA

  Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.

  ConnectorNo auth

• security_fetch_package_vulnerabilitiesA

  DataNexus MCPA

  Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). package_name is accepted as an alias for package. Batch mode: packages array of {name, version, ecosystem} objects — max 50 per call. If packages array is provided and non-empty, batch mode is used and package/version/ecosystem are ignored. Batch returns {results: [...], partial: bool, failed_count: int}. Each result has vuln_count and vulnerabilities list. Returns CVE ID, severity, CVSS score, affected range, and fixed version. Use security_fetch_cve_detail for full detail by CVE ID. Use security_audit_sbom_vulnerabilities for SBOM files. Verified source: Google OSV.dev. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_vulnerabilities", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• msrc_searchA

  patch-tuesdayA

  Search Microsoft security updates (Patch Tuesday) from the official MSRC API. Combines keyword search, CVE/KB lookup, and product/severity/exploitation filtering into a single flexible tool. All filter parameters are optional and can be combined. When no filters are provided, returns the most urgent vulnerabilities from the most recent *released* Patch Tuesday (CISA-KEV- listed or exploited first, then by EPSS exploitation probability, severity, and CVSS score). The upcoming month's document exists before its Patch Tuesday but only holds early Chromium/third-party and out-of-band entries; it is skipped by default and served only when requested via month=. Results are enriched with EPSS scores (FIRST.org daily exploit prediction, 0-1) and CISA KEV (Known Exploited Vulnerabilities) catalog data when available. Use this tool to: - Get the latest Patch Tuesday overview (include_stats=True, limit=0) - Browse the most urgent fixes this month (no filters) - Look up a specific CVE with full detail (cve="CVE-2026-41108") -- works across all months, returns KBs, affected products, CVSS, description, FAQs, EPSS score, and KEV status - Find which CVEs a KB article fixes (kb="5094123" or kb="KB5094123") -- scans recent months, or a specific month when combined with month= - Look up many KBs in one call (kb=["5094123", "KB5094127", ...], up to 30) -- e.g. a machine's installed-update list; returns one grouped per-KB result entry each, with per-KB found/not-found status - Check whether a KB has been superseded by newer patches (kb="5087538", include_chain=True) -- walks Microsoft-stated supersedence links - See what Microsoft has confirmed an update breaks (kb=..., include_known_issues=True) -- known issues from the KB's public support page: symptoms, workarounds, and the resolving update when stated - See what an update changes (kb=..., include_update_summary=True) -- the KB support page's summary and improvements highlights, beyond the security fixes already listed in the MSRC data - Find KEV-listed CVEs this month (kev=True) -- confirmed exploited, with federal remediation due dates - High exploitation probability (min_epss=0.5) -- EPSS >= 50% - Search by keyword (query="Exchange" or query="DNS spoofing") - Filter to a product (product="Windows Server 2022") -- partial match - Filter to a product watchlist (product_profile="identity-core", or products=["Exchange Server", "Windows Server"] / product_families=["Windows", "Azure"]) -- keeps vulns matching any listed product or family; matching is local and profiles never leave the host - Filter by severity (severity="Critical") -- Critical/Important/Moderate/Low - Find actively exploited vulnerabilities (exploited=True) - Find publicly disclosed zero-days (publicly_disclosed=True) - Filter by CVSS score (min_cvss=8.0) - Look at a past month (month="2026-Apr" or month="2026-04") - Combine filters (product="Exchange" + severity="Critical" + month="2026-05") - Search a historical range (query="HTTP.sys" + months_back=6, or start_month="2026-Jan" + end_month="2026-Jun") -- aggregates matching CVEs across released months with per-month trend counts - Paginate with offset (offset=10, limit=10 for page 2) Args: query: Optional keyword; case-insensitive match across CVE ID, title, description, component tag, and affected product names. cve: Optional CVE ID (e.g. "CVE-2026-41108"). Fast path: ignores other filters and returns full detail for that single CVE, searching across all months automatically. kb: Optional KB article number (e.g. "5094123" or "KB5094123") or a list of up to 30 of them for a batched lookup. Fast path: returns the CVEs fixed by that KB, scanning the most recent months (up to 6), or only the given month when month= is also set. A list input returns a grouped response instead: a results array with one entry per KB ("kb", "found", and on success the same body as a single-KB lookup; on a miss "error"/"error_kind"), deduplicated, order preserved. limit/offset apply per KB; other filters are ignored. Accepts numeric KB ids only (any malformed list entry fails the whole call); kb_articles in results may also contain non-KB vendor-fix labels such as "Release Notes", which cannot be looked up here. month: Optional monthly release to search, formatted "2026-Apr" or "2026-04". Defaults to the most recent release whose Patch Tuesday (second Tuesday of the month) has already occurred; pass the upcoming month explicitly to see its pre-release entries. Combined with kb=, restricts the KB lookup to that month. product: Optional product name filter (case-insensitive partial match against affected product names, e.g. "Windows Server 2022"). product_profile: Optional named watchlist (e.g. "identity-core") that expands locally into product/family matchers. Built-in profiles can be overridden/extended via a JSON file at MSRC_PROFILES_PATH. An unknown name returns an invalid_input error listing the available profiles. Profile contents are matched locally and never sent to MSRC, FIRST.org, CISA, or telemetry. products: Optional list of product-name partial matchers. A vulnerability is kept if any entry matches one of its affected products. product_families: Optional list of product-family partial matchers. A vulnerability is kept if any entry matches one of its product families. Combined with products/product_profile as a union (match any listed product OR family). severity: Optional maximum-severity filter. Valid values: Critical, Important, Moderate, Low. exploited: Optional filter for vulnerabilities known to be exploited in the wild (True) or not (False), per Microsoft's assessment. publicly_disclosed: Optional filter for publicly disclosed vulnerabilities. kev: Optional filter for CVEs on (True) or off (False) the CISA Known Exploited Vulnerabilities catalog. ransomware: Optional filter for CVEs whose CISA KEV entry reports known ransomware campaign use (True) or not / not on KEV (False). exploitation_likely: Optional filter on Microsoft's latest-release exploitation assessment: True matches "Exploitation More Likely" or "Exploitation Detected"; False matches everything else (including unassessed entries). Matching results include an exploitation_assessment field. cwe: Optional weakness filter; case-insensitive substring match against CWE entries (e.g. "CWE-416" or "use after free"). Matching results include their cwe list. min_epss: Optional minimum EPSS score (0-1), the probability of exploitation in the next 30 days (e.g. 0.5 for >= 50%). min_cvss: Optional minimum CVSS base score (0-10). attack_vector: Optional CVSS attack-vector filter, one of N (network), A (adjacent), L (local), P (physical). Matches the parsed CVSS v3.x vector; entries without a parseable vector are excluded. privileges_required: Optional CVSS privileges-required filter, one of N (none), L (low), H (high). user_interaction: Optional CVSS user-interaction filter, one of N (none), R (required). scope: Optional CVSS scope filter, one of U (unchanged), C (changed). include_chain: When True together with kb=, adds a supersedence_chain showing which KBs this KB replaces (newest to oldest), walked from Microsoft-stated supersedence links. Ignored without kb=. include_guidance: When True together with cve=, adds a guidance list to the CVE detail output with any Microsoft-provided mitigations, workarounds, and will-not-fix advisories (type/description/url). Omitted by default to keep responses lean. Ignored without cve=. include_references: When True, adds deterministic reference links (MSRC, NVD, EPSS, and KEV when listed) to each result row in month/KB/trend lists. CVE detail lookups always include them. include_kb_details: When True, kb_articles entries become full objects (per-KB url, fixed_build, supersedence, sub_type, and restart_required) instead of bare KB numbers; on cve= lookups it additionally adds restart_required to each KB entry. include_kev_details: When True, KEV-listed rows carry the full KEV entry (due_date, ransomware_use, required_action, vendor_project, product, vulnerability_name) instead of a boolean flag; on cve= lookups it extends the kev block with the extra catalog fields. include_known_issues: When True together with kb=, adds a known_issues block per KB with the issues Microsoft has publicly confirmed for that update (title, symptoms, workaround, and the resolving KB when stated), scraped best-effort from the KB's support page on support.microsoft.com. This reports what Microsoft has confirmed breaks -- it does not predict behavior in a specific environment. The block's status field is honest about coverage: "published" (issues listed), "none_published" (Microsoft publishes no known-issues data for this KB -- the norm for most non-Windows products; Windows cumulative/preview updates are the main source), or "unavailable" (the page could not be fetched or parsed; NOT the same as no issues). Attached even when the KB is not found in MSRC security releases (e.g. preview-only updates). Ignored without kb=. include_update_summary: When True together with kb=, adds an update_summary block per KB describing what the update changes, scraped best-effort from the same support.microsoft.com KB page: the page's Summary/Highlights text plus its Improvements bullet list (size-capped; truncated=True marks a capped block). The status field is honest like known_issues: "published" (a summary exists), "none_published" (Microsoft publishes no summary section for this KB), or "unavailable" (the page could not be fetched or parsed; NOT the same as no summary). Attached even when the KB is not found in MSRC security releases; combines freely with include_known_issues -- both blocks are served by a single fetch of the same page. Ignored without kb=. include_temporal: When True, cvss blocks gain the CVSS temporal score Microsoft publishes (exploit-code maturity adjusted). Applies to cve= detail and to list rows that carry a cvss block. list_months: When True, ignore other filters and return the catalog of available monthly releases (id, title, initial/current release dates, newest first) — useful for discovering valid month= values and spotting same-month revisions. format: Output format for a monthly/filtered search: "json" (default, most complete), "markdown", or "csv". "markdown" adds a prioritized triage briefing (executive summary + table) under a markdown key; "csv" adds a spreadsheet-ready table under a csv key plus a columns list. The JSON vulnerabilities list is always included. Ignored for cve=/kb= fast-path lookups. report: Optional report profile for format="markdown"/"csv". Currently only "triage" (the default rendering) is supported; reserved for future report shapes. force_refresh: When True, bypass the in-process caches for this request and re-fetch the MSRC document and EPSS/KEV enrichment from source. Use to pick up a same-day MSRC revision or fresh EPSS/KEV data. Only the data needed for this request is refreshed; unrelated cached months are left intact. include_freshness: When True (or when force_refresh is used), add a freshness block to the response reporting the cache age and TTL of the MSRC document and the EPSS/KEV enrichment data. months_back: Optional historical-trend control; search the N most recent released months (N >= 1) instead of a single month, aggregating matches with per-month counts. Mutually exclusive with start_month/end_month. Capped at 12 months per request. start_month: Optional start of a historical-trend range (e.g. "2026-Jan" or "2026-01"), inclusive. When end_month is omitted the range runs through the latest released month. Capped at 12 months. end_month: Optional end of a historical-trend range (inclusive); requires start_month (or months_back). Pre-release months are excluded. limit: Maximum number of results to return (default: 10, max: 100). Set to 0 with include_stats=True for a stats-only month overview. offset: Number of results to skip for pagination (default: 0). include_stats: When True, includes aggregate counts (by severity, impact, product family, exploited, KEV, publicly disclosed) for the filtered result set. Returns: Dictionary with: - month: Release ID (e.g. "2026-Jun") and title/release date - total_found: Number of vulnerabilities matching the filters - vulnerabilities: List of compact vulnerability summaries (up to limit) with epss_score and kev flag when available; full detail (epss_percentile, KEV due dates) returned for cve= lookups - filters_applied: Summary of which filters were used - stats: (only when include_stats=True) aggregate counts - supersedence_chain / chain_complete: (only for kb= lookups with include_chain=True) the walked chain, newest to oldest - known_issues: (only for kb= lookups with include_known_issues=True) per-KB block with status ("published" / "none_published" / "unavailable"), an issues list (title, symptoms, workaround, resolution, resolved_by) when published, a note otherwise, and the source_url of the Microsoft support page - update_summary: (only for kb= lookups with include_update_summary=True) per-KB block with status ("published" / "none_published" / "unavailable"), the page title, a summary string and an improvements list of what the update changes when published (truncated=True when size caps trimmed content), a note otherwise, and the source_url of the Microsoft support page - total_kbs / results: (only when kb= is a list) grouped batch output; results holds one entry per KB with kb, found, and either the single-KB response body or a per-KB error/error_kind, while the top-level total_found sums across all KBs - guidance: (only for cve= lookups with include_guidance=True) list of mitigation/workaround/will-not-fix advisories, when Microsoft provides them - format / markdown / csv / columns: (only when format="markdown" or "csv") the chosen format plus the rendered triage view; csv also carries the stable column-name list - freshness: (only with include_freshness=True or force_refresh=True) cache age/TTL for the MSRC document and EPSS/KEV enrichment - range / months_searched / trend: (only for historical-trend searches via months_back or start_month/end_month) the resolved month range, the number of months searched, and per-month aggregate counts (total, by_severity, exploited, publicly_disclosed, kev) - available_months: (only with list_months=True) the release catalog, newest first - error / error_kind: (only on failure) a message plus a category (invalid_input, not_found, upstream, internal) - note: (when relevant) explains month selection, e.g. that a newer pre-Patch-Tuesday document was skipped, or (with release_status="pre-patch-tuesday") that the requested month has not had its Patch Tuesday yet

  ConnectorNo auth

• get_cveA

  NPMScanA

  Look up authoritative NIST NVD data for one exact CVE ID (e.g. "CVE-2026-2950"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date range. Every result is enriched with CISA KEV status (`kev`, non-null only if this CVE is a confirmed, actively-exploited-in-the-wild vulnerability — treat that as an urgent-patch signal regardless of CVSS score) and FIRST.org EPSS (`epss`, the probability of exploitation in the next 30 days — a better prioritization signal than CVSS severity alone, which measures impact, not likelihood). If the KEV or EPSS lookup itself fails (network/timeout/upstream outage), `kev`/`epss` come back `null` only because those fields have to be nullable — `kevCheckFailed`/`epssCheckFailed` (true in that case) is the real signal, and means "unknown", not "confirmed absent/unscored". For a search, a failed EPSS batch call sets `epssCheckFailed` on every result in that response, since one call scores every id together; `kevCheckFailed` is tracked per-CVE since each is looked up independently. For a single cveId lookup, if NVD has no record yet or hasn't scored it, this falls back to the raw MITRE CVE record automatically (`source: "mitre"` on the result) rather than returning nothing. NVD is NOT npm-scoped — unlike query_vulnerabilities/get_latest_advisories, search results can include CVEs for any ecosystem, so pass keywordSearch (e.g. the package name) to narrow it. Prefer this for the authoritative CVSS score/vector/KEV/EPSS data on a CVE already found via another tool, or when a user pastes a CVE ID/link directly; prefer get_latest_advisories for npm-specific browsing. NVD enforces a strict shared rate limit, so this tool may occasionally ask you to retry in a few seconds — do so rather than assuming failure.

  ConnectorNo auth

• get_cveA

  NPMScanA

  Look up authoritative NIST NVD data for one exact CVE ID (e.g. "CVE-2026-2950"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date range. Every result is enriched with CISA KEV status (`kev`, non-null only if this CVE is a confirmed, actively-exploited-in-the-wild vulnerability — treat that as an urgent-patch signal regardless of CVSS score) and FIRST.org EPSS (`epss`, the probability of exploitation in the next 30 days — a better prioritization signal than CVSS severity alone, which measures impact, not likelihood). If the KEV or EPSS lookup itself fails (network/timeout/upstream outage), `kev`/`epss` come back `null` only because those fields have to be nullable — `kevCheckFailed`/`epssCheckFailed` (true in that case) is the real signal, and means "unknown", not "confirmed absent/unscored". For a search, a failed EPSS batch call sets `epssCheckFailed` on every result in that response, since one call scores every id together; `kevCheckFailed` is tracked per-CVE since each is looked up independently. For a single cveId lookup, if NVD has no record yet or hasn't scored it, this falls back to the raw MITRE CVE record automatically (`source: "mitre"` on the result) rather than returning nothing. NVD is NOT npm-scoped — unlike query_vulnerabilities/get_latest_advisories, search results can include CVEs for any ecosystem, so pass keywordSearch (e.g. the package name) to narrow it. Prefer this for the authoritative CVSS score/vector/KEV/EPSS data on a CVE already found via another tool, or when a user pastes a CVE ID/link directly; prefer get_latest_advisories for npm-specific browsing. NVD enforces a strict shared rate limit, so this tool may occasionally ask you to retry in a few seconds — do so rather than assuming failure.

  ConnectorNo auth

• enrich_npm_auditA

  NPMScanA

  Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same remove-now/patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists (a MAL-* advisoryId in the audit report is auto-detected as malware and forces remove-now). npm audit's JSON almost never includes a CVE id (only a GHSA advisory URL), so this resolves each GHSA to its CVE alias via OSV.dev when one exists (ghsaResolvedToCveCount reports how many) before doing the same CISA KEV + FIRST.org EPSS + severity scoring — skipping this step would silently degrade most findings to severity-only ranking despite prioritize_remediation being built around CVE-keyed KEV/EPSS data. Also carries through npm-audit-specific context prioritize_remediation itself has no field for: isDirect (direct vs. transitive dependency) and fixAvailable/fixTarget (npm's own computed fix — note fixTarget can name a different package than the vulnerable one, e.g. bumping a parent to pull in a patched transitive dependency). A package with more than one distinct advisory in the source report only has its first advisory used for ranking; a warning names the package so query_vulnerabilities can be called on it directly for the rest. `yarn audit --json` and `pnpm audit --json` use different report shapes and are not supported — use batch_query_vulnerabilities with the project's manifest/lockfile for those instead.

  ConnectorNo auth

• enrich_npm_auditA

  NPMScanA

  Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same remove-now/patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists (a MAL-* advisoryId in the audit report is auto-detected as malware and forces remove-now). npm audit's JSON almost never includes a CVE id (only a GHSA advisory URL), so this resolves each GHSA to its CVE alias via OSV.dev when one exists (ghsaResolvedToCveCount reports how many) before doing the same CISA KEV + FIRST.org EPSS + severity scoring — skipping this step would silently degrade most findings to severity-only ranking despite prioritize_remediation being built around CVE-keyed KEV/EPSS data. Also carries through npm-audit-specific context prioritize_remediation itself has no field for: isDirect (direct vs. transitive dependency) and fixAvailable/fixTarget (npm's own computed fix — note fixTarget can name a different package than the vulnerable one, e.g. bumping a parent to pull in a patched transitive dependency). A package with more than one distinct advisory in the source report only has its first advisory used for ranking; a warning names the package so query_vulnerabilities can be called on it directly for the rest. `yarn audit --json` and `pnpm audit --json` use different report shapes and are not supported — use batch_query_vulnerabilities with the project's manifest/lockfile for those instead.

  ConnectorNo auth

• nvd_search_cvesA

  nist-nvd-mcp-serverA

  Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response enrichment. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• web_searchA

  TeardropA

  Real-time web search via Tavily for current events, fact-checking, and research. Use search_depth='advanced' for complex queries (higher quality, higher cost) and topic='news' or 'finance' for headlines or market information. Use when: Choose when the task needs current, external, or factual information not available from on-chain or local data — e.g. news, prices, documentation, or fact-checking. Limitations: Returns web snippets, not raw page bodies; results depend on Tavily coverage. Advanced depth costs more. Not a substitute for on-chain tools like get_token_price. Alternatives: get_token_price, http_fetch

  ConnectorNo auth

• epss_timeseriesA

  ZEN SecDBA

  Get the historical EPSS time series for a specific CVE. ## What this tool does Returns the historical EPSS score, percentile, and model version available for a CVE across time, ordered by date. Useful for analyzing how exploitability likelihood has evolved over time. ## When to use this tool Use this tool when the user asks about: - EPSS trend over time - how exploitability probability changed - whether EPSS spiked or dropped - historical comparison of risk If the user only wants the current EPSS score, use `vulnerability_score` instead. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs - **series**: array of objects, each containing: - `date`: measurement date in ISO format - `score`: EPSS score - `percentile`: EPSS percentile - `model`: EPSS model version ## LLM usage guidelines - Never guess EPSS values-use this tool for all EPSS time-series questions. - If `cve_id` is malformed or incomplete, ask the user to correct it before calling. - If the user mentions multiple CVEs, call the tool once per CVE as needed. - If no historical data is available, return an empty series and state that no EPSS history was found.

  ConnectorNo auth

• vulnerability_infoA

  ZEN SecDBA

  Get detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch information (if included in the record) All information is returned in a structured Markdown format suitable for direct display. ## When to use this tool Use this tool when the user asks: - "Give me details about CVE-XYZ." - "Which products are affected by this vulnerability?" - "Show me advisories or references for this CVE." - "Explain what this vulnerability is and how serious it is." This tool is ideal for **deep inspection of a single vulnerability**. For multiple CVEs, call the tool once per CVE. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs Markdown-formatted vulnerability information including: - detailed description - severity metrics (CVSS, vectors) - affected products list - advisory list - references - weakness (CWE) details - additional structured metadata from SecDB ## LLM usage guidelines - Always prefer this tool when the user needs factual information about a specific CVE. - If multiple CVEs are mentioned, call the tool once per CVE. - Combine with: - **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics - **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories - **`ssvc_calculator`** - to compute prioritization based on the vulnerability data - Do not hallucinate product lists, advisories, or details—use what the tool returns.

  ConnectorNo auth

• top_attackers_toolA

  HoneyLabsA

  Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'. 'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path, domain, cve. by='cve' answers 'what CVEs are being mass-scanned right now' and returns value (the CVE id), title, severity, actively_exploited and counts; drill into any of them with cve_lookup. by='cve' does not accept the country/dest_port/asn filters. Optional filters: country (2-letter ISO, e.g. 'CN'), dest_port, asn (e.g. 'AS12345'). Adding a filter is required for large time ranges to stay within memory limits. since/until are ISO-8601 UTC strings.

  ConnectorNo auth