Connection check
verified live · 20h ago
cve-intelligence
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Tools
6
GitHub stars
—
Installs / wk
—
Licence
—
Transport
streamable-http
Last checked
20h ago
Tools & capabilities
6 toolsRead from the running server on 20h ago.
get_cve
read-only
id*
Full intelligence record for one CVE: per-scorer CVSS, EPSS, CISA KEV/ransomware/SSVC, four remote-detection modalities plus the Sigma log-detection layer, per-product fixed versio… Full intelligence record for one CVE: per-scorer CVSS, EPSS, CISA KEV/ransomware/SSVC, four remote-detection modalities plus the Sigma log-detection layer, per-product fixed versions (fixed = first patched build; affected_through = the last vulnerable build, so upgrade past it), news/community coverage, intelligence summary. No key required over MCP; an API key on the HTTP request (Authorization: Bearer cvs_live_…) is honored for attribution. Absence semantics: a null field means this dataset holds no such record. The source may still hold one.
get_epss_movers
read-only
limitwindow
CVEs whose EPSS exploitation probability rose the most recently. window is "7d" (default) or "30d". Each rise is measured between same-EPSS-model-version scores, so a model release… CVEs whose EPSS exploitation probability rose the most recently. window is "7d" (default) or "30d". Each rise is measured between same-EPSS-model-version scores, so a model release (which shifts the whole distribution) never appears as a mover. A rise raises the priority of a CVE; observed exploitation is recorded through CISA KEV. Returns cve_id, current score, the delta, KEV status and url, largest rise first.
get_scoreboard
read-only
The Defender Scoreboard report (CC BY 4.0): exploited vs detectable vs patchable, every figure with its method, caveat and denominator, plus the corpus block and any method-change… The Defender Scoreboard report (CC BY 4.0): exploited vs detectable vs patchable, every figure with its method, caveat and denominator, plus the corpus block and any method-change notes. Cite as "CVE Security Defender Scoreboard, cve-security.com/scoreboard".
get_updates
read-only
cvetypelimitsincecursor
The publication change stream: what this site published, stamped with OUR publish time (first_published, kev_added, detection_added, remediation_added). Pass since (YYYY-MM-DD, str… The publication change stream: what this site published, stamped with OUR publish time (first_published, kev_added, detection_added, remediation_added). Pass since (YYYY-MM-DD, strictly-after) on the first call, then the returned next_cursor to continue. Optional cve scopes the stream to one CVE's change history. Events for withdrawn CVE ids are omitted.
query_package
read-only
namepurlecosystem
CVEs affecting one open-source package, by purl (pkg:npm/lodash) or ecosystem + name (Maven names are group:artifact). Returns the CVE list KEV-first with each OSV version range VE… CVEs affecting one open-source package, by purl (pkg:npm/lodash) or ecosystem + name (Maven names are group:artifact). Returns the CVE list KEV-first with each OSV version range VERBATIM: `events` plus one render-safe projection: `fixed` (the upgrade targets) or `affected_through` (the last VULNERABLE version, so upgrade past it). This tool does not evaluate version membership; compare versions on your side with your ecosystem’s own semantics. Covers CVE-linked, GitHub-reviewed OSS advisories via OSV.dev; absence is not evidence of safety.
search_cves
read-only
qcweecofixkevpkg
+13