此 MCP 可以做什么
Provides CVE intelligence, vulnerability scoring, exploit and sighting searches, security advisories, SSVC prioritization, and Linux or package vulnerability audits.
功能
工具
11
工具
epss_timeseries
Get the historical EPSS time series for a specific CVE.
## What this tool does
Returns the historical EPSS score, percentile, and model version available for a CVE across time, ordered by date.
Useful for analyzing how exploitability likelihood has evolved over time.
## When to use this tool
Use this tool when the user asks about:
- EPSS trend over time
- how exploitability probability changed
- whether EPSS spiked or dropped
- historical comparison of risk
If the user only wants the current EPSS score, use `vulnerability_score` instead.
## Inputs
- **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`).
## Outputs
- **series**: array of objects, each containing:
- `date`: measurement date in ISO format
- `score`: EPSS score
- `percentile`: EPSS percentile
- `model`: EPSS model version
## LLM usage guidelines
- Never guess EPSS values-use this tool for all EPSS time-series questions.
- If `cve_id` is malformed or incomplete, ask the user to correct it before calling.
- If the user mentions multiple CVEs, call the tool once per CVE as needed.
- If no historical data is available, return an empty series and state that no EPSS history was found.
输入模式
{'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNNN)'}}}
输出模式
{'type': 'object', 'properties': {'series': {'type': 'array', 'items': {'type': 'object', 'properties': {'date': {'type': 'string', 'description': 'Date (YYYY-MM-DD)'}, 'model': {'type': 'string', 'description': 'Model version'}, 'score': {'type': 'string', 'description': 'Score (%)'}, 'percentile': {'type': 'string', 'description': 'Percentile (%)'}}}}}}
feed_report
Run a public ZEN SecDB feed report.
## What this tool does
Executes a predefined report on ZEN SecDB public feed data and returns structured results for analytics, trends, distributions, and top-N summaries.
Supported reports can cover public datasets such as:
- CVEs
- security advisories
- EPSS
- weaknesses
- CPE vendors and products
- exploit references
- sightings and IOC-related data
Use `feed_report_catalog` to discover the list of available reports and their supported input parameters.
## When to use this tool
Use this tool when the user asks about:
- distributions, trends, or counts across public vulnerability data
- top CVEs, top weaknesses, top vendors, or similar rankings
- timeline-based summaries such as yearly or monthly trends
- aggregated views over public SecDB feed data
Do not use this tool when the user asks for details about a single CVE, advisory, or exploit. Use the dedicated lookup tools instead.
## Inputs
- **report_id**: identifier of the report to execute
- **filters**: optional object with report-specific filters
- **limit**: optional maximum number of results to return, when supported by the selected report
## Outputs
- **summary**: Optional Markdown summary of the report results
- **report**: structured JSON object containing:
- `report_id`: executed report identifier
- `filters`: applied filters
- `data`: structured report rows or aggregated values
## LLM usage guidelines
- Use `feed_report_catalog` when you need to discover which public reports are available or which parameters they support.
- Do not guess report IDs-use the catalog when uncertain.
- Present `summary` directly to the user-it is already Markdown.
- Use `report` for structured follow-up analysis, comparisons, or tool chaining.
- If the selected report does not exist, return a clear not-found error instead of guessing an alternative.
输入模式
{'type': 'object', 'required': ['report_id'], 'properties': {'limit': {'type': 'string', 'description': 'optional maximum number of results to return, when supported by the selected report'}, 'filters': {'type': 'object', 'description': 'optional object with report-specific filters'}, 'report_id': {'type': 'string', 'description': 'identifier of the report to execute'}}}
输出模式
{'type': 'object', 'required': ['report_id', 'data'], 'properties': {'data': {'oneOf': [{'type': 'array', 'items': {'type': 'object'}}, {'type': 'object'}], 'description': 'structured report rows or aggregated values'}, 'filters': {'type': 'object', 'description': 'optional JSON schema describing supported input parameters'}, 'summary': {'type': 'string', 'description': 'Optional Markdown summary of the report results'}, 'report_id': {'type': 'string', 'description': 'executed report identifier'}}}
feed_report_catalog
List available public ZEN SecDB feed reports.
## What this tool does
Returns the catalog of available ZEN SecDB public feed reports, including their identifiers, descriptions, and supported input parameters.
This tool helps discover which reports can be executed through `feed_report`.
## When to use this tool
Use this tool when:
- the user asks what public reports are available
- you need to discover the correct report ID before running a report
- you need to inspect supported filters or input parameters
- you are unsure which report best matches the user request
## Inputs
This tool does not require any input.
## Outputs
- **reports**: array of report definitions, each containing:
- `report_id`: report identifier
- `title`: human-readable report title
- `description`: short explanation of what the report returns
- `input_schema`: optional JSON schema describing supported input parameters
## LLM usage guidelines
- Use this tool before `feed_report` whenever the correct report ID or supported parameters are not already known.
- Do not invent report IDs or parameters not present in the catalog.
- Prefer the most specific matching report for the user request.
- When useful, briefly summarize the most relevant available reports before calling `feed_report`.
输入模式
{'type': 'object', 'required': []}
输出模式
{'type': 'object', 'properties': {'reports': {'type': 'array', 'items': {'type': 'object', 'properties': {'title': {'type': 'string', 'description': 'human-readable report title'}, 'report_id': {'type': 'string', 'description': 'Report identifier'}, 'description': {'type': 'string', 'description': 'short explanation of what the report returns'}, 'input_schema': {'type': 'object', 'properties': {'additionalProperties': True}, 'description': 'optional JSON schema describing supported input parameters'}}}}}}
linux_audit
Perform a Linux package vulnerability audit using SecDB.
## What this tool does
Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary.
The audit results are based exclusively on the package list provided by the user.
## When to use this tool
Use this tool when the user wants to determine:
- whether installed packages contain known vulnerabilities
- whether a host, VM, container, or base image is affected by security advisories
- which packages require patching or upgrading
If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations.
## Inputs
- **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values).
- **version**: OS version or codename corresponding to the selected distribution.
- **packages**: list of installed packages, **one per line**, generated using the appropriate system command:
### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE)
rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n'
### For DEB-based distributions (Ubuntu, Debian)
dpkg-query -W -f='${Package} ${Version} ${Architecture}\n'
### For Alpine Linux
apk list -I
The raw output of these commands can be passed directly as the `packages` input (one package per line).
...
python3 3.12.3-0ubuntu2.1 amd64
systemd 255.4-1ubuntu8.10 amd64
tmux 3.4-1ubuntu0.1 amd64
...
## Outputs
- **report**: structured objects describing the advisories affecting the audited packages.
- **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings.
## LLM usage guidelines
- Never guess whether a package is vulnerable-always call this tool for Linux audits.
- If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination.
- Normalize the package list to “one entry per line” if the user provides unstructured output.
- The `summary` is already Markdown and can be shown directly.
- Use `report` when deeper technical analysis is required.
输入模式
{'type': 'object', 'required': ['os', 'version', 'packages'], 'properties': {'os': {'type': 'string', 'description': 'Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values)'}, 'version': {'type': 'string', 'description': 'OS version or codename corresponding to the selected distribution'}, 'packages': {'type': 'string', 'description': 'list of installed packages, **one per line**, generated using the appropriate system command'}}}
输出模式
{'type': 'object', 'properties': {'report': {'type': 'array', 'items': {'type': 'object', 'description': 'structured objects describing the advisories affecting the audited packages'}}, 'summary': {'type': 'string', 'description': 'Markdown summary including total vulnerabilities, severity breakdown, and key findings'}}}
linux_os
List supported Linux operating systems and their corresponding versions for use with the `linux_audit` tool.
## What this tool does
Returns an array of supported OS/version pairs, each in the form:
{"os":"name", "versions":["version or codename"]}
This allows the LLM and the user to know exactly which inputs are valid for the `linux_audit` tool.
## When to use this tool
Use this tool when:
- the user does not know which OS names or versions are supported
- the user provides unclear or ambiguous OS information
- you need to validate `os`/`version` before performing a Linux audit
This tool should typically be called **before `linux_audit`** whenever parameters are uncertain.
## Inputs
This tool does not require any input.
## Outputs
Returns an array of objects:
- **os**: supported Linux distribution identifier
- **versions**: corresponding list of supported release or codename
Example:
[
{"os": "ubuntu", "versions": ["noble","focal"]},
{"os": "debian", "versions": ["bookworm","sid"]},
{"os": "redhat", "version": ["redhat-9.0"]}
]
## LLM usage guidelines
- Use this tool to validate or suggest correct OS/version combinations before calling `linux_audit`.
- If the user provides invalid or misspelled OS names, retrieve the official list here and ask them to select one.
- Do not guess operating system identifiers-always rely on this tool to confirm correctness.
输入模式
{'type': 'object', 'required': []}
输出模式
{'type': 'object', 'properties': {'supported': {'type': 'array', 'items': {'type': 'object', 'properties': {'os': {'type': 'string', 'description': 'OS'}, 'versions': {'type': 'array', 'items': {'type': 'string', 'description': 'Version'}}}}}}}
purl_audit
Perform a software package vulnerability audit using SecDB.
## What this tool does
Analyzes a list of software packages identified by PURL (Package URL) and returns
vulnerability information plus a Markdown summary. The audit results are based
exclusively on the package list provided.
## When to use this tool
Use this tool when the user wants to determine:
- whether application dependencies contain known vulnerabilities
- whether a project is affected by security advisories
- which packages require patching or upgrading
## Supported ecosystems
- **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21)
- **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1)
- **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0)
- **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0)
- **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10)
- **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1)
- **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1)
- **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0)
## Inputs
- **purls**: list of Package URLs, one per entry.
Generate them from your project manifest files:
- Node.js: package.json / package-lock.json
- Python: requirements.txt / Pipfile.lock / pyproject.toml
- Ruby: Gemfile.lock
- Go: go.mod / go.sum
- Rust: Cargo.lock
- PHP: composer.lock
- Java: pom.xml / build.gradle
- .NET: *.csproj / packages.lock.json
## Outputs
- **report**: structured JSON objects describing the advisories affecting the audited packages.
- **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings.
## LLM usage guidelines
- Never guess whether a package is vulnerable — always call this tool.
- Only submit PURLs from the supported ecosystems listed above; others will be ignored.
- The `summary` is already Markdown and can be shown directly.
- Use `report` when deeper technical analysis is required.
输入模式
{'type': 'object', 'required': ['purls'], 'properties': {'purls': {'type': 'array', 'items': {'type': 'string'}, 'description': 'List of Package URLs (PURL) to audit'}}}
输出模式
{'type': 'object', 'properties': {'report': {'type': 'array', 'items': {'type': 'object', 'description': 'structured objects describing the advisories affecting the audited packages', 'additionalProperties': True}}, 'summary': {'type': 'string', 'description': 'Markdown summary including total vulnerabilities, severity breakdown, and key findings'}}}
sightings_search
Search real-world vulnerability sightings in SecDB.
## What this tool does
Retrieves information about where and how a vulnerability appears in the real world, including:
- Exploit-DB, Metasploit modules, PoCs
- Scanner plugins (Nessus, OpenVAS/Greenbone)
- Vendor advisories
- Social/media references (Reddit, Mastodon, Bluesky)
- MISP threat-intel sightings
## When to use this tool
Use this tool when the user asks:
- "Is this CVE exploited in the wild?"
- "Is there a PoC or exploit available?"
- "Does Nessus or OpenVAS have a plugin for this CVE?"
- "Is this vulnerability being discussed online?"
- "Show me all advisories/exploits for this CVE/product."
## Inputs
Any of the following may be used:
- **cve_id**: search by specific CVE
- **query**: full-text search (name, product, advisory ID, exploit reference, etc.)
- **category**: filter sightings by type (e.g., `exploit`, `nasl`, `advisory`, `scanner`, `poc`, `social`, `misp`)
- **status**: filter by sighting state (`exploited`, `mitigated`, `seen`, `confirmed`, etc.)
## Outputs
Returns an array of sightings, typically containing:
- `cve_id`
- `status`
- `category`
- `reference`
- `details` (object with additional structured data)
## LLM usage guidelines
- Use `cve_id` when the question targets a specific vulnerability.
- Use `query` for broad or exploratory searches.
- Only use valid enum values for `category` and `status`.
- Use this tool instead of assuming exploitation, PoCs, or plugin availability.
输入模式
{'type': 'object', 'required': [], 'properties': {'query': {'type': 'string', 'description': 'Full-text-search for vulnerability name, CVE ID or Advisory ID, categories, etc.'}, 'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNN)'}, 'status': {'enum': ['seen', 'confirmed', 'exploited', 'patched', 'not-exploited', 'not-confirmed', 'not-patched', 'exploitable', 'mentioned', 'mitigated'], 'type': 'string', 'description': 'Sighting status'}, 'category': {'enum': ['advisory', 'nasl', 'exploit', 'misp', 'scanner', 'poc', 'social'], 'type': 'string', 'description': 'Sighting category (scanner, exploit, advisory, nasl, etc.)'}}}
ssvc_calculator
Compute CISA SSVC (Stakeholder-Specific Vulnerability Categorization) for a CVE.
## What this tool does
Calculates the SSVC decision (Track, Track*, Attend, Act) using:
- exploitation status
- technical impact
- automatable exploitation
- mission prevalence (user-provided)
- public well-being impact (user-provided)
This reflects CISA's official SSVC prioritization model.
## When to use this tool
Use this tool when the user asks about:
- how urgently a CVE should be remediated
- CISA SSVC priority or risk category
- a structured decision model for remediation
## Inputs
- **cve_id**: the vulnerability to evaluate (`CVE-YYYY-NNNNN`)
- **mission_prevalence**: `M`, `S`, or `E` (must be provided by the user)
- **public_well_being_impact**: `M`, `A`, or `I` (must be provided by the user)
## Outputs
- `decision`: one of **Track**, **Track\***, **Attend**, **Act**
- `exploitation`
- `technical_impact`
- `automatable`
- `mission_prevalence`
- `public_well_being_impact`
- `mission_and_well_being_impact_value`
- `vector_string`
- `summary`: Markdown explanation of the outcome
## LLM usage guidelines
- Always ask the user for **mission_prevalence** (M/S/E) and **public_well_being_impact** (M/A/I) before calling.
- Never guess these values—SSVC depends on user context.
- Use the `summary` to explain clearly why the decision was returned.
- Combine with `vulnerability_score` or `sightings_search` if the user needs additional context.
输入模式
{'type': 'object', 'required': ['cve_id', 'mission_prevalence', 'public_well_being_impact'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE ID'}, 'mission_prevalence': {'type': 'string', 'description': '# Mission Prevalence\n\nA mission essential function (MEF) is a function directly related to\naccomplishing the organization\'s mission as set forth in its statutory or\nexecutive charter. Identifying MEFs is part of business continuity planning\nor crisis planning. In contrast to non-essential functions, an organization\nmust perform a [MEF] during a disruption to normal operations. The mission\nis the reason an organization exists, and MEFs are how that mission is\nrealized. Non- essential functions support the smooth delivery or success\nof MEFs rather than directly supporting the mission.\n\n## Possible values\n\n- "M" or "Minimal"\n\nNeither support nor essential apply. The vulnerable component may be used\nwithin the entities, but it is not used as a mission-essential component,\nnor does it provide impactful support to mission-essential functions.\n\n- "S" or "Support"\n\nThe vulnerable component only supports MEFs for two or more entities.\n\n- "E" or "Essential"\n\nThe vulnerable component directly provides capabilities that constitute at\nleast one MEF for at least one entity; component failure may (but does not\nnecessarily) lead to overall mission failure.\n\n## Instructions for LLM\n\nAsk the user for the "Mission Prevalence" value before calling the tool.\n'}, 'public_well_being_impact': {'type': 'string', 'description': '# Public Well-being Impact\n\n## Possible values\n\n- "M" or "Minimal"\n\n**Type of Harm -> All**, The effect is below the threshold for all aspects\ndescribed in material.\n\n- "A" or "Material"\n\n**Type of Harm -> Physical harm**, Does one or more of the following:\n\n- Causes physical distress or injury to system users.\n- Introduces occupational safety hazards.\n- Reduces and/or results in failure of cyber-physical system safety margins.\n\n**Type of Harm -> Environment**, Major externalities (property damage,\nenvironmental damage, etc.) are imposed on other parties.\n\n**Type of Harm -> Financial**, Financial losses likely lead to bankruptcy of\nmultiple persons.\n\n**Type of Harm -> Psychological**, Widespread emotional or psychological harm,\nsufficient to necessitate counseling or therapy, impact populations of people.\n\n- "I" or "Irreversible"\n\n**Type of Harm -> Physical harm**, One or both of the following are true:\n\n- Multiple fatalities are likely.\n- The cyber-physical system, of which the vulnerable component is a part, isl\nikely lost or destroyed.\n\n**Type of Harm -> Environment**, Extreme or serious externalities (immediate\npublic health threat, environmental damage leading to small ecosystem collapse,\netc.) are imposed on other parties.\n\n**Type of Harm -> Financial**, Social systems (elections, financial grid, etc.)\nsupported by the software are destabilized and potentially collapse.\n\n**Type of Harm -> Psychological\tN/A\n\n\n## Instructions for LLM\n\nAsk the user for the "Public Well-being Impact" value before calling the tool.\n'}}}
输出模式
{'type': 'object', 'required': ['exploitation', 'technical_impact', 'automatable', 'mission_prevalence', 'public_well_being_impact', 'mission_and_well_being_impact_value', 'decision', 'vector_string'], 'properties': {'summary': {'type': 'string', 'description': 'Summary'}, 'decision': {'type': 'string', 'description': 'Decision'}, 'automatable': {'type': 'string', 'description': 'Automatable'}, 'exploitation': {'type': 'string', 'description': 'State of Exploitation (Evidence of Active Exploitation of a Vulnerability)'}, 'vector_string': {'type': 'string', 'description': 'SSVC Vector String'}, 'technical_impact': {'type': 'string', 'description': 'Technical Impact (Technical Impact of Exploiting the Vulnerability)'}, 'mission_prevalence': {'type': 'string', 'description': 'Mission Prevalence (Impact on Mission Essential Functions of Relevant Entities)'}, 'public_well_being_impact': {'type': 'string', 'description': 'Public Well-being Impact'}, 'mission_and_well_being_impact_value': {'type': 'string', 'description': 'Mission and Well-Being Impact Value'}}}
vulnerability_info
Get detailed information about a specific CVE.
## What this tool does
Retrieves the full vulnerability record for a CVE from SecDB, including:
- official description and summary
- CVSS metrics (all versions available)
- EPSS metadata (if present)
- affected products and versions
- vendor/security advisories
- references and upstream sources
- weakness classification (CWE)
- exploit and patch information (if included in the record)
All information is returned in a structured Markdown format suitable for direct display.
## When to use this tool
Use this tool when the user asks:
- "Give me details about CVE-XYZ."
- "Which products are affected by this vulnerability?"
- "Show me advisories or references for this CVE."
- "Explain what this vulnerability is and how serious it is."
This tool is ideal for **deep inspection of a single vulnerability**.
For multiple CVEs, call the tool once per CVE.
## Inputs
- **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`).
## Outputs
Markdown-formatted vulnerability information including:
- detailed description
- severity metrics (CVSS, vectors)
- affected products list
- advisory list
- references
- weakness (CWE) details
- additional structured metadata from SecDB
## LLM usage guidelines
- Always prefer this tool when the user needs factual information about a specific CVE.
- If multiple CVEs are mentioned, call the tool once per CVE.
- Combine with:
- **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics
- **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories
- **`ssvc_calculator`** - to compute prioritization based on the vulnerability data
- Do not hallucinate product lists, advisories, or details—use what the tool returns.
输入模式
{'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNNN)'}}}
vulnerability_score
Get CVSS and current EPSS score for a specific CVE.
## What this tool does
Returns a full risk snapshot for a CVE, including:
- CVSS version
- CVSS base score
- CVSS severity
- CVSS vector string
- human-readable explanation of the CVSS vector
- current EPSS score
The field **`cvss_explain`** provides a natural-language interpretation of the CVSS vector (attack conditions, privileges, user interaction, impact breakdown).
Example:
For `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, the explanation may read:
*"The vulnerability can be exploited remotely over the network with low complexity,
without authentication and without user interaction. Exploitation may lead to high
impact on confidentiality, high impact on integrity, and high impact on availability."*
## When to use this tool
Use this tool when the user asks:
- "What is the CVSS/EPSS of this CVE?"
- "Explain the CVSS vector of this vulnerability."
- "What is the severity and why?"
- "Give me the risk profile for this CVE."
For EPSS historical trends, use `epss_timeseries`.
## Inputs
- **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`).
## Outputs
- `cvss_version`
- `cvss_base_score`
- `cvss_base_severity`
- `cvss_vector_string`
- `cvss_explain` - human-readable explanation of the CVSS vector
- `epss_score`
## LLM usage guidelines
- Never guess CVSS or EPSS values—always call this tool.
- Use the `cvss_explain` field directly when the user wants an interpretation of the vector string.
- If multiple CVEs are referenced, call the tool once per CVE.
- Combine this tool with `sightings_search` or `ssvc_calculator` for more complete risk assessments.
输入模式
{'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'description': 'CVE identification (CVE-YYYY-NNNNN)'}}}
输出模式
{'type': 'object', 'required': ['cvss_version', 'cvss_base_score', 'cvss_base_severity', 'cvss_vector_string', 'epss_score'], 'properties': {'epss_score': {'type': 'string', 'description': 'EPSS score'}, 'cvss_explain': {'type': 'string', 'description': 'Explain CVSS'}, 'cvss_version': {'type': 'string', 'description': 'CVSS version'}, 'cvss_base_score': {'type': 'string', 'description': 'CVSS base score'}, 'cvss_base_severity': {'type': 'string', 'description': 'CVSS base severity'}, 'cvss_vector_string': {'type': 'string', 'description': 'CVSS vector string'}}}
vulnerability_search
Perform a full-text vulnerability search in SecDB.
## What this tool does
Searches across:
- CVE entries
- Security advisories
- Exploit references
- Product and vendor vulnerability data
Results are formatted in Markdown and include a search summary.
## Searchable fields (Lucene syntax supported):
- type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei
- id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234)
- title: resource title or name
- summary: short summary
- description: full description text
- alias: known vulnerability names (e.g. alias:log4shell)
- severity: critical, high, medium, low
- kev: true/false — CISA KEV catalog membership
- status: NVD status (CVE only) e.g. analyzed, modified
- published: publication date (e.g. published:[2026-01-01 TO 2026-12-31])
- modified: last modification date
- source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet)
- cve: related CVE ID (e.g. cve:CVE-2026-44827)
- cwe: related CWE ID (e.g. cwe:CWE-79)
- tag: advisory tag (e.g. tag:scada, tag:ics)
- attack_vector: network, adjacent, local, physical
- cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0])
Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards.
## Examples:
- "apache struts rce" → RCE vulnerabilities in Apache Struts
- "id:CVE-2026-44827" → exact CVE lookup
- "source:fortinet AND severity:critical" → critical Fortinet advisories
- "alias:log4shell" → Log4Shell by alias
- "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE
- "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs
- "tag:scada AND severity:high" → high severity ICS/SCADA advisories
## When to use this tool
Use this tool when the user asks:
- to look up a CVE, advisory, exploit, or product
- "show vulnerabilities for X"
- "search for advisories about Y"
- exploratory or broad vulnerability discovery
## Inputs
- **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.)
## Outputs
- **results**: array of Markdown-formatted search hits
- **summary**: Markdown summary with counts and a link to continue searching on SecDB
## LLM usage guidelines
- Use this tool instead of assuming whether a CVE/advisory/exploit exists.
- Present `results` and `summary` directly to the user-they are already Markdown.
- Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.
输入模式
{'type': 'object', 'required': ['query'], 'properties': {'query': {'type': 'string', 'description': 'CVE ID, vulnerability name, Advisory ID, Exploit, etc.'}}}
输出模式
{'type': 'object', 'properties': {'results': {'type': 'array', 'items': {'type': 'string', 'description': 'Formatted result in Markdown'}}, 'summary': {'type': 'string', 'description': 'Search summary with found records (ID) and link for continue the search on SecDB'}}}
历史
近期工具变更
已更改
vulnerability_search
2026年9月29日 02:50
已更改
purl_audit
2026年9月23日 02:41
已添加
purl_audit
2026年9月17日 07:58
已添加
feed_report
2026年9月17日 07:58
已添加
feed_report_catalog
2026年9月17日 07:58
已添加
vulnerability_search
2026年9月17日 07:58
已添加
vulnerability_score
2026年9月17日 07:58
已添加
vulnerability_info
2026年9月17日 07:58
已添加
ssvc_calculator
2026年9月17日 07:58
已添加
sightings_search
2026年9月17日 07:58
已添加
linux_os
2026年9月17日 07:58
已添加
linux_audit
2026年9月17日 07:58
已添加
epss_timeseries
2026年9月17日 07:58
发现
类似的 MCP 服务器
hyperion
com.thetempleofdoom.hyperion/hyperion
Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…
Vee3
io.github.Vee3io/vee3
Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…
IA-QA — 130+ QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox
Provides deterministic QA, evaluation, testing, code analysis, prompt and RAG checks, model comparison, and web security diagnost…
validoria-mcp
com.validoria/validoria-mcp
Runs continuous website, API, and webshop tests covering security, SEO, performance, accessibility, browser journeys, and inciden…
HubVibe: Pay-per-Call Tools for AI Agents: Web Search, Email Verify, KYC, Stocks, Crypto, News, Data
io.github.Its-fortunatefolly/hubvibe
Offers paid utilities for web audits, HTTP fetching and extraction, BigQuery analysis, LLM processing, code execution, blockchain…
developer-tools
net.programmes/developer-tools
Provides general-purpose developer utilities for encoding, hashing, encryption, JSON, HTML, CSS, networking, and related data tra…
Qiniso
io.github.qinisolabs/qiniso
Provides deterministic formatting, parsing, holiday and tax lookups, address handling, and checksum or structure validation for i…
ContrastAPI
com.contrastcyber/api
Provides security research and assessment tools covering CVEs, IOCs, dependencies, secrets, injection risks, HTTP headers, domain…