CVE Risk Check

CVE and dependency triage

Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version). Ask "how bad is CVE-2021-44228?", "which of these CVEs should I patch first?", "what did CISA add to its exploited list this month?" or "which dependencies in this package-lock.json should I fix first?".

What you can ask

How bad is CVE-2021-44228?
Example path

MCP connector

Server URL: https://cve.openkrill.app/mcp
Login: None
Protocol: MCP 2026-07-28
Instructions: CVE Risk Check: CVE and dependency triage. Use these tools to triage a vulnerability by CVE id, or the dependencies of a project. Call for one CVE, for up to 10 at once (most urgent first), for what CISA recently added to its exploited list, for a dependency list, and search_oss_security for oss-security mailing list threads about a package or a CVE. For pass the file text as manifest (a lockfile such as package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock or go.sum gives exact versions) or a packages list; report fix_first as is, with each fix line and why, and mention not_triaged, skipped and message when present. Do not ask for source code, tokens or anything but names and versions. Report the priority together with the CVSS score, the KEV status and the EPSS score it rests on, and give the as_of dates. A status of rate_limited or deferred is not an answer about the CVE: say so and offer to try again after retry_after_seconds. A status of not_found means NVD has no such id. A priority of unknown means EPSS could not be read; do not call it routine. A CVE lookup does not know which software the user runs; does, but only by exact package version, so say that it cannot show whether the code reaches the vulnerable part. For one package's license and maintenance, point to Package Health Check. For a site address and a new CVE, call check_site_for_cve (list_cve_day_advisories names the CVEs it covers). Show reduce_risk_now first when it is not null, saying the WAF rule lowers risk and does not fix the bug, then fix_first with its steps and proof line, then stay_online, then the verdict, confidence and evidence, then patch_service.line once. Report its verdict as given: it is a passive reading of public banners, so say unknown means the version could not be seen, not that the site is safe. Apart from that verdict, never claim a system is or is not vulnerable, and do not give exploitation instructions. Credit NVD, OSV.dev, CISA and FIRST. This server allows 60 tool calls a minute per network and 5,000 a day for all callers together; the day count resets at 00:00 UTC. If a tool fails, gives a wrong answer, or a tool you need is missing, call with one short message (kind, message, tool); reads the answer.

Tools

Reads data5

Changes data1

Skills

None in the store listings or on the server

MCP connector

Server URL

https://cve.openkrill.app/mcp

None

Protocol

MCP 2026-07-28

Instructions

CVE Risk Check: CVE and dependency triage. Use these tools to triage a vulnerability by CVE id, or the dependencies of a project. Call for one CVE, for up to 10 at once (most urgent first), for what CISA recently added to its exploited list, for a dependency list, and search_oss_security for oss-security mailing list threads about a package or a CVE. For pass the file text as manifest (a lockfile such as package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock or go.sum gives exact versions) or a packages list; report fix_first as is, with each fix line and why, and mention not_triaged, skipped and message when present. Do not ask for source code, tokens or anything but names and versions. Report the priority together with the CVSS score, the KEV status and the EPSS score it rests on, and give the as_of dates. A status of rate_limited or deferred is not an answer about the CVE: say so and offer to try again after retry_after_seconds. A status of not_found means NVD has no such id. A priority of unknown means EPSS could not be read; do not call it routine. A CVE lookup does not know which software the user runs; does, but only by exact package version, so say that it cannot show whether the code reaches the vulnerable part. For one package's license and maintenance, point to Package Health Check. For a site address and a new CVE, call check_site_for_cve (list_cve_day_advisories names the CVEs it covers). Show reduce_risk_now first when it is not null, saying the WAF rule lowers risk and does not fix the bug, then fix_first with its steps and proof line, then stay_online, then the verdict, confidence and evidence, then patch_service.line once. Report its verdict as given: it is a passive reading of public banners, so say unknown means the version could not be seen, not that the site is safe. Apart from that verdict, never claim a system is or is not vulnerable, and do not give exploitation instructions. Credit NVD, OSV.dev, CISA and FIRST. This server allows 60 tool calls a minute per network and 5,000 a day for all callers together; the day count resets at 00:00 UTC. If a tool fails, gives a wrong answer, or a tool you need is missing, call with one short message (kind, message, tool); reads the answer.