Overview

CISA's open vulnerability data: the Known Exploited Vulnerabilities catalog and its federal remediation deadlines, the SSVC decision points CISA publishes per CVE in Vulnrichment, the CSAF corpus of industrial control system advisories back to 2010, and CISA's publication feeds. Check a scan's worth of CVE IDs against KEV in one call, find what is overdue for a vendor, work out the BOD 26-04 timeline for an asset you own, and search or read ICS advisories. Every source is keyless. Runs as a stdio process, a local Streamable HTTP server, or the public hosted endpoint above.

Tools

Resources

Both resources are fully covered by the tools above, so a tool-only client loses nothing.

Capability reference

cisa_list_reference _tool

• One required topic: directives, kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources; reads in-process state only, so it answers while other tools are failing
• directives adds timelineTable (all 16 rows of BOD 26-04 Table 1, with remediationTimelineDays and forensicTriageRequired), definitions, and supersedes; sources reports the KEV catalogVersion, the advisory index's ready / documentCount / syncStatus, the SSVC cache TTL, and the cached feed windows

cisa_check_cve_status _tool

• Up to 200 cveIds per call, answered from the cached KEV snapshot with no upstream request; a CVE outside KEV comes back inKev: false, not as an error
• Per CVE: dateAdded, dueDate, daysUntilDue, overdue, requiredAction, knownRansomwareCampaignUse, forensicTriage, cwes[], every URL in the entry's notes as references[] typed by kind, and a three-state directive (BOD 26-04, BOD 22-01, or null); the response echoes the catalog snapshot and the asOf date the deadlines were computed against
• detail: "summary" trims each in-KEV record to the triage fields (dates, deadline status, directive, vendor and product labels, ransomware and forensic-triage flags), which keeps a full 200-CVE batch compact; full is the default

cisa_search_kev _tool

• Filters AND together over the whole snapshot: vendorProject and product (CISA's own labels, not CPE names), nameContains, cwe, cveIdPrefix, dateAddedFrom / dateAddedTo, dueBefore / dueAfter, overdue, ransomware, forensicTriage, directive (BOD 26-04 / BOD 22-01 / none); up to 100 per page (default 25) with an opaque cursor. cwe and cveIdPrefix normalize case and surrounding whitespace
• Sorts by dateAdded (default) or dueDate and reports totalCount and appliedFilters; a zero-hit result names the filter that matches nothing on its own and what dropping it restores, or the filters whose removal restores results and how many
• nameContains matches the letters a-z and the digits 0-9 after folding case and accents and spelling letters such as ß, æ, and ø as ss, ae, and o; any other letter or digit, such as a word in another script, is dropped, and the notice names it and the tokens actually searched
• Typed errors: catalog_unavailable (retryable), invalid_date_range, empty_search_text

cisa_get_ssvc _tool

• Up to 50 cveIds per call, each a live Vulnrichment lookup, plus assetExposure: publicly_exposed, not_publicly_exposed, or unknown (default, returns both arms)
• Per CVE: found, exploitation, automatable, technicalImpact, cvss and cwes where CISA published them, and bod2604.timelines[] (tableRow, remediationTimelineDays, forensicTriageRequired); a KEV entry adds kevAssigned, plus assignmentAgrees when an exposure was stated
• A CVE with no enrichment is found: false with guidance; enrichment_source_unavailable (retryable) fires only when every fetch fails

cisa_search_ics_advisories _tool

• Full-text q over titles, vendor names, and product names, plus vendor, product, cve, cwe, inKev, cvssMin / cvssMax, severity, sector, series (ICSA / ICSMA), publisher (coordinator / other), publishedFrom / publishedTo, revisedFrom / revisedTo; sorts by revised (default), published, maxCvss, or relevance (needs q); up to 50 per page (default 20) with an opaque cursor. cve and cwe normalize case and surrounding whitespace
• Results carry advisoryId, up to 20 cves with cveCount, kevCves, maxCvss with severityDerived, sectors, url, csafUrl, and attribution; without inKev, an unloaded KEV snapshot leaves kevCves out and says so rather than failing
• Reports totalCount and appliedFilters; a zero-hit result names the filter that matches nothing on its own and what dropping it restores, or the filters whose removal restores results and how many
• vendor and product are case-insensitive substrings matched literally, non-ASCII capitals included, so a label copied from a result matches its own advisories
• Typed errors: mirror_not_ready and catalog_unavailable (retryable), mirror_unavailable, invalid_cvss_range, invalid_date_range, relevance_sort_without_query, empty_search_text

cisa_get_advisory _tool

• advisoryId (optional revision suffix; case, surrounding whitespace, and a trailing .json are normalized, and every ID comes back in its uppercase form), optional sections (advisory, summary, products, vulnerabilities, revisionHistory, references, acknowledgments), and optional cves to narrow vulnerabilities to named entries
• Returns kind: "full", or kind: "outline" when a document read without sections exceeds the 24,000-byte budget: per-section byte sizes plus the CVE IDs in vulnerabilities, for a stateless re-call
• An ID not in the index returns found: false with guidance, indexCheckpoint, and indexLastSyncedAt; the guidance says when the ID's own date is later than the last sync, so the advisory may be newer than the index
• Typed errors: mirror_not_ready (retryable), mirror_unavailable, unknown_section, unknown_cve, cves_need_vulnerabilities_section

cisa_get_alerts _tool