Vulnerability intelligence tools
The eight tools that answer questions about one advisory, from the full decision record to KEV status, remediation plan, timeline, vendor advisories, workarounds and VEX.
All eight take an advisory identifier (CVE, GHSA, PYSEC, RUSTSEC, GO, EUVD and other formats). Full parameter tables: Tool reference.
vulnetix_vuln
The record you will use most. detail picks the view:
detail |
Size for CVE-2021-44228 |
Contents |
|---|---|---|
summary (default) |
about 10 KB | Every decision field. Affected packages, purls and cloud locators reduced to counts, groups and samples. Includes a resource_link to the full record. |
full |
about 208 KB | The complete shaped record, up to 200 verbatim affected entries and all purls |
raw |
2.6 MB | The unshaped vdb-api record. Refused above 524,288 bytes. |
Summary fields:
| Field | Contents |
|---|---|
threatExposure |
Composite level and score, with the rules that produced it |
attackSurface |
Exposure level and reasoning |
ssvc |
Decision (Act, Attend, Track), priority and inputs |
kev |
Vendor, product, due date, ransomware flag, required action |
epss |
Probability and percentile |
exploitationMaturity |
Level, score and reasoning |
remediationTimeline |
Lifecycle stage, age and milestones |
affectedRoutines |
Functions and files to search your code for |
attackPaths |
Tactics mapped to ATT&CK techniques |
reachability |
Reachability results when the CLI supplied them |
affected, purls, cloudLocators |
Counts, groups and samples |
references, tags |
Advisory links and tags |
Hosts that render MCP Apps show this result as the CVE risk card.
Look up CVE-2021-44228 and tell me the KEV deadline and SSVC decision.vulnetix_kev_status
Whether one advisory is in any KEV catalogue, with the CISA due date, required action and ransomware flag. One call, unshaped. Use it instead of paging vulnetix_kev when you have an id.
vulnetix_kev
The KEV catalogues: CISA, ENISA/EU, VulnCheck and Vulnetix. Paged with limit (1 to 200, default 25) and offset. Returns count, sources, hasMore and items. Rendered as the KEV deadline board by hosts that support apps.
vulnetix_remediation
A ranked plan rather than a single version: actions (capped by maxActions, default 25) with steps, effort and impact, plus distributionPatches, registryFixes, sourceFixes, workarounds, cwes, ssvc, severity and kevEntries with daysUntilDue and overdue.
Give me the remediation plan for CVE-2021-44228 and say which action to take first.vulnetix_timeline
The lifecycle as a dated events list (at most 60) and a meta summary with lifecycleStage, currentAgeDays, publicationToFirstExploitDays, publicationToKevDays and insights. Use it to argue urgency: how quickly this advisory was weaponised.
vulnetix_advisories
Vendor advisories: Red Hat errata, Microsoft MSRC patches, vendor patches and comments, and references. Use it to find the advisory for the distribution or product you run.
vulnetix_workarounds
Documented workarounds and configuration changes that mitigate without patching, for when no patch exists or the upgrade is blocked.
vulnetix_vex
Published VEX statements from upstreams and vendors. Check it before you spend effort: a vendor may already have declared your product not affected.