com.cve-security/cve-intelligence

name:com.cve-security/cve-intelligence

CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.

transport:: remote
credential class:: self-provisionable

Owner verification

Not yet verified. Verifying proves you control this server and is free, permanently — it never changes a published score.

Start verification →

Tools

get_cve
Full intelligence record for one CVE: per-scorer CVSS, EPSS, CISA KEV/ransomware/SSVC, four remote-detection modalities plus the Sigma log-detection layer, per-product fixed versions (fixed = first patched build; affected_through = last VULNERABLE build, never a fix), news/community coverage, intelligence summary. No key required over MCP; an API key on the HTTP request (Authorization: Bearer cvs_live_…) is honoured for attribution. Absence semantics: a null field means this dataset holds no such record, never that none exists.
shallow
get_scoreboard
The Defender Scoreboard report (CC BY 4.0): exploited vs detectable vs patchable, every figure with its method, caveat and denominator, plus the corpus block and any method-change notes. Cite as "CVE Security Defender Scoreboard, cve-security.com/scoreboard".
shallow
get_updates
The publication change stream: what this site published, stamped with OUR publish time (first_published, kev_added, detection_added, remediation_added). Pass since (YYYY-MM-DD, strictly-after) on the first call, then the returned next_cursor to continue. Events for withdrawn CVE ids are omitted.
shallow
query_package
CVEs affecting one open-source package, by purl (pkg:npm/lodash) or ecosystem + name (Maven names are group:artifact). Returns the CVE list KEV-first with each OSV version range VERBATIM: `events` plus one render-safe projection — `fixed` (the upgrade targets) or `affected_through` (the last VULNERABLE version, never a fix). This tool does NOT evaluate version membership — compare versions on your side with your ecosystem’s own semantics. Covers CVE-linked, GitHub-reviewed OSS advisories via OSV.dev; absence is not evidence of safety.
shallow
search_cves
Search the catalog. Free text (q) and/or structured filters: vendor (slug), cwe (CWE-nnn), year ("2024,2025"), sev ("critical,high"), kev (0|1), ransomware (0|1), detect (0|1 — detection content we track), fix (0|1 — fix=0 means computed-and-none-held, never "no fix exists"), epss_gte (0..1), eco (OSS ecosystem, e.g. npm or PyPI), pkg (pkg_key, e.g. npm/lodash — for ranges use query_package), page, limit (1..50). Filter-only queries return the /browse slice ordered KEV-first then EPSS.
shallow

Embed this server’s score

Tool count and median score across every tool in this server’s corpus — honest in a way a single cherry-picked tool’s badge wouldn’t be.

[![Vouch score](https://vouch.tools/api/servers/bf7b0852-93a1-4d74-9cc4-d17e60db04b7/badge.svg)](https://vouch.tools/servers/bf7b0852-93a1-4d74-9cc4-d17e60db04b7)