cisa-cybersecurity-mcp-server
An MCP server providing access to CISA's Known Exploited Vulnerabilities catalog, BOD 26-04 remediation deadlines, SSVC prioritization data, and the ICS advisory corpus. It allows agents to check CVE status, search vulnerabilities by various criteria, and retrieve advisory details without requiring API keys.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
https://cisa-cybersecurity.caseyjhand.com/mcpWhat its tools do
7 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.
Checks and signals
Each line is separate evidence, not a trust score.
- Passed Endpoint answered the live check ·
- Availability 1 of 1 checks passed in 30 days
What you can do with it
- Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog
- Search KEV by vendor, product, CWE, or overdue status
- Fetch SSVC decision points and compute BOD 26-04 timelines
- Search and read ICS advisories by vendor, product, or CVE
Source and maintenance
- Maintenance checked
Protocol and capabilities
- Server
- cisa-cybersecurity-mcp-server 0.4.0
- MCP protocol negotiated in check
- 2025-11-25
- Tools
- 7 advertised
- Resources
- 61 advertised
- Resource templates
- 3 advertised
- Prompts
- 0 advertised
{
"tools": {
"listChanged": true
},
"logging": {},
"prompts": {
"listChanged": true
},
"resources": {
"subscribe": true,
"listChanged": true
},
"extensions": {
"io.modelcontextprotocol/skills": {
"directoryRead": true
}
},
"completions": {}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
7 advertised
cisa_list_reference — cisa_list_reference
Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"topic"
],
"properties": {
"topic": {
"enum": [
"directives",
"kev_fields",
"ssvc_values",
"sectors",
"advisory_id_formats",
"severity_bands",
"sources"
],
"type": "string",
"description": "Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds)."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"topic",
"title",
"summary",
"entries"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"description": "Machine-readable failure mode."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"title": {
"type": "string",
"description": "Human-readable title for the topic."
},
"topic": {
"enum": [
"directives",
"kev_fields",
"ssvc_values",
"sectors",
"advisory_id_formats",
"severity_bands",
"sources"
],
"type": "string",
"description": "The topic that was decoded."
},
"entries": {
"type": "array",
"items": {
"type": "object",
"required": [
"key",
"label",
"description"
],
"properties": {
"key": {
"type": "string",
"description": "Stable identifier for the term."
},
"label": {
"type": "string",
"description": "Human-readable name for the term."
},
"values": {
"type": "array",
"items": {
"type": "string",
"description": "One accepted value."
},
"description": "The value domain, when the term has a closed or enumerated one."
},
"description": {
"type": "string",
"description": "What the term means and how it affects a query."
}
},
"description": "One decoded term within the topic.",
"additionalProperties": false
},
"description": "The decoded terms for this topic."
},
"sources": {
"type": "object",
"required": [
"kev",
"csafMirror",
"vulnrichment",
"feeds"
],
"properties": {
"kev": {
"type": "object",
"required": [
"catalogVersion",
"dateReleased",
"count",
"lastCheckedAt",
"lastModified",
"refreshCron"
],
"properties": {
"count": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Entry count the loaded snapshot carries; null before the first load."
},
"refreshCron": {
"type": "string",
"description": "Cron expression the refresh poll runs on, or off when it is disabled."
},
"dateReleased": {
"type": [
"string",
"null"
],
"description": "Release timestamp the loaded snapshot carries; null before the first load."
},
"lastModified": {
"type": [
"string",
"null"
],
"description": "Upstream Last-Modified of the loaded snapshot, used for the conditional poll."
},
"lastCheckedAt": {
"type": [
"string",
"null"
],
"description": "When the refresh poll last reached the origin, ISO 8601; null if never."
},
"catalogVersion": {
"type": [
"string",
"null"
],
"description": "Catalog version of the loaded snapshot; null before the first load lands."
}
},
"description": "The in-memory KEV catalog snapshot.",
"additionalProperties": false
},
"feeds": {
"type": "object",
"required": [
"windowItems",
"cached"
],
"properties": {
"cached": {
"type": "array",
"items": {
"type": "object",
"required": [
"feed",
"oldest",
"newest",
"fetchedAt"
],
"properties": {
"feed": {
"enum": [
"advisories",
"alerts",
"ics"
],
"type": "string",
"description": "Which feed this cached window belongs to."
},
"newest": {
"type": [
"string",
"null"
],
"description": "Publication date of the newest item in the cached window."
},
"oldest": {
"type": [
"string",
"null"
],
"description": "Publication date of the oldest item in the cached window."
},
"fetchedAt": {
"type": "string",
"description": "When this window was fetched, ISO 8601."
}
},
"description": "One cached feed window.",
"additionalProperties": false
},
"description": "Feed windows currently held in memory; empty before any feed is read."
},
"windowItems": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Items each feed serves — a fixed upstream ceiling, not a server choice."
}
},
"description": "The RSS feed tier.",
"additionalProperties": false
},
"csafMirror": {
"type": "object",
"required": [
"ready",
"documentCount",
"failedDocumentCount",
"lastSuccessfulCheckpoint",
"checkpoint",
"syncStatus",
"lastCompletedAt"
],
"properties": {
"ready": {
"type": "boolean",
"description": "True once a full sync has ever completed; stays true during a refresh."
},
"checkpoint": {
"type": [
"string",
"null"
],
"description": "Durable high-water mark — the newest current_release_date ingested."
},
"syncStatus": {
"type": "string",
"description": "Lifecycle state: pending, in_progress, complete, partial, error, busy, or unavailable. A partial refresh keeps applied rows and retries unresolved documents on the next refresh."
},
"documentCount": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Advisories currently held in the index, including partial updates; null before the first sync completes or when the store cannot be read."
},
"lastCompletedAt": {
"type": [
"string",
"null"
],
"description": "When a full sync last completed, ISO 8601; null if never."
},
"unavailableReason": {
"enum": [
"not_writable",
"read_only",
"missing_directory",
"not_a_directory",
"not_a_database"
],
"type": "string",
"description": "Present only when the index cannot be opened: its location is not writable, is read-only, has a missing directory, runs through a file, or holds a file that is not a SQLite database. Fixed by CISA_CSAF_MIRROR_PATH, not by waiting."
},
"failedDocumentCount": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Changed documents that failed in the last manifest application; zero after a successful sync, null when the store cannot be read."
},
"lastSuccessfulCheckpoint": {
"type": [
"string",
"null"
],
"description": "Newest current_release_date at the last wholly successful sync; unchanged after partial updates, null before completion."
}
},
"description": "The local ICS advisory index.",
"additionalProperties": false
},
"vulnrichment": {
"type": "object",
"required": [
"mode",
"cacheTtlSeconds"
],
"properties": {
"mode": {
"type": "string",
"const": "on_demand",
"description": "Access mode — fetched per CVE on demand; the repository is not mirrored."
},
"cacheTtlSeconds": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "TTL for a cached record; negative results use one sixth of it."
}
},
"description": "The per-CVE SSVC enrichment tier.",
"additionalProperties": false
}
},
"description": "Topic sources only — what this server currently holds, read from in-process state.",
"additionalProperties": false
},
"summary": {
"type": "string",
"description": "What this topic covers and when to reach for it."
},
"supersedes": {
"type": "array",
"items": {
"type": "object",
"required": [
"directive",
"issued",
"note"
],
"properties": {
"note": {
"type": "string",
"description": "What the superseded directive covered."
},
"issued": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Issue date, YYYY-MM-DD."
},
"directive": {
"type": "string",
"description": "The superseded directive identifier."
}
},
"description": "One directive that BOD 26-04 supersedes and revokes.",
"additionalProperties": false
},
"description": "Topic directives only — the directives BOD 26-04 supersedes and revokes."
},
"definitions": {
"type": "array",
"items": {
"type": "object",
"required": [
"term",
"definition"
],
"properties": {
"term": {
"type": "string",
"description": "The defined term."
},
"definition": {
"type": "string",
"description": "The directive's own definition of the term."
}
},
"description": "One supporting definition from the directive text.",
"additionalProperties": false
},
"description": "Topic directives only — supporting definitions from the directive text."
},
"timelineTable": {
"type": "array",
"items": {
"type": "object",
"required": [
"row",
"publiclyExposed",
"inKev",
"automatable",
"technicalImpact",
"timelineLabel",
"remediationTimelineDays",
"forensicTriageRequired"
],
"properties": {
"row": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Table 1 row number, 1 through 16."
},
"inKev": {
"type": "boolean",
"description": "Whether the CVE is in the CISA KEV catalog."
},
"automatable": {
"type": "boolean",
"description": "The SSVC Automatable decision point for this row."
},
"timelineLabel": {
"type": "string",
"description": "The agency timeline in the directive's own wording."
},
"publiclyExposed": {
"type": "boolean",
"description": "Whether the asset is reachable by unauthenticated or untrusted entities."
},
"technicalImpact": {
"enum": [
"partial",
"total"
],
"type": "string",
"description": "The SSVC Technical Impact decision point for this row."
},
"forensicTriageRequired": {
"type": "boolean",
"description": "Whether the row additionally requires a forensic triage of the asset."
},
"remediationTimelineDays": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Calendar days allowed, or null for the \"Fix on system upgrade\" rows."
}
},
"description": "One row of BOD 26-04 Appendix A, Table 1.",
"additionalProperties": false
},
"description": "Topic directives only — all sixteen rows of BOD 26-04 Appendix A, Table 1."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}cisa_check_cve_status — cisa_check_cve_status
Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cveIds"
],
"properties": {
"cveIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
},
"maxItems": 1000,
"minItems": 1,
"description": "CVE identifiers to check, up to 1,000 accepted and 200 processed per call. Oversized batches return normalized unprocessedIds for a follow-up call unless normalization is disabled. The whole batch costs zero upstream requests — pair a large batch with detail \"summary\"."
},
"detail": {
"enum": [
"full",
"summary"
],
"type": "string",
"default": "full",
"description": "full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"results",
"foundCount",
"notFoundCount",
"catalog",
"asOf"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"asOf": {
"type": "string",
"description": "The UTC date daysUntilDue and overdue were computed against, YYYY-MM-DD."
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"read_limit_exceeded",
"catalog_unavailable"
],
"description": "Machine-readable failure mode. Declared by this tool: `read_limit_exceeded`: The batch exceeds the per-call cap and input normalization is disabled. `catalog_unavailable`: No KEV catalog snapshot is held and the fetch from cisa.gov failed. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"notice": {
"type": "string",
"description": "Guidance when none of the supplied CVE IDs are in the catalog."
},
"catalog": {
"type": "object",
"required": [
"catalogVersion",
"dateReleased",
"count",
"fetchedAt"
],
"properties": {
"count": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Entries in the loaded snapshot."
},
"fetchedAt": {
"type": "string",
"description": "When this server fetched the snapshot, ISO 8601."
},
"dateReleased": {
"type": "string",
"description": "Release timestamp the snapshot carries."
},
"catalogVersion": {
"type": "string",
"description": "Version string of the loaded catalog snapshot."
}
},
"description": "Which catalog snapshot answered this call.",
"additionalProperties": false
},
"results": {
"type": "array",
"items": {
"type": "object",
"required": [
"cveId",
"inKev"
],
"properties": {
"cwes": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "One CWE identifier."
},
"description": "Associated CWEs. Empty on some entries, and a CWE filter excludes those. Absent under detail \"summary\"."
},
"cveId": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "The CVE identifier that was looked up."
},
"inKev": {
"type": "boolean",
"description": "Whether the CVE is in the KEV catalog. False is a normal result, not an error."
},
"kevUrl": {
"type": "string",
"description": "Absolute URL of the KEV catalog page for this CVE. Absent under detail \"summary\"."
},
"dueDate": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Federal remediation deadline CISA assigned, YYYY-MM-DD."
},
"overdue": {
"type": "boolean",
"description": "True when the due date is strictly before the echoed asOf date."
},
"product": {
"type": "string",
"description": "CISA's own product label — free text, not a CPE."
},
"dateAdded": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Date CISA added the entry to the catalog, YYYY-MM-DD."
},
"directive": {
"anyOf": [
{
"enum": [
"BOD 26-04",
"BOD 22-01"
],
"type": "string"
},
{
"type": "null"
}
],
"description": "The binding operational directive the entry cites, or null when it cites neither — most entries name none, and none is never inferred from age."
},
"references": {
"type": "array",
"items": {
"type": "object",
"required": [
"kind",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Absolute reference URL, verbatim from the notes field."
},
"kind": {
"enum": [
"nvd",
"cisa",
"bod_guidance",
"forensic_triage",
"vendor",
"other"
],
"type": "string",
"description": "What the link points at: the NVD detail record, a cisa.gov page, BOD 26-04 guidance, the forensic-triage requirements, a vendor page, or an unclassifiable URL."
},
"label": {
"type": "string",
"description": "CISA's own label for the segment, when the notes entry carried one."
}
},
"description": "One reference URL parsed from the entry notes.",
"additionalProperties": false
},
"description": "Every reference URL in the notes field, in notes order, each classified by kind. Absent under detail \"summary\"."
},
"daysUntilDue": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Whole days from the echoed asOf date to the due date; negative once overdue."
},
"vendorProject": {
"type": "string",
"description": "CISA's own vendor label — free text, not a CPE vendor component."
},
"forensicTriage": {
"enum": [
"Yes",
"No"
],
"type": "string",
"description": "Whether the entry falls in the BOD 26-04 three-day forensic-triage tier."
},
"requiredAction": {
"type": "string",
"description": "CISA's required-action text for the entry, verbatim. Absent under detail \"summary\"."
},
"notesCommentary": {
"type": "string",
"description": "The prose segments of the notes field, verbatim with any URLs they contain; present when the notes carry prose. Absent under detail \"summary\"."
},
"shortDescription": {
"type": "string",
"description": "CISA's one-paragraph description. Absent under detail \"summary\"."
},
"vulnerabilityName": {
"type": "string",
"description": "CISA's short name for the vulnerability. Absent under detail \"summary\"."
},
"knownRansomwareCampaignUse": {
"enum": [
"Known",
"Unknown"
],
"type": "string",
"description": "Whether CISA has linked the vulnerability to a ransomware campaign. Unknown means no link on record, not that none exists."
}
},
"description": "One KEV catalog entry, or a not-in-KEV result carrying only cveId and inKev. Under cisa_check_cve_status detail \"summary\" an entry carries only cveId, inKev, the dates and deadline status, directive, vendor and product labels, and the ransomware and forensic-triage flags.",
"additionalProperties": false
},
"description": "One result per processed CVE, in the order supplied."
},
"foundCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "How many of the requested CVEs are in the catalog."
},
"summaryNote": {
"type": "string",
"description": "Present only under detail \"summary\": which fields each in-KEV result omits and how to restore them."
},
"notFoundCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "How many of the requested CVEs are not in the catalog."
},
"unprocessedIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
},
"description": "Normalized CVE IDs not processed; send these in a follow-up call."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"idempotentHint": true
}cisa_search_kev — cisa_search_kev
Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"cwe": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match."
},
"limit": {
"type": "integer",
"default": 25,
"maximum": 1000,
"minimum": 1,
"description": "Maximum entries per page; requests above 100 use 100 when input clamping is enabled."
},
"order": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc",
"description": "Sort direction."
},
"cursor": {
"type": "string",
"description": "Opaque pagination cursor from a previous call. Omit for the first page."
},
"sortBy": {
"enum": [
"dueDate",
"dateAdded"
],
"type": "string",
"default": "dateAdded",
"description": "Field to sort by."
},
"overdue": {
"type": "boolean",
"description": "True selects entries whose due date is strictly before the echoed asOf date."
},
"product": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of CISA's own product label."
},
"dueAfter": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest due date, inclusive, YYYY-MM-DD."
},
"directive": {
"enum": [
"BOD 26-04",
"BOD 22-01",
"none"
],
"type": "string",
"description": "Which directive the entry cites. \"none\" selects the entries citing neither."
},
"dueBefore": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest due date, inclusive, YYYY-MM-DD."
},
"ransomware": {
"type": "boolean",
"description": "True selects entries CISA has linked to ransomware campaigns."
},
"cveIdPrefix": {
"type": "string",
"pattern": "^CVE-[0-9]{4}$",
"description": "Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized."
},
"dateAddedTo": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest date added, inclusive, YYYY-MM-DD."
},
"nameContains": {
"type": "string",
"minLength": 2,
"description": "Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback."
},
"dateAddedFrom": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest date added, inclusive, YYYY-MM-DD."
},
"vendorProject": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of CISA's own vendor label."
},
"forensicTriage": {
"type": "boolean",
"description": "True selects the BOD 26-04 three-day forensic-triage tier."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"results",
"hasMore",
"totalCount",
"catalog",
"asOf",
"appliedFilters"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"cap": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "The page limit that was applied."
},
"asOf": {
"type": "string",
"description": "The UTC date overdue and daysUntilDue were computed against, YYYY-MM-DD."
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"read_limit_exceeded",
"catalog_unavailable",
"invalid_date_range",
"empty_search_text"
],
"description": "Machine-readable failure mode. Declared by this tool: `read_limit_exceeded`: limit exceeds the per-call cap and input clamping is disabled. `catalog_unavailable`: No KEV catalog snapshot is held and the fetch from cisa.gov failed. `invalid_date_range`: A From bound is later than its matching To bound. `empty_search_text`: nameContains holds no letter a-z or digit 0-9 once case, accents, and letters such as ß and ø are folded and punctuation is removed, so there is nothing to search for. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"shown": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Entries returned on this page."
},
"cursor": {
"type": "string",
"description": "Opaque cursor for the next page. Absent when this is the last page."
},
"notice": {
"type": "string",
"description": "Guidance when nothing matched, when a page was capped, or when nameContains dropped characters it cannot match."
},
"catalog": {
"type": "object",
"required": [
"catalogVersion",
"dateReleased",
"count",
"fetchedAt"
],
"properties": {
"count": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Entries in the loaded snapshot."
},
"fetchedAt": {
"type": "string",
"description": "When this server fetched the snapshot, ISO 8601."
},
"dateReleased": {
"type": "string",
"description": "Release timestamp the snapshot carries."
},
"catalogVersion": {
"type": "string",
"description": "Version string of the loaded catalog snapshot."
}
},
"description": "Which catalog snapshot answered this call.",
"additionalProperties": false
},
"hasMore": {
"type": "boolean",
"description": "Whether more matches exist beyond this page."
},
"results": {
"type": "array",
"items": {
"type": "object",
"required": [
"cveId",
"inKev"
],
"properties": {
"cwes": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "One CWE identifier."
},
"description": "Associated CWEs. Empty on some entries, and a CWE filter excludes those. Absent under detail \"summary\"."
},
"cveId": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "The CVE identifier that was looked up."
},
"inKev": {
"type": "boolean",
"description": "Whether the CVE is in the KEV catalog. False is a normal result, not an error."
},
"kevUrl": {
"type": "string",
"description": "Absolute URL of the KEV catalog page for this CVE. Absent under detail \"summary\"."
},
"dueDate": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Federal remediation deadline CISA assigned, YYYY-MM-DD."
},
"overdue": {
"type": "boolean",
"description": "True when the due date is strictly before the echoed asOf date."
},
"product": {
"type": "string",
"description": "CISA's own product label — free text, not a CPE."
},
"dateAdded": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Date CISA added the entry to the catalog, YYYY-MM-DD."
},
"directive": {
"anyOf": [
{
"enum": [
"BOD 26-04",
"BOD 22-01"
],
"type": "string"
},
{
"type": "null"
}
],
"description": "The binding operational directive the entry cites, or null when it cites neither — most entries name none, and none is never inferred from age."
},
"references": {
"type": "array",
"items": {
"type": "object",
"required": [
"kind",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Absolute reference URL, verbatim from the notes field."
},
"kind": {
"enum": [
"nvd",
"cisa",
"bod_guidance",
"forensic_triage",
"vendor",
"other"
],
"type": "string",
"description": "What the link points at: the NVD detail record, a cisa.gov page, BOD 26-04 guidance, the forensic-triage requirements, a vendor page, or an unclassifiable URL."
},
"label": {
"type": "string",
"description": "CISA's own label for the segment, when the notes entry carried one."
}
},
"description": "One reference URL parsed from the entry notes.",
"additionalProperties": false
},
"description": "Every reference URL in the notes field, in notes order, each classified by kind. Absent under detail \"summary\"."
},
"daysUntilDue": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Whole days from the echoed asOf date to the due date; negative once overdue."
},
"vendorProject": {
"type": "string",
"description": "CISA's own vendor label — free text, not a CPE vendor component."
},
"forensicTriage": {
"enum": [
"Yes",
"No"
],
"type": "string",
"description": "Whether the entry falls in the BOD 26-04 three-day forensic-triage tier."
},
"requiredAction": {
"type": "string",
"description": "CISA's required-action text for the entry, verbatim. Absent under detail \"summary\"."
},
"notesCommentary": {
"type": "string",
"description": "The prose segments of the notes field, verbatim with any URLs they contain; present when the notes carry prose. Absent under detail \"summary\"."
},
"shortDescription": {
"type": "string",
"description": "CISA's one-paragraph description. Absent under detail \"summary\"."
},
"vulnerabilityName": {
"type": "string",
"description": "CISA's short name for the vulnerability. Absent under detail \"summary\"."
},
"knownRansomwareCampaignUse": {
"enum": [
"Known",
"Unknown"
],
"type": "string",
"description": "Whether CISA has linked the vulnerability to a ransomware campaign. Unknown means no link on record, not that none exists."
}
},
"description": "One KEV catalog entry, or a not-in-KEV result carrying only cveId and inKev. Under cisa_check_cve_status detail \"summary\" an entry carries only cveId, inKev, the dates and deadline status, directive, vendor and product labels, and the ransomware and forensic-triage flags.",
"additionalProperties": false
},
"description": "Matching KEV entries for this page."
},
"truncated": {
"type": "boolean",
"description": "True when the page limit capped this result."
},
"totalCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Total matches before paging."
},
"appliedFilters": {
"type": "object",
"description": "The filters the server actually applied, as it parsed them.",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "string",
"description": "The filter value as the server parsed it."
}
},
"snapshotCaveat": {
"type": "string",
"description": "Disclosure that additions are queryable but revisions are not detectable."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"idempotentHint": true
}cisa_get_ssvc — cisa_get_ssvc
Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cveIds"
],
"properties": {
"cveIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
},
"maxItems": 1000,
"minItems": 1,
"description": "CVE identifiers to look up, up to 1,000 accepted and 50 processed per call. Oversized batches return normalized unprocessedIds for a follow-up call unless normalization is disabled. Each uncached CVE needs its own live enrichment lookup rather than a cached batch check."
},
"assetExposure": {
"enum": [
"publicly_exposed",
"not_publicly_exposed",
"unknown"
],
"type": "string",
"default": "unknown",
"description": "Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. \"unknown\" returns both arms so the spread is visible without guessing."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"results",
"foundCount",
"notFoundCount",
"failedCount",
"echo"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"echo": {
"type": "object",
"required": [
"assetExposure",
"requested"
],
"properties": {
"requested": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "How many CVE IDs were requested."
},
"assetExposure": {
"type": "string",
"description": "The asset exposure the server applied."
}
},
"description": "The request as the server parsed it.",
"additionalProperties": false
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"read_limit_exceeded",
"enrichment_source_unavailable"
],
"description": "Machine-readable failure mode. Declared by this tool: `read_limit_exceeded`: The batch exceeds the per-call cap and input normalization is disabled. `enrichment_source_unavailable`: Every processed per-CVE fetch failed, including rejected HTTP responses. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"notice": {
"type": "string",
"description": "Guidance when nothing was enriched, or when a decision timestamp predates KEV."
},
"results": {
"type": "array",
"items": {
"type": "object",
"required": [
"cveId",
"found",
"outcome",
"cwes",
"inKev",
"sourceUrl"
],
"properties": {
"cvss": {
"type": "object",
"required": [
"version",
"baseScore",
"baseSeverity",
"vectorString"
],
"properties": {
"version": {
"type": "string",
"description": "CVSS version of the contributed score."
},
"baseScore": {
"type": "number",
"description": "CVSS base score, 0.0 through 10.0."
},
"baseSeverity": {
"type": "string",
"description": "Qualitative severity band as published."
},
"vectorString": {
"type": "string",
"description": "The full CVSS vector string."
}
},
"description": "The CVSS score CISA contributed through its ADP container, when present.",
"additionalProperties": false
},
"cwes": {
"type": "array",
"items": {
"type": "object",
"required": [
"cweId",
"description"
],
"properties": {
"cweId": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "CWE identifier."
},
"description": {
"type": "string",
"description": "CWE name as published."
}
},
"description": "One CWE from the CISA-authored container.",
"additionalProperties": false
},
"description": "CWEs CISA contributed. Empty when none were published."
},
"cveId": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "The CVE identifier that was looked up."
},
"found": {
"type": "boolean",
"description": "Whether CISA has published SSVC decision points for this CVE; outcome explains a false value."
},
"inKev": {
"type": "boolean",
"description": "Whether the CVE is in this server's KEV catalog snapshot."
},
"bod2604": {
"type": "object",
"required": [
"timelines",
"basis",
"caveat"
],
"properties": {
"basis": {
"type": "string",
"description": "The decision table the timeline was resolved against."
},
"caveat": {
"type": "string",
"description": "What the computation is and is not. Fixed text on every result."
},
"timelines": {
"type": "array",
"items": {
"type": "object",
"required": [
"assetExposure",
"tableRow",
"timelineLabel",
"remediationTimelineDays",
"forensicTriageRequired"
],
"properties": {
"tableRow": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "BOD 26-04 Table 1 row number, 1 to 16."
},
"assetExposure": {
"enum": [
"publicly_exposed",
"not_publicly_exposed"
],
"type": "string",
"description": "The exposure arm this timeline applies to."
},
"timelineLabel": {
"type": "string",
"description": "The agency timeline in the directive's own wording."
},
"forensicTriageRequired": {
"type": "boolean",
"description": "Whether a forensic triage of the asset is also required."
},
"remediationTimelineDays": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Calendar days allowed, or null for \"Fix on system upgrade\"."
}
},
"description": "One computed remediation timeline.",
"additionalProperties": false
},
"description": "One timeline per exposure arm — one when the caller stated an exposure, both when it is unknown."
}
},
"description": "The BOD 26-04 timeline implied by the published decision points.",
"additionalProperties": false
},
"outcome": {
"enum": [
"ssvc",
"not_found",
"no_cisa_container",
"no_ssvc_metric",
"fetch_failed"
],
"type": "string",
"description": "The lookup outcome, distinguishing confirmed absence from fetch failure."
},
"guidance": {
"type": "string",
"description": "What to do instead, present on every result where found is false."
},
"ssvcRole": {
"type": "string",
"description": "The SSVC role CISA recorded, e.g. CISA Coordinator."
},
"sourceUrl": {
"type": "string",
"description": "The Vulnrichment record URL this result was read from."
},
"automatable": {
"type": "string",
"description": "The SSVC Automatable value (yes or no)."
},
"kevAssigned": {
"type": "object",
"required": [
"dateAdded",
"dueDate",
"daysFromAdd",
"forensicTriage",
"directive"
],
"properties": {
"dueDate": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Federal remediation deadline CISA assigned."
},
"dateAdded": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Date CISA added the CVE to the KEV catalog."
},
"directive": {
"anyOf": [
{
"enum": [
"BOD 26-04",
"BOD 22-01"
],
"type": "string"
},
{
"type": "null"
}
],
"description": "The directive the KEV entry cites, or null when it cites neither."
},
"daysFromAdd": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Calendar days from dateAdded to dueDate."
},
"forensicTriage": {
"enum": [
"Yes",
"No"
],
"type": "string",
"description": "Whether the KEV entry is in the three-day forensic-triage tier."
}
},
"description": "CISA's own assignment for this CVE, reported alongside the computation.",
"additionalProperties": false
},
"ssvcVersion": {
"type": "string",
"description": "SSVC schema version CISA published against."
},
"exploitation": {
"type": "string",
"description": "The SSVC Exploitation value (none, poc, or active). Values outside that set are passed through verbatim."
},
"ssvcTimestamp": {
"type": "string",
"description": "When CISA published these decision points, ISO 8601."
},
"technicalImpact": {
"type": "string",
"description": "The SSVC Technical Impact value (partial or total)."
},
"assignmentAgrees": {
"type": "boolean",
"description": "Whether CISA's assigned deadline matches the computed timeline. Present only when the CVE is in KEV and an exposure was stated. Reported, never reconciled."
}
},
"description": "One SSVC lookup result.",
"additionalProperties": false
},
"description": "One result per processed CVE, in the order supplied."
},
"foundCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "How many CVEs carry published SSVC decision points."
},
"failedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "How many processed CVE lookups failed; absence is unknown."
},
"notFoundCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "How many processed CVEs have confirmed absence of SSVC decision points."
},
"unprocessedIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
},
"description": "Normalized CVE IDs not processed; send these in a follow-up call."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"idempotentHint": true
}cisa_search_ics_advisories — cisa_search_ics_advisories
Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"q": {
"type": "string",
"minLength": 2,
"description": "Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number."
},
"cve": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized."
},
"cwe": {
"type": "string",
"pattern": "^CWE-[0-9]+$",
"description": "Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children."
},
"inKev": {
"type": "boolean",
"description": "true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result."
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 1000,
"minimum": 1,
"description": "Maximum advisories per page; requests above 50 use 50 when input clamping is enabled."
},
"order": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc",
"description": "Sort direction. Under relevance, desc means most relevant first."
},
"cursor": {
"type": "string",
"description": "Opaque pagination cursor from a previous call. Omit for the first page."
},
"sector": {
"enum": [
"Chemical",
"Commercial Facilities",
"Communications",
"Critical Manufacturing",
"Dams",
"Defense Industrial Base",
"Emergency Services",
"Energy",
"Financial Services",
"Food and Agriculture",
"Government Facilities",
"Healthcare and Public Health",
"Information Technology",
"Nuclear Reactors, Materials, and Waste",
"Transportation Systems",
"Water and Wastewater Systems",
"Multiple"
],
"type": "string",
"description": "Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors."
},
"series": {
"enum": [
"ICSA",
"ICSMA"
],
"type": "string",
"description": "Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus."
},
"sortBy": {
"enum": [
"relevance",
"published",
"revised",
"maxCvss"
],
"type": "string",
"default": "revised",
"description": "Field to sort by. relevance requires q and ranks by FTS5 bm25."
},
"vendor": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact."
},
"cvssMax": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Maximum value of the advisory's maximum CVSS base score, inclusive."
},
"cvssMin": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Minimum value of the advisory's maximum CVSS base score, inclusive."
},
"product": {
"type": "string",
"minLength": 2,
"description": "Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters."
},
"severity": {
"enum": [
"NONE",
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"type": "string",
"description": "Severity band of the advisory's maximum CVSS score."
},
"publisher": {
"enum": [
"coordinator",
"other"
],
"type": "string",
"description": "coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus."
},
"revisedTo": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest current release date, inclusive, YYYY-MM-DD."
},
"publishedTo": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Latest initial release date, inclusive, YYYY-MM-DD."
},
"revisedFrom": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest current release date, inclusive, YYYY-MM-DD."
},
"publishedFrom": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Earliest initial release date, inclusive, YYYY-MM-DD."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"results",
"hasMore",
"totalCount",
"appliedFilters",
"mirror"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"cap": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "The page limit that was applied."
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"read_limit_exceeded",
"mirror_busy",
"mirror_not_ready",
"mirror_unavailable",
"invalid_cvss_range",
"invalid_date_range",
"relevance_sort_without_query",
"empty_search_text",
"catalog_unavailable"
],
"description": "Machine-readable failure mode. Declared by this tool: `read_limit_exceeded`: limit exceeds the per-call cap and input clamping is disabled. `mirror_busy`: A transient SQLite lock prevents the advisory index from opening. `mirror_not_ready`: The advisory index has never completed a full sync. `mirror_unavailable`: The advisory index store cannot be opened: its location is not writable, is read-only, runs through a missing directory or a file, or holds a file that is not a SQLite database. `invalid_cvss_range`: cvssMin exceeds cvssMax. `invalid_date_range`: A From bound is later than its matching To bound. `relevance_sort_without_query`: sortBy is relevance but no q was supplied, so there is no bm25 rank to sort by. `empty_search_text`: q contains no word or number once quotes and punctuation are removed, so there is nothing to search for. `catalog_unavailable`: inKev is set, no KEV catalog snapshot is held, and the fetch from cisa.gov failed. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"shown": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Advisories returned on this page."
},
"cursor": {
"type": "string",
"description": "Opaque cursor for the next page. Absent when this is the last page."
},
"mirror": {
"type": "object",
"required": [
"documentCount",
"checkpoint",
"lastRefreshedAt"
],
"properties": {
"checkpoint": {
"type": "string",
"description": "Newest current_release_date ingested, or \"none\"."
},
"documentCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Advisories held in the local index."
},
"lastRefreshedAt": {
"type": "string",
"description": "When a full sync last completed, or \"never\"."
}
},
"description": "Which index state answered this call.",
"additionalProperties": false
},
"notice": {
"type": "string",
"description": "Guidance when nothing matched — the filter that matches no advisory on its own and what dropping it restores, or the filters whose removal restores results and how many — when a page was capped, when KEV membership was not evaluated, or when a cwe result may be incomplete."
},
"hasMore": {
"type": "boolean",
"description": "Whether more matches exist beyond this page."
},
"results": {
"type": "array",
"items": {
"type": "object",
"required": [
"advisoryId",
"title",
"series",
"vendors",
"vendorCount",
"productCount",
"cves",
"cveCount",
"sectors",
"published",
"revised",
"revision",
"publisherCategory",
"url",
"csafUrl",
"attribution"
],
"properties": {
"url": {
"type": "string",
"description": "Absolute URL of the cisa.gov web version of the advisory."
},
"cves": {
"type": "array",
"items": {
"type": "string",
"description": "One CVE identifier."
},
"description": "Up to twenty CVEs; cveCount carries the full count."
},
"title": {
"type": "string",
"description": "The advisory title."
},
"series": {
"enum": [
"ICSA",
"ICSMA"
],
"type": "string",
"description": "Advisory series."
},
"csafUrl": {
"type": "string",
"description": "Absolute URL of the raw CSAF JSON document."
},
"kevCves": {
"type": "array",
"items": {
"type": "string",
"description": "One CVE identifier."
},
"description": "Every CVE this advisory covers that is in the KEV catalog, drawn from its full CVE list rather than the twenty in cves. Empty when none is; absent when KEV membership could not be evaluated."
},
"maxCvss": {
"type": "object",
"required": [
"score",
"severity",
"version",
"severityDerived"
],
"properties": {
"score": {
"type": "number",
"description": "Highest CVSS base score in the advisory."
},
"version": {
"type": "string",
"description": "CVSS version the highest score was published under."
},
"severity": {
"enum": [
"NONE",
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"type": "string",
"description": "Severity band for that score."
},
"severityDerived": {
"type": "boolean",
"description": "True when the band was derived from a CVSS v2 score rather than published upstream."
}
},
"description": "Highest CVSS score across the advisory. Absent when the advisory carries no CVSS score.",
"additionalProperties": false
},
"revised": {
"type": "string",
"description": "Current release date, ISO 8601."
},
"sectors": {
"type": "array",
"items": {
"type": "string",
"description": "One canonical sector name."
},
"description": "Normalized sector names. Empty when the advisory carries no sector note."
},
"vendors": {
"type": "array",
"items": {
"type": "string",
"description": "One vendor label."
},
"description": "Up to ten vendor labels; vendorCount carries the full count."
},
"cveCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Distinct CVEs the advisory covers."
},
"revision": {
"type": "string",
"description": "Document revision number."
},
"published": {
"type": "string",
"description": "Initial release date, ISO 8601."
},
"advisoryId": {
"type": "string",
"pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
"description": "The advisory identifier, e.g. ICSA-26-260-07. Pass it to cisa_get_advisory."
},
"sectorsRaw": {
"type": "string",
"description": "The sector note verbatim, when the advisory carries one."
},
"attribution": {
"type": "string",
"description": "Who authored the text and under what terms it may be redistributed."
},
"vendorCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Distinct vendors named in the product tree."
},
"productCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Flattened product entries in the product tree."
},
"publisherCategory": {
"type": "string",
"description": "coordinator for CISA-authored, other for a republished vendor advisory."
}
},
"description": "One matching advisory.",
"additionalProperties": false
},
"description": "Matching advisories for this page."
},
"truncated": {
"type": "boolean",
"description": "True when the page limit capped this result."
},
"totalCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Total matches before paging."
},
"cvssCoverage": {
"type": "string",
"description": "Disclosure of derived-band and no-score coverage under a score filter."
},
"appliedFilters": {
"type": "object",
"description": "The filters the server actually applied.",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "string",
"description": "The filter value as the server parsed it."
}
},
"sectorCoverage": {
"type": "string",
"description": "Disclosure of how many advisories a sector filter can never match."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}cisa_get_advisory — cisa_get_advisory
Read one CISA industrial control system advisory: product definitions and relationship component references; per-CVE CVSS score, vector, and CWE; vendor remediations, flags, and threats; sectors; and revision history. Large advisories return a section outline with byte sizes and vulnerability CVE IDs. Re-call with sections, cves for named vulnerabilities, or productIds for exact product definitions referenced by vulnerability status, scores, remediations, flags, or threats. Product IDs are case-sensitive; relationship selection does not expand components. Every response carries source URLs and attribution. Find advisory IDs with cisa_search_ics_advisories.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"advisoryId"
],
"properties": {
"cves": {
"type": "array",
"items": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "One CVE identifier the advisory covers, e.g. CVE-2023-3935. Case and surrounding whitespace are normalized."
},
"description": "Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include \"vulnerabilities\"."
},
"sections": {
"type": "array",
"items": {
"enum": [
"advisory",
"summary",
"products",
"vulnerabilities",
"revisionHistory",
"references",
"acknowledgments"
],
"type": "string",
"description": "One section name, as the outline reports it."
},
"description": "Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget."
},
"advisoryId": {
"type": "string",
"pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
"description": "Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized."
},
"productIds": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"description": "Exact case-sensitive CSAF product ID; surrounding whitespace is trimmed."
},
"description": "Narrow products to these IDs from vulnerability status, score, remediation, flag, or threat references. Alone selects products; combined with cves selects both sections. Explicit sections must include products."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"found"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"kind": {
"enum": [
"full",
"outline"
],
"type": "string",
"description": "full when the document is returned; outline when only the section listing is."
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"product_ids_need_products_section",
"unknown_product_id",
"mirror_busy",
"mirror_not_ready",
"mirror_unavailable",
"unknown_section",
"cves_need_vulnerabilities_section",
"unknown_cve"
],
"description": "Machine-readable failure mode. Declared by this tool: `product_ids_need_products_section`: productIds is nonempty but explicit sections omits products. `unknown_product_id`: productIds names an ID with no definition in this advisory. `mirror_busy`: A transient SQLite lock prevents the advisory index from opening. `mirror_not_ready`: The advisory index has never completed a full sync. `mirror_unavailable`: The advisory index store cannot be opened: its location is not writable, is read-only, runs through a missing directory or a file, or holds a file that is not a SQLite database. `unknown_section`: A requested section is one this advisory does not carry. `cves_need_vulnerabilities_section`: cves is set but sections does not include \"vulnerabilities\", so there is nothing for cves to narrow. `unknown_cve`: A cves entry names a CVE this advisory does not cover. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"found": {
"type": "boolean",
"description": "Whether an advisory with that ID is in the index."
},
"summary": {
"type": "object",
"required": [
"sectors"
],
"properties": {
"sectors": {
"type": "array",
"items": {
"type": "string",
"description": "One canonical sector name."
},
"description": "Normalized sector names. Empty when the advisory carries no sector note."
},
"sectorsRaw": {
"type": "string",
"description": "The sector note verbatim, when present."
},
"summaryText": {
"type": "string",
"description": "The advisory summary or overview note."
},
"headquarters": {
"type": "string",
"description": "The company-headquarters-location note."
},
"exploitability": {
"type": "string",
"description": "The exploitability note, when present."
},
"riskEvaluation": {
"type": "string",
"description": "The risk-evaluation note, when present."
},
"countriesDeployed": {
"type": "string",
"description": "The countries/areas-deployed note."
}
},
"description": "Narrative notes and sector classification.",
"additionalProperties": false
},
"advisory": {
"type": "object",
"required": [
"advisoryId",
"title",
"series",
"status",
"csafVersion",
"published",
"revised",
"revision",
"publisherCategory",
"publisherName",
"url",
"csafUrl",
"attribution"
],
"properties": {
"url": {
"type": "string",
"description": "Absolute URL of the cisa.gov web version of the advisory."
},
"title": {
"type": "string",
"description": "The advisory title."
},
"series": {
"enum": [
"ICSA",
"ICSMA"
],
"type": "string",
"description": "Advisory series."
},
"status": {
"type": "string",
"description": "CSAF tracking status, e.g. final or interim."
},
"csafUrl": {
"type": "string",
"description": "Absolute URL of the raw CSAF JSON document."
},
"revised": {
"type": "string",
"description": "Current release date, ISO 8601."
},
"revision": {
"type": "string",
"description": "Document revision number."
},
"published": {
"type": "string",
"description": "Initial release date, ISO 8601."
},
"advisoryId": {
"type": "string",
"pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
"description": "The advisory identifier."
},
"attribution": {
"type": "string",
"description": "Who authored the text and under what terms it may be redistributed."
},
"csafVersion": {
"type": "string",
"description": "CSAF schema version the document declares."
},
"publisherName": {
"type": "string",
"description": "Publisher name as the document records it."
},
"publisherCategory": {
"type": "string",
"description": "coordinator for CISA-authored, other for a republished vendor advisory."
}
},
"description": "Advisory identity, dates, and attribution. Always kept, including on a section selection.",
"additionalProperties": false
},
"guidance": {
"type": "string",
"description": "What to do instead, present when found is false: how current the index is, and whether the advisory may be newer than it."
},
"products": {
"type": "object",
"required": [
"vendorCount",
"productCount",
"vendors",
"shownProducts"
],
"properties": {
"vendors": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"products"
],
"properties": {
"name": {
"type": "string",
"description": "Vendor label as the advisory spells it."
},
"products": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"versions"
],
"properties": {
"name": {
"type": "string",
"description": "Product name."
},
"family": {
"type": "string",
"description": "Product family, when the tree names one."
},
"versions": {
"type": "array",
"items": {
"type": "object",
"required": [
"kind",
"value",
"productId"
],
"properties": {
"kind": {
"type": "string",
"description": "CSAF branch category, or full_product_name or relationship for definitions outside branches."
},
"name": {
"type": "string",
"description": "Exact full product name supplied upstream."
},
"value": {
"type": "string",
"description": "Version/range expression for a branch row, or full name for a standalone or relationship definition."
},
"productId": {
"type": "string",
"description": "Exact opaque CSAF product ID referenced by vulnerability entries; case-sensitive and not restricted to CSAFPID tokens."
},
"productReference": {
"type": "string",
"description": "First relationship component ID; not automatically expanded."
},
"identificationHelper": {
"type": "string",
"description": "Lossless JSON text of upstream CSAF product identification metadata, when supplied."
},
"relationshipCategory": {
"type": "string",
"description": "CSAF relationship category supplied upstream."
},
"relatesToProductReference": {
"type": "string",
"description": "Second relationship component ID; not automatically expanded."
}
},
"description": "One branch, standalone, or relationship product definition.",
"additionalProperties": false
},
"description": "Product definitions grouped under this product label."
}
},
"description": "One product under the vendor.",
"additionalProperties": false
},
"description": "Products under this vendor."
}
},
"description": "One vendor and its products.",
"additionalProperties": false
},
"description": "Vendors flattened out of the CSAF product tree."
},
"selected": {
"type": "boolean",
"description": "True when productIds selects only requested definitions; whole-document totals are retained."
},
"truncated": {
"type": "boolean",
"description": "True only on a copy stored by an older index build that capped product rows; the index re-ingests on its next start and then returns every row. Absent otherwise."
},
"vendorCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Distinct vendors in the product tree."
},
"productCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Flattened product entries in the whole product tree."
},
"shownProducts": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Product definitions returned — equal to productCount except under productIds selection or on a legacy truncated copy."
}
},
"description": "Affected products and version ranges.",
"additionalProperties": false
},
"sections": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"bytes"
],
"properties": {
"cves": {
"type": "array",
"items": {
"type": "string",
"description": "One CVE identifier."
},
"description": "On the vulnerabilities section only: the CVE IDs it holds, in document order. Pass any of them in cves to cisa_get_advisory to read just those entries."
},
"name": {
"type": "string",
"description": "Section identifier — pass in `sections` to retrieve it"
},
"bytes": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": 0,
"description": "Serialized byte size of the section"
}
},
"description": "One section this advisory carries, with its serialized byte size.",
"additionalProperties": false
},
"description": "Outline arm — the sections available, largest first, with their byte sizes and, for vulnerabilities, its CVE IDs."
},
"references": {
"type": "array",
"items": {
"type": "object",
"required": [
"category",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "The reference URL."
},
"summary": {
"type": "string",
"description": "Reference summary, when present."
},
"category": {
"type": "string",
"description": "CSAF reference category, e.g. self or external."
}
},
"description": "One document-level reference.",
"additionalProperties": false
},
"description": "Document-level references."
},
"outlineNotice": {
"type": "string",
"description": "Outline arm — how to call cisa_get_advisory for specific sections."
},
"acknowledgments": {
"type": "array",
"items": {
"type": "object",
"required": [
"names"
],
"properties": {
"names": {
"type": "array",
"items": {
"type": "string",
"description": "One acknowledged person."
},
"description": "Acknowledged people."
},
"summary": {
"type": "string",
"description": "What the acknowledgment records."
},
"organization": {
"type": "string",
"description": "Acknowledged organization, when named."
}
},
"description": "One acknowledgment entry.",
"additionalProperties": false
},
"description": "Acknowledgment entries."
},
"indexCheckpoint": {
"type": [
"string",
"null"
],
"description": "Present when found is false: the newest revision timestamp the index holds, or null if none."
},
"revisionHistory": {
"type": "array",
"items": {
"type": "object",
"required": [
"number",
"date",
"summary"
],
"properties": {
"date": {
"type": "string",
"description": "Revision date, ISO 8601."
},
"number": {
"type": "string",
"description": "Revision number."
},
"summary": {
"type": "string",
"description": "What changed in this revision."
},
"legacyVersion": {
"type": "string",
"description": "Legacy version label, when the entry carries one."
}
},
"description": "One revision-history entry.",
"additionalProperties": false
},
"description": "Revision history, oldest first as published."
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"scores",
"remediations",
"productStatus",
"notes"
],
"properties": {
"cve": {
"type": "string",
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
"description": "The CVE identifier."
},
"cweId": {
"type": "string",
"description": "CWE identifier, when the entry carries one."
},
"flags": {
"type": "array",
"items": {
"type": "object",
"required": [
"label",
"productIds"
],
"properties": {
"label": {
"type": "string",
"description": "CSAF flag label, verbatim."
},
"groupIds": {
"type": "array",
"items": {
"type": "string",
"description": "One verbatim group reference."
},
"description": "Upstream group references, including unresolved groups."
},
"productIds": {
"type": "array",
"items": {
"type": "string",
"description": "One exact product ID."
},
"description": "Direct product IDs and resolved group members."
}
},
"description": "One scoped vulnerability flag.",
"additionalProperties": false
},
"description": "Vulnerability flags; absent on rows awaiting re-ingest."
},
"notes": {
"type": "array",
"items": {
"type": "object",
"required": [
"category",
"text"
],
"properties": {
"text": {
"type": "string",
"description": "Note text, verbatim."
},
"title": {
"type": "string",
"description": "Note title, when present."
},
"category": {
"type": "string",
"description": "CSAF note category."
}
},
"description": "One note attached to the vulnerability.",
"additionalProperties": false
},
"description": "Notes attached to the vulnerability. CVSS v4 appears here as prose — it is never parsed into a score field."
},
"title": {
"type": "string",
"description": "Vulnerability title, when the entry carries one."
},
"scores": {
"type": "array",
"items": {
"type": "object",
"required": [
"version",
"baseScore",
"baseSeverity",
"severityDerived",
"vectorString",
"productIds"
],
"properties": {
"version": {
"type": "string",
"description": "CVSS version of this score."
},
"baseScore": {
"type": "number",
"description": "CVSS base score, 0.0 through 10.0."
},
"productIds": {
"type": "array",
"items": {
"type": "string",
"description": "One CSAFPID token."
},
"description": "Products this score applies to."
},
"baseSeverity": {
"type": "string",
"description": "Severity band for the score."
},
"vectorString": {
"type": "string",
"description": "The full CVSS vector string."
},
"severityDerived": {
"type": "boolean",
"description": "True when the band was derived here rather than published upstream."
}
},
"description": "One CVSS score.",
"additionalProperties": false
},
"description": "CVSS scores. Empty on the 431 vulnerability objects that carry none."
},
"cweName": {
"type": "string",
"description": "CWE name, when the entry carries one."
},
"threats": {
"type": "array",
"items": {
"type": "object",
"required": [
"category",
"details",
"productIds"
],
"properties": {
"details": {
"type": "string",
"description": "Threat details, verbatim."
},
"category": {
"type": "string",
"description": "CSAF threat category, verbatim."
},
"groupIds": {
"type": "array",
"items": {
"type": "string",
"description": "One verbatim group reference."
},
"description": "Upstream group references, including unresolved groups."
},
"productIds": {
"type": "array",
"items": {
"type": "string",
"description": "One exact product ID."
},
"description": "Direct product IDs and resolved group members."
}
},
"description": "One scoped vulnerability threat.",
"additionalProperties": false
},
"description": "Vulnerability threats; absent on rows awaiting re-ingest."
},
"remediations": {
"type": "array",
"items": {
"type": "object",
"required": [
"category",
"details",
"productIds"
],
"properties": {
"url": {
"type": "string",
"description": "Vendor link for the remediation, when present."
},
"details": {
"type": "string",
"description": "The remediation instructions, verbatim."
},
"category": {
"type": "string",
"description": "CSAF remediation category: mitigation, vendor_fix, workaround, none_available, or no_fix_planned."
},
"groupIds": {
"type": "array",
"items": {
"type": "string",
"description": "One verbatim CSAF group reference."
},
"description": "Upstream group references, including unresolved groups."
},
"productIds": {
"type": "array",
"items": {
"type": "string",
"description": "One CSAFPID token."
},
"description": "Products this remediation applies to."
},
"restartRequired": {
"type": "string",
"description": "Restart category the remediation requires, when stated."
}
},
"description": "One remediation entry.",
"additionalProperties": false
},
"description": "Remediations for this vulnerability."
},
"productStatus": {
"type": "object",
"required": [
"known_affected",
"fixed",
"known_not_affected",
"recommended"
],
"properties": {
"fixed": {
"type": "array",
"items": {
"type": "string",
"description": "One CSAFPID token."
},
"description": "Products already fixed."
},
"recommended": {
"type": "array",
"items": {
"type": "string",
"description": "One CSAFPID token."
},
"description": "Products recommended by the publisher."
},
"known_affected": {
"type": "array",
"items": {
"type": "string",
"description": "One CSAFPID token."
},
"description": "Products known to be affected."
},
"known_not_affected": {
"type": "array",
"items": {
"type": "string",
"description": "One CSAFPID token."
},
"description": "Products known not to be affected."
}
},
"description": "Per-product status buckets, as CSAF names them.",
"additionalProperties": false
}
},
"description": "One vulnerability the advisory covers.",
"additionalProperties": false
},
"description": "Vulnerabilities the advisory covers, with scores, remediations, and product status."
},
"indexLastSyncedAt": {
"type": [
"string",
"null"
],
"description": "Present when found is false: when the index last completed a sync, ISO 8601, or null if never."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}cisa_get_alerts — cisa_get_alerts
List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Cursors continue within the current 30-item rolling window; upstream provides no pagination, history, or date-range query. The window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"feed": {
"enum": [
"advisories",
"alerts",
"ics"
],
"type": "string",
"default": "advisories",
"description": "Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks)."
},
"limit": {
"type": "integer",
"default": 30,
"maximum": 1000,
"minimum": 1,
"description": "Maximum items to return; values above 30 use 30 when input clamping is enabled. The upstream window contains at most 30 items."
},
"since": {
"type": "string",
"format": "date",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
"description": "Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it."
},
"cursor": {
"type": "string",
"description": "Opaque continuation cursor from this feed. Resumes after the last returned GUID within the available window; omit to restart."
}
},
"additionalProperties": false
}{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"hasMore",
"stale",
"fetchedAt",
"feed",
"feedUrl",
"feedTitle",
"items",
"window",
"windowCaveat"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"cap": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "The limit that was applied."
},
"feed": {
"enum": [
"advisories",
"alerts",
"ics"
],
"type": "string",
"description": "The feed that was read."
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"read_limit_exceeded",
"invalid_cursor",
"feed_unavailable"
],
"description": "Machine-readable failure mode. Declared by this tool: `read_limit_exceeded`: limit exceeds the per-call cap and input clamping is disabled. `invalid_cursor`: The cursor is malformed or belongs to a different feed. `feed_unavailable`: The feed fetch failed or returned a body that carried no RSS channel. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"items": {
"type": "array",
"items": {
"type": "object",
"required": [
"title",
"link",
"pubDate",
"summary",
"summaryTruncated",
"guid"
],
"properties": {
"guid": {
"type": "string",
"description": "The upstream guid — a node path such as /node/25513, not a URL and not a permalink."
},
"link": {
"type": "string",
"description": "Absolute URL of the canonical page for the item."
},
"title": {
"type": "string",
"description": "Item title, trimmed — upstream carries trailing whitespace."
},
"pubDate": {
"type": "string",
"description": "Publication timestamp, ISO 8601. Upstream publishes RFC 822 with a two-digit year."
},
"summary": {
"type": "string",
"description": "Item description with HTML stripped and entities decoded, capped at 1,200 characters."
},
"advisoryId": {
"type": "string",
"pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
"description": "Present for ICS advisory items; chains straight into cisa_get_advisory."
},
"summaryTruncated": {
"type": "boolean",
"description": "True when the summary was capped."
}
},
"description": "One feed item.",
"additionalProperties": false
},
"description": "Items from the fetched window, newest first as published; stale identifies cached fallback."
},
"shown": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Items returned."
},
"stale": {
"type": "boolean",
"description": "True when refresh failed and this response uses the last cached window."
},
"cursor": {
"type": "string",
"description": "Continuation cursor for this feed; absent on the last page or when the anchor is unavailable."
},
"notice": {
"type": "string",
"description": "Safe retry guidance on refresh failure, or guidance when the since filter excluded every item."
},
"window": {
"type": "object",
"required": [
"itemCount",
"oldest",
"newest",
"upstreamWindowSize"
],
"properties": {
"newest": {
"type": [
"string",
"null"
],
"description": "Publication date of the newest item in the fetched window; null when empty."
},
"oldest": {
"type": [
"string",
"null"
],
"description": "Publication date of the oldest item in the fetched window; null when empty."
},
"itemCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Items returned after limit and since were applied."
},
"upstreamWindowSize": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Items the upstream feed serves — a fixed ceiling, not a server choice."
}
},
"description": "What the fetched window covers.",
"additionalProperties": false
},
"feedUrl": {
"type": "string",
"description": "The absolute feed URL this window came from."
},
"hasMore": {
"type": "boolean",
"description": "Whether more matching items remain after this page within the available window."
},
"feedTitle": {
"type": "string",
"description": "The channel title the feed declares."
},
"fetchedAt": {
"type": "string",
"description": "UTC timestamp when this window was successfully fetched."
},
"truncated": {
"type": "boolean",
"description": "True when the limit capped the returned items."
},
"windowCaveat": {
"type": "string",
"description": "Limits of continuation within the upstream rolling window."
},
"effectiveQuery": {
"type": "string",
"description": "The since filter as applied, and how many window items it excluded."
}
},
"additionalProperties": false
}{
"readOnlyHint": true,
"idempotentHint": true
}Prompts
0 advertised
Resources
61 advertised
CVE-2026-19868 — SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-19868CVE-2024-27834 — Apple Multiple Products Improper Authentication Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2024-27834CVE-2026-119977 — WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-119977CVE-2026-118527 — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-118527CVE-2026-111357 — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-111357CVE-2026-97229 — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-97229CVE-2026-76418 — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-76418CVE-2026-46300 — Linux Kernel Missing Initialization of a Variable Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-46300CVE-2026-41709 — Broadcom VMWare ESX Insufficient Logging Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-41709CVE-2026-48356 — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-48356CVE-2026-111497 — Google Brotli Unchecked Return Value Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-111497CVE-2026-109619 — PHP Stale Internal Request-State Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-109619CVE-2026-109618 — PHP Memory Corruption Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-109618CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-114625CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-110447CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-96656CVE-2026-96655 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-96655CVE-2026-96654 — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-96654CVE-2026-96652 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-96652CVE-2026-110936 — Siemens Software Center Uncontrolled Search Path Element Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-110936CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-106931CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-102764CVE-2025-61624 — Fortinet Multiple Products Path Traversal Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2025-61624CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-21589CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-76519CVE-2026-105134 — Ahsay AhsayCBS Command Injection Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-105134CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-105133CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-0322CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-96951CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/CVE-2026-104935ICSA-26-211-07 — Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update B) — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-211-07ICSA-26-307-01 — Subnet Solutions PowerSYSTEM Center — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-307-01ICSA-26-302-01 — Siemens Mendix SAML Module — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-302-01ICSA-26-302-02 — Hitachi Energy TRO600 series products — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-302-02ICSA-26-302-03 — Hitachi Energy CoreTec Product — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-302-03ICSA-26-258-06 — Siemens Mendix SAML — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-258-06ICSA-26-125-01 — Hitachi Energy PCM600 (Update A) — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-125-01ICSA-25-275-02 — Hitachi Energy MSM Product (Update A) — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-25-275-02ICSA-26-300-01 — EPICS Base — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-300-01ICSA-26-300-02 — Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-300-02ICSA-26-267-02 — Eufy Omni C20, Omni X10 Pro (Update A) — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-267-02ICSA-26-295-01 — Kiloview E3 NDI Encoder — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-01ICSA-26-295-02 — Siemens Industrial Edge App Publisher — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-02ICSA-26-295-03 — Siemens Software Center — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-03ICSA-26-295-04 — Siemens Capital Embedded AR Classic — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-04ICSA-26-295-05 — Siemens SENTRON 3NA COM Fuse — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-05ICSA-26-295-06 — Siemens PSS(R)SINCAL — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-06ICSA-26-295-07 — Siemens SIMATIC IPCs — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-07ICSA-26-295-08 — Siemens APOGEE, TALON and Desigo PXC/PXM Products — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-08ICSA-26-295-09 — Siemens Industrial Edge Device Kit — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-09ICSA-26-295-10 — Siemens SIMATIC S7 Webserver API — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-10ICSA-26-295-11 — Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-11ICSA-26-295-12 — Siemens RUGGEDCOM CROSSBOW — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-12ICSA-26-295-13 — Siemens WinCC — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-13ICSA-26-295-14 — Siemens SIMATIC S7 PLCs Web Server — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-14ICSA-26-295-15 — Siemens RUGGEDCOM CROSSBOW Station Access Controller — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-15ICSA-26-295-16 — Siemens SIMATIC S7-1500 TM MFP — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-16ICSA-26-295-17 — Siemens Industrial Edge Devices — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-17ICSA-26-295-18 — Siemens RUGGEDCOM APE1808 Devices — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSA-26-295-18ICSMA-26-295-01 — InterSystems Corporation InterSystems IRIS for Health — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/ICSMA-26-295-01cisa-cybersecurity-guide
Use cisa_* tools to triage vulnerability lists and trace ICS advisory applicability from CVEs through product definitions, relationships, and scoped remediations. Use for CISA evidence, KEV deadlines, SSVC timelines, affected versions, and recent advisory monitoring when incomplete coverage could change the conclusion.
skill://cisa-cybersecurity-guide/SKILL.mdkev-entry — KEV catalog entry
One entry from the CISA Known Exploited Vulnerabilities catalog, addressed by CVE ID — the same record shape cisa_check_cve_status returns, including the federal remediation deadline, the directive cited, ransomware and forensic-triage flags, and the references parsed from the entry notes. Listing returns the 30 most recently added entries.
cisa://kev/{cveId}ics-advisory — ICS advisory (CSAF)
One CISA industrial control system advisory, flattened from CSAF 2.0 — affected products with version ranges, per-CVE CVSS and CWE, remediations, sectors, and revision history. Large advisories return a section outline instead of the whole document; follow up with cisa_get_advisory to request named sections. Listing returns the 30 most recently revised advisories.
cisa://advisory/{advisoryId}io.modelcontextprotocol/skills
skill://{+path}90-day uptime
A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.
- 2026-11-07: 1 of 1 checks answered
- 2026-11-09: 1 of 1 checks answered
30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 737 ms
- 95th percentile latency
- 737 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 737 ms · metadata changed · 7 tool(s), 61 resource(s), 3 resource template(s), 0 prompt(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
claude mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcpCodex
codex mcp add cisa-cybersecurity-mcp-server --url https://cisa-cybersecurity.caseyjhand.com/mcpCursor
{
"mcpServers": {
"cisa-cybersecurity-mcp-server": {
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
}
}Cline
{
"mcpServers": {
"cisa-cybersecurity-mcp-server": {
"type": "streamableHttp",
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp",
"disabled": false
}
}
}VS Code
{
"servers": {
"cisa-cybersecurity-mcp-server": {
"type": "http",
"url": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
}
}Gemini CLI
gemini mcp add --transport http cisa-cybersecurity-mcp-server https://cisa-cybersecurity.caseyjhand.com/mcpClaude Desktop
https://cisa-cybersecurity.caseyjhand.com/mcpWindsurf
{
"mcpServers": {
"cisa-cybersecurity-mcp-server": {
"serverUrl": "https://cisa-cybersecurity.caseyjhand.com/mcp"
}
}
}Let your agent find its tools
Find servers like cisa-cybersecurity-mcp-server from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.