# cve_security_lookup

Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

Agent View of the PolicyLayer registry record for `cve_security_lookup`. HTML page: https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/cve-security-lookup

## Facts

- Tool: `cve_security_lookup`
- Server: Mcp Knowledge (`https://mcp.gapup.io`) — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge.md
- Homepage: https://github.com/getgapup/gapup-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 6 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `mode` | string | no | Override auto-detection: "lookup" for exact CVE ID, "search" for product/vendor keyword. |
| `async` | boolean | no | If true, returns a job_id immediately (<200ms) instead of waiting for the result. Poll the result with job_result(job_id). Use for slow tools to avoid client ti |
| `query` | string | yes | CVE ID (e.g. "CVE-2024-3094") or product/vendor keyword (e.g. "openssl", "Apache Tomcat"). Mode is auto-detected from the CVE-YYYY-XXXXX pattern. |
| `max_results` | number | no | Maximum number of vulnerabilities to return (default 20, max 50). |
| `severity_min` | string | no | Minimum CVSS v3 severity to include in results (default: no filter). |
| `published_after` | string | no | ISO date YYYY-MM-DD — only include CVEs published after this date. Defaults to 365 days ago for search mode. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "cve_security_lookup",
    "arguments": {
      "query": "<query>"
    }
  }
}
```

## Why cve_security_lookup is rated Low

This is a read-only information retrieval tool that queries authoritative security databases (NVD NIST, CISA KEV, EPSS FIRST, GitHub Security Advisories) to surface vulnerability metadata. It enables passive analysis and research with zero side effects on systems or data.

From the tool's own definition: "Tool performs 'Look up', 'search', and 'cross-references' vulnerability data from external databases. Returns 'structured vulnerability records' with no indication of modification, creation, deletion, or execution capabilities."

Risk signals: Accepts freeform code/query input (query)

## Use case

AI agents call cve_security_lookup to retrieve information from Mcp Knowledge without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp Knowledge:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "cve_security_lookup": {}
  }
}
```

## Other tools on Mcp Knowledge (270)

- `adversarial_input_stress_tester` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/adversarial-input-stress-tester.md
- `competitor_pricing_scrape` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/competitor-pricing-scrape.md
- `dora_operational_resilience_stress_tes` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/dora-operational-resilience-stress-tes.md
- `financial_model_3statement` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/financial-model-3statement.md
- `gl_reconciler` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/gl-reconciler.md
- `lgpd_data_subject_rights_automator` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/lgpd-data-subject-rights-automator.md
- `monte_carlo_portfolio` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/monte-carlo-portfolio.md
- `workflow_orchestrator` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/workflow-orchestrator.md
- `ma_arbitrage_hunter` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ma-arbitrage-hunter.md
- `repo_rate_arbitrage_scanner` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/repo-rate-arbitrage-scanner.md
- `tax_optimization` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/tax-optimization.md
- `treasury_optimizer` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/treasury-optimizer.md
- `usdc_x402_payments_intel` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/usdc-x402-payments-intel.md
- `working_capital_fx_hedge_optimizer` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/working-capital-fx-hedge-optimizer.md
- `pricing_in_deal` — Other — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/pricing-in-deal.md
- `term_sheet_negotiation` — Other — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/term-sheet-negotiation.md
- `abm_architect` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/abm-architect.md
- `abm_lookalike_account_finder` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/abm-lookalike-account-finder.md
- `account_expansion_mapper` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/account-expansion-mapper.md
- `affiliate_fraud_clickstream_detector` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/affiliate-fraud-clickstream-detector.md
- `africa_trade_barrier_breaker` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-barrier-breaker.md
- `africa_trade_finance_esg_rater` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-finance-esg-rater.md
- `africa_trade_preference_arbitrage` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-preference-arbitrage.md
- `africa_trade_preference_optimizer` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-preference-optimizer.md
- `agoa_eba_intelligence` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/agoa-eba-intelligence.md
- `ai_act_sandbox_regulatory_sandbox` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-act-sandbox-regulatory-sandbox.md
- `ai_act_training_data_audit` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-act-training-data-audit.md
- `ai_governance_full_report_async` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-full-report-async.md
- `ai_governance_full_report_result` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-full-report-result.md
- `ai_governance_pilot` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-pilot.md
- …and 240 more: https://policylayer.com/tools/io-github-getgapup-mcp-knowledge.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-getgapup-mcp-knowledge · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-getgapup-mcp-knowledge