io.github.kimmawla/vuln-triage-mcp

Whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog, i.e. confirmed exploited in the wild, with the date added and CISA's required action. Use when: the user asks "is this being exploited in the wild" / "is it in KEV". Prefer another tool when: the user wants an overall priority or "should I fix this"; use triage_vulnerability. Needs a CVE ID; for a GHSA ID, use triage_vulnerability. status is "listed" or "not_listed". stale=true means the catalog could not be refreshed and may be out of date. If the catalog cannot be loaded at all, this returns an error; that means KEV status is unknown, not "not listed".

List known vulnerabilities (OSV.dev) affecting a package, or one version of it. Use when: the user asks "what vulnerabilities affect package X" or "is version Y of X vulnerable". ecosystem is one of PyPI, npm, Go, Maven, crates.io, RubyGems, NuGet, Packagist. Prefer another tool when: the user already has a CVE or GHSA ID; use lookup_vulnerability for details or triage_vulnerability for priority. Pass version whenever the user knows it (from a lockfile, requirements, error message, etc.): it narrows results sharply to advisories affecting that version. An empty version returns advisories for all versions ever released, which can be large and is mostly irrelevant to a specific install. Results are sorted by CVSS base score (highest first, unscored last) and capped at 50. found_count is the number of unique advisories collected; returned_count is the number in vulns. Before concluding a package has few or no known vulnerabilities, check truncated and compare found_count with returned_count. truncated=true means the list is incomplete; truncation_reason says why (the 50 cap, or OSV pagination stopping early: page or time limit, a failed page, or "pagination did not advance"), and ranking_note warns that the ranking covers only what was collected.

FIRST EPSS exploit-prediction score for one CVE: the probability (0-1) of exploitation activity in the next 30 days, and its percentile among all CVEs. Use when: the user asks only about exploit probability / likelihood for a CVE. Prefer another tool when: the user wants an overall priority or "should I fix this"; use triage_vulnerability. Needs a CVE ID; for a GHSA ID, use triage_vulnerability. epss and percentile are null (found=false) when EPSS has no score for the CVE.

Raw advisory details for one vulnerability from OSV.dev: summary, details, CVSS, CVE aliases, fixed versions, and references. Use when: the user wants the facts about one specific CVE-YYYY-NNNN or GHSA-xxxx-xxxx-xxxx ID, without a priority judgment. Prefer another tool when: the user asks how urgent it is or what to fix first; use triage_vulnerability, which includes these details plus EPSS, KEV, and a score.

Prioritize one vulnerability: OSV advisory, CVSS base score, EPSS exploit probability, CISA KEV status, and a 0-100 priority score with bucket, confidence, and reasoning. Also reports whether a fixed version exists. Use when: any "how urgent is this", "should I fix this", or "what should I fix first" question about a CVE-YYYY-NNNN or GHSA-xxxx-xxxx-xxxx ID. Prefer another tool when: the user wants raw advisory details only; use lookup_vulnerability. To find IDs for a package, use find_vulns_for_package first. If EPSS or KEV is unavailable, the result is still returned with partial=true and the unavailable source named in missing_sources; KEV status is then "unknown", which does not mean "not listed". A GHSA ID without a CVE alias cannot be checked in EPSS or KEV, and missing_sources says so. A CVE with no OSV.dev record (common for vendor/closed-source products such as Windows or Exchange) is still triaged from EPSS and KEV: advisory is null, there is no CVSS component, and missing_sources includes "osv". If EPSS and KEV don't know the CVE either, reasoning says the ID may not exist or may be too new; check it for typos. A GHSA ID with no OSV record, or an OSV timeout or server error, returns an error. bucket is critical, high, medium, low, or unknown. KEV-listed vulnerabilities are always critical (score at least 80). Otherwise bucket is "unknown" when there is no CVSS severity or confidence is low: too little data to classify, and reasoning names what is missing. "unknown" means insufficient data. Never report it to the user as low risk or safe; say the priority could not be determined and what data is missing.