List cleared public Hacker Bob Common Vulnerabilities and Exposures records with cursor pagination and optional project or publication-status filters.
ConnectorNo auth
650,404 tools. Updated 2026-10-13 03:28
"A tool for checking Common Vulnerabilities and Exposures (CVEs)" matching MCP tools:
- Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.ConnectorNo auth
- Discover available product features, API/MCP URLs, versions, content limits, and interpretation boundaries before choosing a content tool. Returns product.capabilities.v1 metadata, without fetching stories or checking upstream freshness. Public and read-only; no credentials or arguments. Use latest_stories for recent records or get_health for endpoint compatibility. The mobile app distribution channel remains separately suspended.ConnectorNo auth
- List CVEs indexed from MITRE/GHSA BEFORE NVD publication (early-warning, freshest data). By default each result is slim (no description, no cvss_breakdown, no affected_products list, no references) — pass include='full' for the same payload shape as cve_lookup; for drill-down on a single CVE prefer cve_lookup. Use for threat intelligence on emerging CVEs; use cve_search for published NVD data. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, next_offset, verdict, hint}.ConnectorNo auth
- Look up MITRE CWE (Common Weakness Enumeration) catalog record from research view 1000. Default response is SLIM (first 3 mitigations, first 3 examples; extended_description is null) — pass include='full' for the verbose record (full mitigations + examples lists, populated extended_description). Returns description, abstract type (Pillar/Class/Base/Variant/Compound), status (Stable/Draft/Incomplete/Deprecated), exploit likelihood, recommended mitigations, observed example CVEs, parent_cwe (walk up the hierarchy), child_cwes (drill down to more specific weaknesses), and cve_count (LOWER BOUND — counts only CVEs whose primary CWE matches; CVEs with multiple CWEs may not be counted). Use after cve_lookup or kev_detail to understand the underlying weakness category; chain with cve_search(cwe_id=...) to enumerate all matching CVEs. Returns 404 when the CWE is not in research view 1000. Free: 30/hr, Pro: 500/hr. Returns {cwe_id, name, description, extended_description (null on slim, populated on include='full'), abstract_type, status, likelihood, mitigations (first 3 by default), total_mitigations, examples (first 3 by default), total_examples, parent_cwe, child_cwes, cve_count, updated_at, verdict, next_calls}.ConnectorNo auth
- Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). package_name is accepted as an alias for package. Batch mode: packages array of {name, version, ecosystem} objects — max 50 per call. If packages array is provided and non-empty, batch mode is used and package/version/ecosystem are ignored. Batch returns {results: [...], partial: bool, failed_count: int}. Each result has vuln_count and vulnerabilities list. Returns CVE ID, severity, CVSS score, affected range, and fixed version. Use security_fetch_cve_detail for full detail by CVE ID. Use security_audit_sbom_vulnerabilities for SBOM files. Verified source: Google OSV.dev. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_vulnerabilities", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorNo auth
Matching MCP Servers
- FlicenseAqualityDmaintenanceMCP server for Common Crawl CDX that enables backlink discovery, expired domain finding, and competitor gap analysis without requiring API keys.4-
- AlicenseAqualityCmaintenanceMCP server and CLI for querying Common Crawl via AWS Athena, enabling users to check a domain's presence in crawls, analyze dynamics, compare domains, and inspect page text.13MIT
Matching MCP Connectors
Paid MCP server for EAN, UPC, and GTIN validation, normalization, correction, and batch analysis.
Web page tools for AI agents: page metadata, outlinks, change detection, readable text and 10-URL batch metadata. Pay per call in USDC on Base via x402 ($0.02 to $0.15), no API key or signup.
- Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. The primary discovery tool for vulnerability surveillance and triage workflows. pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in the response enrichment. Returns brief summaries — call nvd_get_cve for full detail on specific IDs. At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).ConnectorNo auth
- Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:[2026-01-01 TO 2026-12-31]) - modified: last modification date - source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet) - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - tag: advisory tag (e.g. tag:scada, tag:ics) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0]) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "source:fortinet AND severity:critical" → critical Fortinet advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs - "tag:scada AND severity:high" → high severity ICS/SCADA advisories ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.ConnectorNo auth
- Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.ConnectorNo auth
- Read one CISA industrial control system advisory in full: affected products flattened from the CSAF product tree into vendor, product, and version ranges; per-CVE CVSS score, vector, and CWE; remediations with their category and vendor instructions; critical-infrastructure sectors; and the revision history. Large advisories return a section outline instead of the whole document, listing each section's size and the CVE IDs the vulnerabilities section holds — re-call with the sections you need, or with cves to read only those vulnerability entries. Republished vendor advisories carry the originating vendor's text; every response reports the source URL and attribution. Find advisory IDs with cisa_search_ics_advisories.ConnectorNo auth
- Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.ConnectorNo auth
- Answer "is this network caught up?" with indexing freshness, lag, heads, and available tables. COMMON USER ASKS: - Is Base caught up? FIRST CHOICE FOR: - checking indexing head, lag, tables, and capabilities for one network WHEN TO USE: - You want to know whether a network is indexed, fresh, caught up, or behind before querying. - You need chain family, real-time status, or available tables for a network. DON'T USE: - You only need the latest block or slot number. EXAMPLES: - Is Base caught up?: {"network":"base-mainnet"}ConnectorNo auth
- Look up CISA KEV (Known Exploited Vulnerabilities) full record for a CVE. Returns federal patch deadline (due_date), CISA-specified required_action remediation, known ransomware association, vendor/product, the CISA-given common name (e.g. 'Log4Shell'), CISA-reported CWE list, plus lifecycle metadata: date_updated (when CISA last revised the entry), date_removed (set when CISA removed the CVE from the catalog — null while still active), and updated_at (our DB sync freshness). Returns 404 when the CVE is not in the KEV catalog — use cve_lookup for non-KEV CVEs. Best follow-up after cve_lookup or cve_search(kev=true) when an in_kev=true CVE is identified; chain with cwe_lookup on each returned CWE to investigate the weakness category. Free: 30/hr, Pro: 500/hr. Returns {cve_id, vendor_project, product, vulnerability_name, date_added, due_date, required_action, known_ransomware_use, notes, cwes, date_updated, date_removed, updated_at, verdict, next_calls}.ConnectorNo auth
- Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixed versions. Use this when you have a full SBOM to audit. Use security_fetch_package_vulnerabilities instead when checking a single package version. Verified source: Google OSV.dev batch API. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_vulnerabilities", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorNo auth
- Return a list of hands-on SecDim Play secure coding challenges (labs) related to a detected or suspected vulnerability. SecDim Play challenges are scored, hands-on labs: find and fix a real vulnerability in running code to earn points and badges. Use this tool to: - Find hands-on SecDim Play labs for specific vulnerabilities like XSS, SQL Injection, etc. - Explore OWASP Top 10 vulnerabilities and related labs - Provide additional resources and guides to help developers improve their secure coding skills For structured tutorial content (text, video, and lab-based courses) on the same vulnerability, use search_learn_courses (SecDim Learn) instead or in addition. Args: search: Search term for the vulnerability (e.g., 'xss', 'sql-injection', 'injection') cwe: Common Weakness Enumeration (CWE) ID to filter by owasp: OWASP category to filter by (e.g., 'a03:2021') technology: Technology or framework to filter by (e.g., 'react', 'django') language: Programming language to filter by (e.g., 'javascript', 'python') difficulty: Difficulty level to filter by (e.g., 'trivial', 'easy', 'medium', 'hard') type: Challenge format to filter by (e.g., 'battle', 'exploitation', 'incident-response') mitre: MITRE ATT&CK ID to filter by (e.g., 'T1102.003') SecDim Play challenges (labs) each simulate a real vulnerability. They are scored according to the following difficulty levels: - Trivial: Easy to find and path vulnerabilities. It can be completed in 5-10 minutes. 1-15 points. - Easy: Known vulnerabilities. It can be completed in 10-30 minutes. 16-35 points. - Medium: Known vulnerabilities but require defence-in-depth patch. It can be completed in 20-30 minutes. 36-70 points. - Hard: Hard to find or patch vulnerabilities. It can be completed in 30-60 minutes. 71-100 points. - Battle: SecDim Flagship attack and defence challenge that require both vulnerability exploitation and mitigation skills. Points are accumulated. Returns: Dictionary containing SecDim Play labs results or error If there are no results, user can perform a manual search on the SecDim Play frontend (SECDIM_PLAY_FRONTEND_BASE_URL)ConnectorNo auth
- When: read once before your first canvas_* call, to build or to edit. Datadef's standard for a readable diagram (size, edge discipline, nested zones, notes) and the tool workflow: which canvas_* tool to use when, batching, laying out once, checking with canvas_view. It is the same standard Datadef's own generator follows, so a diagram you build by hand comes out indistinguishable from a generated one. Works without a subscription. Next: create_blank_diagram to build, or canvas_view to edit an existing diagram.ConnectorAPI key
- PG1 Sovereign Threat Intelligence: returns CVEs affecting a given vendor/product (optionally a specific version), enriched with CVSS, EPSS, and CISA KEV status, sorted by exploitation risk. Sourced from NVD keyword search. Payment required: $0.01 via x402, sent in params._meta["x402/payment"] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SIBLING DIFFERENTIATION: Use for discovering CVEs by vendor/product when you do not already have an exact CVE id. Do NOT use for a known CVE id (use get_cve_details / get_cve_batch). USAGE EXCLUSIONS: Uses NVD keyword search, not strict CPE matching — results may include near-matches. BEHAVIOR: Returns up to 50 results per call.ConnectorNo auth
- The credit reviews of the monitored book that need attention today (UTC), the overdue ones, whose standing next review date has passed, and those falling due within window_days (14), today included, each group soonest first. Every row names its exposure, team, company label and node_id, current status band, disposition and next review date. Each group lists at most 50 rows, while overdue_total and due_soon_total count every one; never_reviewed counts the active exposures with no review yet. Exposures no longer actively monitored are never listed. Owners are member identities and are not served.ConnectorNo auth
- Known security vulnerabilities for a package version (npm, PyPI, crates, Go, Maven, NuGet, RubyGems, Packagist) with severity, CVE/GHSA ids, and the version that fixes each. Queries OSV.dev, the open vulnerability database that aggregates GitHub advisories, PyPA, RustSec, Go and more. Pass up to 50 packages at once as "ecosystem:name@version" to audit a lockfile. When to use: For CVEs in one package version; for general package facts use package_info (on the MAD Synapse · Web & Research server, https://agent.maddegen.art/hub/mcp/web). Price: $0.002 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).ConnectorNo auth
- [Tool directory] Use this when checking the AgentoolRank review status of a tool you submitted via submit_tool. Requires submission_id and status_token from that submission; returns review status, queue position and listing URL when available. Not for launch-directory progress — that is my_progress.ConnectorNo auth
- Live TXT DNS lookup — queries ALL TXT records for a domain in real time and returns each record with its TTL and detected type (spf, dmarc, mta-sts, tlsrpt, bimi, other). Does NOT require a project — works for any domain, even ones not monitored. This is the only tool that shows all TXT records at once, making it essential for: • Detecting duplicate SPF records (multiple "v=spf1..." entries — a common misconfiguration that causes SPF to fail) • Verifying a newly published DNS record is visible • Checking for conflicting or stale TXT entries • Diagnosing issues that other tools (get_spf_records, get_dkim_records) cannot catch because they only see DMARC-reported data, not raw DNS.ConnectorOAuth