first-epss-mcp-server
An MCP server that retrieves FIRST EPSS exploitation scores and daily history for CVEs, allows querying by score thresholds, and enables prioritization using caller-supplied CVSS data. It supports STDIO and Streamable HTTP transports and provides tools for fetching scores, timeseries data, and reference information.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
MCP endpoint (Streamable HTTP)
https://first-epss.caseyjhand.com/mcpWhat you can do with it
- Retrieve latest or historical FIRST EPSS probability and percentile for specific CVEs
- Inspect daily EPSS history and score movement for up to 50 unique CVEs
- Discover CVEs using inclusive EPSS or percentile bounds and year filters
- Prioritize CVEs by combining EPSS scores with caller-supplied CVSS severity
Source and maintenance
Community listingRegistry 0.2.0
- Maintenance checked
Protocol and capabilities
- Server
- first-epss-mcp-server 0.2.0
- MCP protocol
- 2025-06-18
- Tools
- 5 advertised
- Resources
- 1 advertised
- Resource templates
- 1 advertised
- Prompts
- 0 advertised
Server-advertised capabilities
{
"tools": {
"listChanged": true
},
"logging": {},
"prompts": {
"listChanged": true
},
"resources": {
"subscribe": true,
"listChanged": true
},
"extensions": {
"io.modelcontextprotocol/skills": {
"directoryRead": true
}
}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
5 advertised
epss_get_scores — Epss Get Scores
Advertised read-onlyOpen-world
Retrieve latest available or historically dated FIRST EPSS probability and percentile for supplied CVEs. Process up to 500 unique entries from batchOffset; response byte limits can return fewer whole entries. Resume with nextBatchOffset as batchOffset, the original cves and returned score date as date. deferredCves were not queried; withheldCves were processed but omitted, and either list can be a declared preview. Missing scores remain unknown; use epss_list_reference for coverage and interpretation.
epss_get_scores input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cves"
],
"properties": {
"cves": {
"type": "array",
"items": {
"type": "string",
"maxLength": 128,
"minLength": 1,
"description": "Complete CVE-YYYY-NNNN identifier; whitespace, case and Unicode dashes are normalized."
},
"maxItems": 5000,
"minItems": 1,
"description": "One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted."
},
"date": {
"type": "string",
"pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
"description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
},
"batchOffset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs."
}
},
"additionalProperties": false
}epss_get_scores output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"scores",
"unscoredCves",
"deferredCves",
"requestedCount",
"processedCount",
"duplicateCount",
"provenance"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"snapshot_unavailable",
"upstream_shape"
],
"description": "Machine-readable failure mode. Declared by this tool: `snapshot_unavailable`: FIRST identifies the requested dated snapshot as unavailable. `upstream_shape`: The upstream envelope, score data, batch completeness or snapshot consistency is invalid. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"notice": {
"type": "string",
"description": "Missing-data, deferred-work or model-metadata caveats."
},
"scores": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Daily exploitation forecast and model attribution.",
"additionalProperties": false
},
"description": "Forecasts ordered by EPSS descending then CVE."
},
"provenance": {
"type": "object",
"required": [
"source",
"apiUrl",
"retrievedAt",
"scoreDates",
"modelMetadata"
],
"properties": {
"apiUrl": {
"type": "string",
"description": "FIRST lookup endpoint."
},
"source": {
"type": "string",
"const": "FIRST EPSS",
"description": "Score publisher."
},
"scoreDates": {
"type": "array",
"items": {
"type": "string",
"description": "Observed snapshot date."
},
"description": "Returned anchor or candidate score dates."
},
"retrievedAt": {
"type": "string",
"description": "UTC retrieval timestamp."
},
"modelMetadata": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"enum": [
"verified",
"inferred",
"unavailable"
],
"type": "string",
"description": "verified: matching metadata; inferred: published schedule; unavailable: unknown."
},
"scoreDate": {
"type": "string",
"description": "Snapshot attributed by metadata."
},
"sourceUrl": {
"type": "string",
"description": "Model metadata source."
},
"explanation": {
"type": "string",
"description": "Attribution limitations and inference basis."
},
"modelVersion": {
"type": "string",
"description": "Attributed model version."
}
},
"description": "Snapshot model attribution.",
"additionalProperties": false
},
"requestedDate": {
"type": "string",
"description": "Explicit requested historical date."
}
},
"description": "Source and model attribution.",
"additionalProperties": false
},
"batchOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Starting offset in the original normalized unique input."
},
"deferredCves": {
"type": "array",
"items": {
"type": "string",
"description": "Identifier not queried."
},
"description": "Never-queried identifiers beyond this call workload cap; complete unless deferredCvesComplete is false. Resume using nextBatchOffset and the original submission."
},
"unscoredCves": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"reason",
"guidance"
],
"properties": {
"cve": {
"type": "string",
"description": "Submitted normalized identifier."
},
"reason": {
"enum": [
"invalid_format",
"not_returned"
],
"type": "string",
"description": "Invalid identifier or upstream omission; neither implies zero risk."
},
"guidance": {
"type": "string",
"description": "Next step for missing scores."
}
},
"description": "Identifier with an explicitly unknown forecast.",
"additionalProperties": false
},
"description": "Retained processed identifiers without scores, in request order."
},
"withheldCves": {
"type": "array",
"items": {
"type": "string",
"description": "Already processed identifier withheld from this response."
},
"description": "Already processed identifiers withheld by the byte budget, in original input order; may be a preview."
},
"budgetLimited": {
"type": "boolean",
"description": "True when whole entries or accounting lists were shortened to fit the serialized response budget."
},
"deferredCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Identifiers beyond this call workload cap, not queried."
},
"returnedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Processed identifiers whose complete score, history or unscored entry is included."
},
"withheldCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Processed identifiers withheld by the response byte budget; queried valid entries are included in processedCount."
},
"duplicateCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Duplicate submitted entries removed."
},
"processedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Unique identifiers processed, including invalid formats."
},
"requestedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Unique normalized identifiers submitted."
},
"nextBatchOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Resume with this batchOffset and the original cves, returned date and original severity/policy inputs."
},
"deferredCvesComplete": {
"type": "boolean",
"description": "True when deferredCves includes every never-queried deferred identifier."
},
"withheldCvesComplete": {
"type": "boolean",
"description": "True when withheldCves includes every withheld identifier."
}
},
"additionalProperties": false
}epss_get_scores annotations
{
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true
}epss_get_timeseries — Epss Get Timeseries
Advertised read-onlyOpen-world
Retrieve an EPSS anchor and up to 30 preceding daily observations for up to 50 unique CVEs from batchOffset. Response byte limits retain whole history items. Resume CVE batches with nextBatchOffset as batchOffset, the original cves and returned score date as date; withheldCves were processed, deferredCves were not queried, and lists can be declared previews. Exact 7-day and 30-day deltas require their calendar baselines; gaps remain unknown. Model boundaries do not explain score movement. Re-anchor using previousAnchorDate for the preceding history window; that snapshot may be unavailable.
epss_get_timeseries input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cves"
],
"properties": {
"cves": {
"type": "array",
"items": {
"type": "string",
"maxLength": 128,
"minLength": 1,
"description": "Complete CVE-YYYY-NNNN identifier; whitespace, case and Unicode dashes are normalized."
},
"maxItems": 5000,
"minItems": 1,
"description": "One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted."
},
"date": {
"type": "string",
"pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
"description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
},
"batchOffset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs."
}
},
"additionalProperties": false
}epss_get_timeseries output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"items",
"unscoredCves",
"deferredCves",
"requestedCount",
"processedCount",
"duplicateCount",
"provenance"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"snapshot_unavailable",
"upstream_shape"
],
"description": "Machine-readable failure mode. Declared by this tool: `snapshot_unavailable`: FIRST identifies the requested dated snapshot as unavailable. `upstream_shape`: The envelope, snapshots or history dates contain invalid or contradictory data. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"items": {
"type": "array",
"items": {
"type": "object",
"required": [
"current",
"series",
"requestedWindow",
"missingDates",
"unavailableDeltas",
"deltaComparisons",
"peak",
"modelBoundariesCrossed",
"modelBoundaryCoverageThrough"
],
"properties": {
"peak": {
"type": "object",
"required": [
"epss",
"dates"
],
"properties": {
"epss": {
"type": "number",
"description": "0–1 peak EPSS across anchor and observations."
},
"dates": {
"type": "array",
"items": {
"type": "string",
"description": "Date tied for peak EPSS."
},
"description": "All tied peak dates, ascending."
}
},
"description": "Observed peak without inferring missing dates.",
"additionalProperties": false
},
"series": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Daily exploitation forecast and model attribution.",
"additionalProperties": false
},
"description": "Available preceding observations in ascending date order; excludes anchor."
},
"current": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Anchor score, separate from preceding history.",
"additionalProperties": false
},
"delta7d": {
"type": "number",
"description": "Anchor EPSS minus exact seven-day baseline, in probability units."
},
"delta30d": {
"type": "number",
"description": "Anchor EPSS minus exact thirty-day baseline, in probability units."
},
"missingDates": {
"type": "array",
"items": {
"type": "string",
"description": "Missing expected calendar date."
},
"description": "Every gap in the requested preceding window."
},
"observedWindow": {
"type": "object",
"required": [
"startDate",
"endDate",
"observationCount"
],
"properties": {
"endDate": {
"type": "string",
"description": "Last calendar date in the window."
},
"startDate": {
"type": "string",
"description": "First calendar date in the window."
},
"observationCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Number of available preceding observations."
}
},
"description": "Extent and count of preceding data; absent when no observations exist.",
"additionalProperties": false
},
"requestedWindow": {
"type": "object",
"required": [
"startDate",
"endDate"
],
"properties": {
"endDate": {
"type": "string",
"description": "Last calendar date in the window."
},
"startDate": {
"type": "string",
"description": "First calendar date in the window."
}
},
"description": "Anchor minus 30 through anchor minus one calendar day.",
"additionalProperties": false
},
"deltaComparisons": {
"type": "array",
"items": {
"type": "object",
"required": [
"days",
"baselineDate",
"endpointDate",
"crossesModelBoundary"
],
"properties": {
"days": {
"type": "number",
"description": "Comparison day distance."
},
"baselineDate": {
"type": "string",
"description": "Exact baseline date."
},
"endpointDate": {
"type": "string",
"description": "Anchor endpoint date."
},
"crossesModelBoundary": {
"type": "boolean",
"description": "A documented model transition falls after baseline through endpoint."
}
},
"description": "One exact-date comparison.",
"additionalProperties": false
},
"description": "Available exact-date comparison provenance."
},
"unavailableDeltas": {
"type": "array",
"items": {
"type": "number",
"description": "Unavailable baseline day distance, 7 or 30."
},
"description": "Comparisons without exact-date baselines."
},
"previousAnchorDate": {
"type": "string",
"description": "Anchor minus 31 days for the preceding window; absent before 2021-04-14. Snapshot availability is not guaranteed."
},
"modelBoundariesCrossed": {
"type": "array",
"items": {
"type": "object",
"required": [
"date",
"fromModel",
"toModel"
],
"properties": {
"date": {
"type": "string",
"description": "Model publishing transition date."
},
"toModel": {
"type": "string",
"description": "New model label."
},
"fromModel": {
"type": "string",
"description": "Preceding model label."
}
},
"description": "Documented model publishing transition.",
"additionalProperties": false
},
"description": "Transitions strictly after earliest observed date through anchor."
},
"modelBoundaryCoverageThrough": {
"type": "string",
"description": "Last date the model schedule was verified."
}
},
"description": "One anchor and its derived history.",
"additionalProperties": false
},
"description": "Derived trajectories ordered by anchor EPSS descending then CVE."
},
"notice": {
"type": "string",
"description": "Missing-data, deferred-work or model-metadata caveats."
},
"provenance": {
"type": "object",
"required": [
"source",
"apiUrl",
"retrievedAt",
"scoreDates",
"modelMetadata"
],
"properties": {
"apiUrl": {
"type": "string",
"description": "FIRST lookup endpoint."
},
"source": {
"type": "string",
"const": "FIRST EPSS",
"description": "Score publisher."
},
"scoreDates": {
"type": "array",
"items": {
"type": "string",
"description": "Observed snapshot date."
},
"description": "Returned anchor or candidate score dates."
},
"retrievedAt": {
"type": "string",
"description": "UTC retrieval timestamp."
},
"modelMetadata": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"enum": [
"verified",
"inferred",
"unavailable"
],
"type": "string",
"description": "verified: matching metadata; inferred: published schedule; unavailable: unknown."
},
"scoreDate": {
"type": "string",
"description": "Snapshot attributed by metadata."
},
"sourceUrl": {
"type": "string",
"description": "Model metadata source."
},
"explanation": {
"type": "string",
"description": "Attribution limitations and inference basis."
},
"modelVersion": {
"type": "string",
"description": "Attributed model version."
}
},
"description": "Snapshot model attribution.",
"additionalProperties": false
},
"requestedDate": {
"type": "string",
"description": "Explicit requested historical date."
}
},
"description": "Source and model attribution.",
"additionalProperties": false
},
"batchOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Starting offset in the original normalized unique input."
},
"deferredCves": {
"type": "array",
"items": {
"type": "string",
"description": "Identifier not queried."
},
"description": "Never-queried identifiers beyond this call workload cap; complete unless deferredCvesComplete is false. Resume using nextBatchOffset and the original submission."
},
"unscoredCves": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"reason",
"guidance"
],
"properties": {
"cve": {
"type": "string",
"description": "Submitted normalized identifier."
},
"reason": {
"enum": [
"invalid_format",
"not_returned"
],
"type": "string",
"description": "Invalid identifier or upstream omission; neither implies zero risk."
},
"guidance": {
"type": "string",
"description": "Next step for missing scores."
}
},
"description": "Identifier with an explicitly unknown forecast.",
"additionalProperties": false
},
"description": "Retained processed identifiers without scores, in request order."
},
"withheldCves": {
"type": "array",
"items": {
"type": "string",
"description": "Already processed identifier withheld from this response."
},
"description": "Already processed identifiers withheld by the byte budget, in original input order; may be a preview."
},
"budgetLimited": {
"type": "boolean",
"description": "True when whole entries or accounting lists were shortened to fit the serialized response budget."
},
"deferredCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Identifiers beyond this call workload cap, not queried."
},
"returnedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Processed identifiers whose complete score, history or unscored entry is included."
},
"withheldCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Processed identifiers withheld by the response byte budget; queried valid entries are included in processedCount."
},
"duplicateCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Duplicate submitted entries removed."
},
"processedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Unique identifiers processed, including invalid formats."
},
"requestedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Unique normalized identifiers submitted."
},
"nextBatchOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Resume with this batchOffset and the original cves, returned date and original severity/policy inputs."
},
"deferredCvesComplete": {
"type": "boolean",
"description": "True when deferredCves includes every never-queried deferred identifier."
},
"withheldCvesComplete": {
"type": "boolean",
"description": "True when withheldCves includes every withheld identifier."
}
},
"additionalProperties": false
}epss_get_timeseries annotations
{
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true
}epss_query_threshold — Epss Query Threshold
Advertised read-onlyOpen-world
Discover CVEs using inclusive EPSS or percentile bounds, CVE year or dataset-addition recency; filters intersect and at least one is required. Examine one candidate page in the upstream FIRST order, which is not ranked by EPSS, so the first page does not hold the highest scores. Each serialized response surface fits 65536 UTF-8 bytes; budgetLimited and withheldCount disclose whole matches withheld, with nextOffset at the first withheld match. Year filtering can return an empty page with nextOffset; candidateTotal is a broad-query total, not an exact-year total. Continue with the same filters, limit, returned score date and nextOffset.
epss_query_threshold input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"date": {
"type": "string",
"pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
"description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
},
"year": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": 1999,
"description": "Exact CVE year from 1999 through the current UTC year; candidate pages may contain no matches."
},
"limit": {
"type": "integer",
"default": 100,
"maximum": 9007199254740991,
"minimum": 1,
"description": "Requested candidates per page; positive safe integers above 10000 are clamped to 10000 before exact-year filtering."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Candidate-space offset; use returned nextOffset for continuation."
},
"maxEpss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive maximum EPSS probability."
},
"minEpss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive minimum EPSS probability."
},
"maxPercentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive maximum population percentile rank."
},
"minPercentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive minimum population percentile rank."
},
"addedWithinDays": {
"type": "integer",
"maximum": 100000,
"minimum": 1,
"description": "Dataset-addition recency relative to upstream present, independent of historical date."
}
},
"additionalProperties": false
}epss_query_threshold output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"scores",
"filters",
"pagination",
"provenance"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"invalid_filter_combination",
"upstream_shape",
"snapshot_unavailable"
],
"description": "Machine-readable failure mode. Declared by this tool: `invalid_filter_combination`: No qualifying filter is supplied or minimum exceeds maximum. `upstream_shape`: The candidate envelope, scores, snapshot or pagination are inconsistent. `snapshot_unavailable`: FIRST identifies the requested dated snapshot as unavailable. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"notice": {
"type": "string",
"description": "Missing-data, deferred-work or model-metadata caveats."
},
"scores": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Daily exploitation forecast and model attribution.",
"additionalProperties": false
},
"description": "Retained records from this candidate page."
},
"filters": {
"type": "object",
"properties": {
"date": {
"type": "string",
"pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
"description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
},
"year": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": 1999,
"description": "Exact CVE year from 1999 through the current UTC year; candidate pages may contain no matches."
},
"limit": {
"type": "number",
"description": "Applied candidate page limit."
},
"offset": {
"type": "number",
"description": "Applied candidate offset."
},
"maxEpss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive maximum EPSS probability."
},
"minEpss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive minimum EPSS probability."
},
"maxPercentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive maximum population percentile rank."
},
"minPercentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Inclusive minimum population percentile rank."
},
"addedWithinDays": {
"type": "integer",
"maximum": 100000,
"minimum": 1,
"description": "Dataset-addition recency relative to upstream present, independent of historical date."
}
},
"description": "Applied filters; combine with provenance scoreDates to pin continuation.",
"additionalProperties": false
},
"pagination": {
"type": "object",
"required": [
"offset",
"limit",
"examinedCount",
"returnedCount",
"candidateTotal",
"total",
"totalRelation",
"hasMore"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Candidate page limit."
},
"total": {
"anyOf": [
{
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991
},
{
"type": "null"
}
],
"description": "Exact total without a year filter; null with year."
},
"offset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Candidate offset examined."
},
"hasMore": {
"type": "boolean",
"description": "Withheld matches or more candidates exist; not a guarantee of more year matches."
},
"nextOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "First withheld match candidate position, or next candidate page when no matches were withheld."
},
"budgetLimited": {
"type": "boolean",
"description": "True when complete matches were withheld to fit the response byte budget."
},
"examinedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Candidates examined before year filtering."
},
"returnedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Whole records retained after filtering and response byte budgeting."
},
"totalRelation": {
"enum": [
"exact",
"unknown"
],
"type": "string",
"description": "Whether total is exact or unknown."
},
"withheldCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Matches inspected but withheld by the response byte budget; recovered with nextOffset."
},
"candidateTotal": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Exact broad-query candidate count."
}
},
"description": "Candidate pagination accounting.",
"additionalProperties": false
},
"provenance": {
"type": "object",
"required": [
"source",
"apiUrl",
"retrievedAt",
"scoreDates",
"modelMetadata"
],
"properties": {
"apiUrl": {
"type": "string",
"description": "FIRST lookup endpoint."
},
"source": {
"type": "string",
"const": "FIRST EPSS",
"description": "Score publisher."
},
"scoreDates": {
"type": "array",
"items": {
"type": "string",
"description": "Observed snapshot date."
},
"description": "Returned anchor or candidate score dates."
},
"retrievedAt": {
"type": "string",
"description": "UTC retrieval timestamp."
},
"modelMetadata": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"enum": [
"verified",
"inferred",
"unavailable"
],
"type": "string",
"description": "verified: matching metadata; inferred: published schedule; unavailable: unknown."
},
"scoreDate": {
"type": "string",
"description": "Snapshot attributed by metadata."
},
"sourceUrl": {
"type": "string",
"description": "Model metadata source."
},
"explanation": {
"type": "string",
"description": "Attribution limitations and inference basis."
},
"modelVersion": {
"type": "string",
"description": "Attributed model version."
}
},
"description": "Snapshot model attribution.",
"additionalProperties": false
},
"requestedDate": {
"type": "string",
"description": "Explicit requested historical date."
}
},
"description": "Snapshot source and model metadata, including dates from filtered-out candidates.",
"additionalProperties": false
}
},
"additionalProperties": false
}epss_query_threshold annotations
{
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true
}epss_prioritize_cves — Epss Prioritize Cves
Advertised read-onlyOpen-world
Assign remediation tiers using latest or dated EPSS and caller-supplied CVSS base severity. Defaults are severity >= 7 and EPSS probability >= 0.10; select percentile explicitly for population rank. Missing severity stays in epssOnly and missing EPSS stays unscored. Thresholds are policy conventions, not FIRST guidance. Process up to 500 unique entries from batchOffset, returning whole entries within the byte budget. Resume using nextBatchOffset as batchOffset, the original cves with original cvssBaseScore values, returned score date as date, and the same severityThreshold and likelihood. Deferred lists may be declared previews; withheldCves were already processed.
epss_prioritize_cves input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cves"
],
"properties": {
"cves": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve"
],
"properties": {
"cve": {
"type": "string",
"maxLength": 128,
"minLength": 1,
"description": "Complete CVE-YYYY-NNNN identifier; whitespace, case and Unicode dashes are normalized."
},
"cvssBaseScore": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Optional caller-supplied severity; absent remains unknown."
}
},
"description": "CVE identifier with optional supplied severity.",
"additionalProperties": false
},
"maxItems": 5000,
"minItems": 1,
"description": "One to 5000 CVEs with optional caller severity; process up to 500 unique identifiers from batchOffset."
},
"date": {
"type": "string",
"pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
"description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
},
"likelihood": {
"oneOf": [
{
"type": "object",
"required": [
"metric",
"threshold"
],
"properties": {
"metric": {
"type": "string",
"const": "epss",
"description": "Exploitation probability metric."
},
"threshold": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 inclusive probability cutoff."
}
},
"description": "Probability-based likelihood policy.",
"additionalProperties": false
},
{
"type": "object",
"required": [
"metric",
"threshold"
],
"properties": {
"metric": {
"type": "string",
"const": "percentile",
"description": "Population rank metric; not probability."
},
"threshold": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 inclusive percentile cutoff."
}
},
"description": "Percentile-based likelihood policy.",
"additionalProperties": false
}
],
"description": "Select one likelihood metric and threshold; omitted uses EPSS >= 0.10."
},
"batchOffset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs."
},
"severityThreshold": {
"type": "number",
"default": 7,
"maximum": 10,
"minimum": 0,
"description": "Inclusive high severity threshold, default 7."
}
},
"additionalProperties": false
}epss_prioritize_cves output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"tiers",
"epssOnly",
"unscoredCves",
"deferredCves",
"requestedCount",
"processedCount",
"duplicateCount",
"provenance",
"thresholds"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"conflicting_cvss",
"snapshot_unavailable",
"upstream_shape"
],
"description": "Machine-readable failure mode. Declared by this tool: `conflicting_cvss`: Duplicate canonical CVEs have different severity inputs, including missing versus supplied. `snapshot_unavailable`: FIRST identifies the requested dated snapshot as unavailable. `upstream_shape`: The score envelope, batch completeness or snapshot is invalid. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"tiers": {
"type": "object",
"required": [
"act_now",
"scheduled",
"monitor",
"defer"
],
"properties": {
"defer": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource",
"cvssBaseScore",
"highSeverity",
"highLikelihood"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"highSeverity": {
"type": "boolean",
"description": "Severity meets inclusive severityThreshold."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"cvssBaseScore": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "0–10 caller-supplied CVSS base severity; not retrieved."
},
"highLikelihood": {
"type": "boolean",
"description": "Selected likelihood metric meets inclusive threshold."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Scored CVE with known severity and explicit threshold flags.",
"additionalProperties": false
},
"description": "Low severity and low likelihood."
},
"act_now": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource",
"cvssBaseScore",
"highSeverity",
"highLikelihood"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"highSeverity": {
"type": "boolean",
"description": "Severity meets inclusive severityThreshold."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"cvssBaseScore": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "0–10 caller-supplied CVSS base severity; not retrieved."
},
"highLikelihood": {
"type": "boolean",
"description": "Selected likelihood metric meets inclusive threshold."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Scored CVE with known severity and explicit threshold flags.",
"additionalProperties": false
},
"description": "High severity and high likelihood."
},
"monitor": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource",
"cvssBaseScore",
"highSeverity",
"highLikelihood"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"highSeverity": {
"type": "boolean",
"description": "Severity meets inclusive severityThreshold."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"cvssBaseScore": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "0–10 caller-supplied CVSS base severity; not retrieved."
},
"highLikelihood": {
"type": "boolean",
"description": "Selected likelihood metric meets inclusive threshold."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Scored CVE with known severity and explicit threshold flags.",
"additionalProperties": false
},
"description": "Low severity and high likelihood."
},
"scheduled": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource",
"cvssBaseScore",
"highSeverity",
"highLikelihood"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"highSeverity": {
"type": "boolean",
"description": "Severity meets inclusive severityThreshold."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"cvssBaseScore": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "0–10 caller-supplied CVSS base severity; not retrieved."
},
"highLikelihood": {
"type": "boolean",
"description": "Selected likelihood metric meets inclusive threshold."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Scored CVE with known severity and explicit threshold flags.",
"additionalProperties": false
},
"description": "High severity and low likelihood."
}
},
"description": "Policy tiers, each sorted by EPSS, CVSS descending then CVE ascending.",
"additionalProperties": false
},
"notice": {
"type": "string",
"description": "Missing-data, deferred-work or model-metadata caveats."
},
"epssOnly": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"epss",
"percentile",
"date",
"modelVersionSource",
"highLikelihood",
"guidance"
],
"properties": {
"cve": {
"type": "string",
"description": "Canonical CVE identifier."
},
"date": {
"type": "string",
"description": "Upstream score date."
},
"epss": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 probability of observed exploitation within the next 30 days."
},
"guidance": {
"type": "string",
"description": "How to supply missing severity."
},
"percentile": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 population rank, not exploitation probability."
},
"modelVersion": {
"type": "string",
"description": "Verified or inferred scoring model version when available."
},
"highLikelihood": {
"type": "boolean",
"description": "Selected likelihood meets threshold."
},
"modelVersionSource": {
"enum": [
"csv_header",
"published_schedule",
"unavailable"
],
"type": "string",
"description": "csv_header: verified metadata; published_schedule: inferred; unavailable: unknown."
}
},
"description": "Forecast with unknown caller severity.",
"additionalProperties": false
},
"description": "Scored CVEs without caller severity; never classified as low severity."
},
"provenance": {
"type": "object",
"required": [
"source",
"apiUrl",
"retrievedAt",
"scoreDates",
"modelMetadata"
],
"properties": {
"apiUrl": {
"type": "string",
"description": "FIRST lookup endpoint."
},
"source": {
"type": "string",
"const": "FIRST EPSS",
"description": "Score publisher."
},
"scoreDates": {
"type": "array",
"items": {
"type": "string",
"description": "Observed snapshot date."
},
"description": "Returned anchor or candidate score dates."
},
"retrievedAt": {
"type": "string",
"description": "UTC retrieval timestamp."
},
"modelMetadata": {
"type": "object",
"required": [
"status"
],
"properties": {
"status": {
"enum": [
"verified",
"inferred",
"unavailable"
],
"type": "string",
"description": "verified: matching metadata; inferred: published schedule; unavailable: unknown."
},
"scoreDate": {
"type": "string",
"description": "Snapshot attributed by metadata."
},
"sourceUrl": {
"type": "string",
"description": "Model metadata source."
},
"explanation": {
"type": "string",
"description": "Attribution limitations and inference basis."
},
"modelVersion": {
"type": "string",
"description": "Attributed model version."
}
},
"description": "Snapshot model attribution.",
"additionalProperties": false
},
"requestedDate": {
"type": "string",
"description": "Explicit requested historical date."
}
},
"description": "Source and model attribution.",
"additionalProperties": false
},
"thresholds": {
"type": "object",
"required": [
"severityThreshold",
"likelihood"
],
"properties": {
"likelihood": {
"oneOf": [
{
"type": "object",
"required": [
"metric",
"threshold"
],
"properties": {
"metric": {
"type": "string",
"const": "epss",
"description": "Exploitation probability metric."
},
"threshold": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 inclusive probability cutoff."
}
},
"description": "Probability-based likelihood policy.",
"additionalProperties": false
},
{
"type": "object",
"required": [
"metric",
"threshold"
],
"properties": {
"metric": {
"type": "string",
"const": "percentile",
"description": "Population rank metric; not probability."
},
"threshold": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "0–1 inclusive percentile cutoff."
}
},
"description": "Percentile-based likelihood policy.",
"additionalProperties": false
}
],
"description": "Applied alternative likelihood metric and cutoff."
},
"severityThreshold": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Applied inclusive high severity cutoff."
}
},
"description": "Applied policy conventions, not FIRST recommendations.",
"additionalProperties": false
},
"batchOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Starting offset in the original normalized unique input."
},
"deferredCves": {
"type": "array",
"items": {
"type": "string",
"description": "Identifier not queried."
},
"description": "Never-queried identifiers beyond this call workload cap; complete unless deferredCvesComplete is false. Resume using nextBatchOffset and the original submission."
},
"unscoredCves": {
"type": "array",
"items": {
"type": "object",
"required": [
"cve",
"reason",
"guidance"
],
"properties": {
"cve": {
"type": "string",
"description": "Submitted normalized identifier."
},
"reason": {
"enum": [
"invalid_format",
"not_returned"
],
"type": "string",
"description": "Invalid identifier or upstream omission; neither implies zero risk."
},
"guidance": {
"type": "string",
"description": "Next step for missing scores."
},
"cvssBaseScore": {
"type": "number",
"maximum": 10,
"minimum": 0,
"description": "Preserved caller severity even when EPSS is absent."
}
},
"description": "Unknown forecast with preserved caller severity.",
"additionalProperties": false
},
"description": "Processed identifiers without EPSS, preserving supplied severity."
},
"withheldCves": {
"type": "array",
"items": {
"type": "string",
"description": "Already processed identifier withheld from this response."
},
"description": "Already processed identifiers withheld by the byte budget, in original input order; may be a preview."
},
"budgetLimited": {
"type": "boolean",
"description": "True when whole entries or accounting lists were shortened to fit the serialized response budget."
},
"deferredCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Identifiers beyond this call workload cap, not queried."
},
"returnedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Processed identifiers whose complete score, history or unscored entry is included."
},
"withheldCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Processed identifiers withheld by the response byte budget; queried valid entries are included in processedCount."
},
"duplicateCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Duplicate submitted entries removed."
},
"processedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Unique identifiers processed, including invalid formats."
},
"requestedCount": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Unique normalized identifiers submitted."
},
"nextBatchOffset": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Resume with this batchOffset and the original cves, returned date and original severity/policy inputs."
},
"deferredCvesComplete": {
"type": "boolean",
"description": "True when deferredCves includes every never-queried deferred identifier."
},
"withheldCvesComplete": {
"type": "boolean",
"description": "True when withheldCves includes every withheld identifier."
}
},
"additionalProperties": false
}epss_prioritize_cves annotations
{
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true
}epss_list_reference — Epss List Reference
Advertised read-only
Explain FIRST EPSS interpretation, model publishing dates, lookup coverage and transparent prioritization policy. Use this static reference before interpreting missing scores, score movement or probability versus percentile thresholds.
epss_list_reference input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"topic": {
"enum": [
"all",
"interpretation",
"models",
"coverage",
"prioritization"
],
"type": "string",
"default": "all",
"description": "interpretation: score meaning; models: publishing history; coverage: limits and missing data; prioritization: tier policy; all: every topic."
}
},
"additionalProperties": false
}epss_list_reference output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"topics",
"verifiedAt"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"description": "Machine-readable failure mode."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"topics": {
"type": "array",
"items": {
"type": "object",
"required": [
"topic",
"guidance",
"facts",
"sources"
],
"properties": {
"facts": {
"type": "array",
"items": {
"type": "string",
"description": "Documented fact or policy."
},
"description": "Detailed reference facts."
},
"topic": {
"enum": [
"interpretation",
"models",
"coverage",
"prioritization"
],
"type": "string",
"description": "Reference topic."
},
"sources": {
"type": "array",
"items": {
"type": "string",
"description": "Primary-source URL."
},
"description": "Supporting primary sources."
},
"guidance": {
"type": "string",
"description": "Interpretive guidance."
}
},
"description": "Guidance and supporting facts for one topic.",
"additionalProperties": false
},
"description": "Selected reference topics."
},
"verifiedAt": {
"type": "string",
"const": "2026-10-18",
"description": "Primary-source verification date."
}
},
"additionalProperties": false
}epss_list_reference annotations
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}Prompts
0 advertised
Resources
1 advertised
first-epss-guide
Gates and workflows for the epss_* tools (FIRST EPSS). When EPSS answers a question and when an NVD or KEV source must, where score dates and offsets come from, when batch and candidate paging is done, why discovery pages are not EPSS-ranked, and how to tell a model change from real score movement. Use when triaging a CVE list or scanner export, explaining an EPSS change, or finding high-likelihood or newly added CVEs.
first-epss-guide URI
skill://first-epss-guide/SKILL.mdio.modelcontextprotocol/skills
io.modelcontextprotocol/skills URI template
skill://{+path}30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 743 ms
- 95th percentile latency
- 743 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 743 ms · metadata changed · 5 tool(s), 1 resource(s), 1 resource template(s), 0 prompt(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
Claude Code configuration
claude mcp add --transport http first-epss-mcp-server-caseyjhand https://first-epss.caseyjhand.com/mcpCodex
Codex configuration
codex mcp add first-epss-mcp-server-caseyjhand --url https://first-epss.caseyjhand.com/mcpCursor
Cursor configuration
{
"mcpServers": {
"first-epss-mcp-server-caseyjhand": {
"url": "https://first-epss.caseyjhand.com/mcp"
}
}
}Cline
Cline configuration
{
"mcpServers": {
"first-epss-mcp-server-caseyjhand": {
"type": "streamableHttp",
"url": "https://first-epss.caseyjhand.com/mcp",
"disabled": false
}
}
}VS Code
VS Code configuration
{
"servers": {
"first-epss-mcp-server-caseyjhand": {
"type": "http",
"url": "https://first-epss.caseyjhand.com/mcp"
}
}
}Gemini CLI
Gemini CLI configuration
gemini mcp add --transport http first-epss-mcp-server-caseyjhand https://first-epss.caseyjhand.com/mcpClaude Desktop
Claude Desktop configuration
{
"mcpServers": {
"first-epss-mcp-server-caseyjhand": {
"url": "https://first-epss.caseyjhand.com/mcp"
}
}
}Windsurf
Windsurf configuration
{
"mcpServers": {
"first-epss-mcp-server-caseyjhand": {
"serverUrl": "https://first-epss.caseyjhand.com/mcp"
}
}
}Let your agent find its tools
Find servers like first-epss-mcp-server from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.