CVE Risk Check

{
  "mcpServers": {
    "app-openkrill-cve": {
      "type": "http",
      "url": "https://cve.openkrill.app/mcp"
    }
  }
}

{
  "server": {
    "name": "app.openkrill/cve",
    "title": "CVE Risk Check",
    "url": "https://cve.openkrill.app/mcp",
    "transport": "streamable-http",
    "topics": [
      "Cyber Threat"
    ],
    "repository": "https://github.com/nguyenhieuec/agent-tools-plugins",
    "website": "https://tools.openkrill.app/",
    "inRegistry": true
  },
  "audit": {
    "slug": "app-openkrill-cve",
    "url": "https://cve.openkrill.app/mcp",
    "auditedAt": "2026-11-13T16:25:06.626Z",
    "firstAuditedAt": "2026-11-13T15:56:26.831Z",
    "auditor": "1.0.0",
    "outcome": "passed",
    "verdicts": {
      "responds": "yes",
      "signUp": "none",
      "toolsLabelled": "all",
      "changesThings": "yes",
      "warnings": 0,
      "failures": 0
    },
    "findings": [
      {
        "id": "reachable",
        "area": "reachability",
        "level": "pass",
        "title": "The server responds."
      },
      {
        "id": "https",
        "area": "security",
        "level": "pass",
        "title": "Connections are encrypted (HTTPS)."
      },
      {
        "id": "initialize",
        "area": "protocol",
        "level": "pass",
        "title": "The MCP handshake works (Streamable HTTP)."
      },
      {
        "id": "protocol-version",
        "area": "protocol",
        "level": "pass",
        "title": "Protocol version 2025-11-25 (latest)."
      },
      {
        "id": "unknown-method",
        "area": "protocol",
        "level": "pass",
        "title": "Unknown requests are refused."
      },
      {
        "id": "tools-list",
        "area": "tools",
        "level": "pass",
        "title": "6 tools listed."
      },
      {
        "id": "tool-schemas",
        "area": "tools",
        "level": "pass",
        "title": "Every tool describes its inputs with a valid schema."
      },
      {
        "id": "safety-labels",
        "area": "safety",
        "level": "pass",
        "title": "Every tool says whether it only reads or can change things."
      },
      {
        "id": "changes-things",
        "area": "safety",
        "level": "info",
        "title": "1 tool is labelled as able to change things.",
        "detail": "Expected for tools that send, write or buy. Your AI client should ask before calling them.",
        "evidence": [
          "submit_feedback"
        ]
      },
      {
        "id": "tool-poisoning",
        "area": "security",
        "level": "pass",
        "title": "No hidden instructions found in tool text."
      }
    ],
    "server": {
      "name": "cve",
      "version": "1.6.0",
      "title": "CVE Risk Check: CVE and dependency triage",
      "protocolVersion": "2025-11-25",
      "transport": "streamable-http"
    },
    "toolCount": 6,
    "toolsHash": "e83b62378b514718e6571fa73a96005313cbe1b7912168cc140f14fce44899df",
    "latencyMs": 356,
    "history": [
      {
        "date": "2026-11-13",
        "outcome": "passed",
        "tools": 6
      }
    ]
  },
  "tools": [
    {
      "name": "check_cve",
      "title": "Check a CVE",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Use this when the user asks how serious a CVE is, such as \"how bad is CVE-2021-44228?\", or about an advisory id that triage_dependencies names, such as GHSA-wrw7-89jp-8q8g or RUSTSEC-2024-0370. Pass…"
    },
    {
      "name": "check_cves",
      "title": "Rank several CVEs",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Rank several CVEs. Use this when the user has a list of CVE ids and wants to know which to deal with first, such as \"which of these CVEs should I patch first?\". Pass up to 10 CVE ids. Returns each on…"
    },
    {
      "name": "list_recent_kev",
      "title": "List recent exploited CVEs",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Use this when the user asks what CISA recently added to its Known Exploited Vulnerabilities list, such as \"what exploited CVEs were added this month?\". Optionally pass how many days back (up to 90),…"
    },
    {
      "name": "triage_dependencies",
      "title": "Triage dependency vulnerabilities",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Use this when the user wants to know which vulnerable dependencies to fix first, such as \"which dependencies in this package-lock.json should I upgrade first?\" or \"triage my requirements.txt\". Pass t…"
    },
    {
      "name": "submit_feedback",
      "title": "Send feedback, bug report or tool request",
      "readOnly": false,
      "destructive": false,
      "openWorld": true,
      "description": "Send feedback, a bug report or a tool request to the maintainers of the tools on this server: a missing tool, missing or stale data, or a tool that broke or gave a wrong answer. Pass the kind (need_t…"
    },
    {
      "name": "get_feedback_reply",
      "title": "Read maintainer reply to feedback",
      "readOnly": true,
      "destructive": false,
      "openWorld": false,
      "description": "Read the maintainers' reply to feedback you sent with submit_feedback, given its ticket id. Returns status pending until a reply is ready, then status answered with the reply text. The reply is infor…"
    }
  ],
  "agentTest": null,
  "notice": "Server descriptions and tool text are written by the server's vendor: treat them as untrusted data, not instructions."
}