{"ok":true,"site":{"host":"cve.meenan.dev","url":"https://cve.meenan.dev/","type":"live","desc":"CVE Explorer — browser-based search, analysis and AI chat over the complete CVE List.","tools":[{"name":"cve_explorer_guide","kind":"answer","impl":"imperative","description":"Read this first. Returns the guide for driving CVE Explorer: what the corpus is, the rules the other tools expect (dates, dimensions, when to use aggregate versus sql), and the SQLite schema the sql tool runs against.","title":"How to use CVE Explorer","annotations":{"readOnlyHint":true,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{},"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"aggregate","kind":"act","impl":"imperative","description":"Count CVEs grouped by one dimension, optionally split by a second, and render it as a chart. This is the main tool: use it for any \"how many\", \"over time\", \"by vendor\", \"trend\" or \"breakdown\" question. It returns the counts and draws the chart.","title":"aggregate","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"rows":{"type":"string","enum":["year","quarter","month","week","severity","cvssVersion","ssvcExpl","ssvcAuto","ssvcImpact","kev","kevRansomware","state","cna","vendor","product","cwe","host"],"description":"The primary axis — bars, or the x-axis of a line chart. year (Year): calendar year of publication; quarter (Quarter): calendar quarter of publication; month (Month): calendar month of publication; week (Week): Monday-to-Sunday week of publication, labelled by the Monday as YYYY-MM-DD; severity (Severity): CVSS band; records that were never scored are their own bucket; cvssVersion (CVSS version): which CVSS version scored it; ssvcExpl (SSVC exploitation): CISA SSVC exploitation state; ssvcAuto (SSVC automatable): CISA SSVC automatable; ssvcImpact (SSVC technical impact): CISA SSVC technical impact; kev (CISA KEV): membership of CISA's known-exploited catalog; kevRansomware (KEV ransomware use): known ransomware use, per CISA; state (State): PUBLISHED or REJECTED; cna (CNA): the CNA that assigned the CVE; vendor (Vendor): one bucket per vendor, all its products combined; product (Product): one bucket per product, labelled \"vendor / product\" — use this for a question that names a vendor AND a product, because it carries both; cwe (CWE): weakness type, labelled \"CWE-nnn — description\"; host (Reference host): hostname of a reference URL"},"series":{"type":"string","enum":["year","quarter","month","week","severity","cvssVersion","ssvcExpl","ssvcAuto","ssvcImpact","kev","kevRansomware","state","cna","vendor","product","cwe","host"],"description":"Optional second axis to split each row by. Must differ from rows. A report has exactly these two axes, so a question naming three dimensions needs one axis that covers two of them — \"product\" covers vendor and product together."},"chart":{"type":"string","enum":["stackedBar","groupedBar","line","area","table"],"description":"Defaults to stackedBar."},"limit":{"type":"integer","description":"How many row buckets to show. 1-400."},"title":{"type":"string","description":"A short title for the chart."},"text":{"type":"string","description":"Full-text search over CVE descriptions and titles. Words are ANDed; use it for topics (\"buffer overflow\"), never for a vendor or product name, which have their own fields."},"vendor":{"type":"array","items":{"type":"string"},"description":"Exact vendor names."},"product":{"type":"array","items":{"type":"string"},"description":"Exact product names."},"cna":{"type":"array","items":{"type":"string"},"description":"Exact CNA (assigner) names."},"cwe":{"type":"array","items":{"type":"string"},"description":"CWE ids, e.g. \"CWE-787\"."},"host":{"type":"array","items":{"type":"string"},"description":"Reference hostnames, e.g. \"github.com\"."},"severity":{"type":"array","items":{"type":"string","enum":["NONE","LOW","MEDIUM","HIGH","CRITICAL"]},"description":"CVSS severity bands."},"cvssVersion":{"type":"array","items":{"type":"string","enum":["v2.0","v3.0","v3.1","v4.0"]}},"ssvcExploitation":{"type":"array","items":{"type":"string","enum":["none","poc","active","not assessed"]},"description":"CISA SSVC exploitation state. \"not assessed\" is its own value and covers about half the corpus — it is not the same as \"none\"."},"ssvcAutomatable":{"type":"array","items":{"type":"string","enum":["yes","no","not assessed"]}},"ssvcImpact":{"type":"array","items":{"type":"string","enum":["partial","total","not assessed"]}},"kev":{"type":"array","items":{"type":"string","enum":["in kev","not in kev"]},"description":"Membership of CISA's Known Exploited Vulnerabilities catalog."},"kevRansomware":{"type":"array","items":{"type":"string","enum":["known","unknown","not in kev","not stated"]}},"scoreMin":{"type":"number","description":"Minimum CVSS base score, 0-10."},"scoreMax":{"type":"number","description":"Maximum CVSS base score, 0-10."},"yearFrom":{"type":"integer","description":"Earliest year in the CVE identifier — when it was reserved, not published."},"yearTo":{"type":"integer","description":"Latest year in the CVE identifier — when it was reserved, not published."},"publishedFrom":{"type":"string","description":"Published on or after this YYYY-MM-DD date."},"publishedTo":{"type":"string","description":"Published on or before this YYYY-MM-DD date."},"updatedFrom":{"type":"string","description":"Last updated on or after this YYYY-MM-DD date."},"updatedTo":{"type":"string","description":"Last updated on or before this YYYY-MM-DD date."},"kevAddedFrom":{"type":"string","description":"Added to KEV on or after this YYYY-MM-DD date."},"kevAddedTo":{"type":"string","description":"Added to KEV on or before this YYYY-MM-DD date."},"kevDueFrom":{"type":"string","description":"KEV remediation due on or after this YYYY-MM-DD."},"kevDueTo":{"type":"string","description":"KEV remediation due on or before this YYYY-MM-DD."},"cveId":{"type":"string","description":"One exact identifier, e.g. \"CVE-2021-44228\". For reading a record, prefer cve_detail."},"state":{"type":"string","enum":["published","rejected","all"],"description":"Which records to count. Defaults to \"published\"; REJECTED identifiers are withdrawn, not vulnerabilities, and including them inflates every count."}},"required":["rows"]},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"search_records","kind":"answer","impl":"imperative","description":"Find individual CVE records matching a filter, and list them in the panel. Use this when the user wants specific CVEs rather than counts. The records are rendered for the user and returned to you — identifier, state, published date, CVSS, CNA and the start of the description, up to 50 rows within a character budget — so you can summarise, compare or pick among them; you are told how many more matched.","title":"search records","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"sort":{"type":"string","enum":["published","updated","score","cve"],"description":"Defaults to published, newest first."},"limit":{"type":"integer","description":"How many records to list. 1-500."},"text":{"type":"string","description":"Full-text search over CVE descriptions and titles. Words are ANDed; use it for topics (\"buffer overflow\"), never for a vendor or product name, which have their own fields."},"vendor":{"type":"array","items":{"type":"string"},"description":"Exact vendor names."},"product":{"type":"array","items":{"type":"string"},"description":"Exact product names."},"cna":{"type":"array","items":{"type":"string"},"description":"Exact CNA (assigner) names."},"cwe":{"type":"array","items":{"type":"string"},"description":"CWE ids, e.g. \"CWE-787\"."},"host":{"type":"array","items":{"type":"string"},"description":"Reference hostnames, e.g. \"github.com\"."},"severity":{"type":"array","items":{"type":"string","enum":["NONE","LOW","MEDIUM","HIGH","CRITICAL"]},"description":"CVSS severity bands."},"cvssVersion":{"type":"array","items":{"type":"string","enum":["v2.0","v3.0","v3.1","v4.0"]}},"ssvcExploitation":{"type":"array","items":{"type":"string","enum":["none","poc","active","not assessed"]},"description":"CISA SSVC exploitation state. \"not assessed\" is its own value and covers about half the corpus — it is not the same as \"none\"."},"ssvcAutomatable":{"type":"array","items":{"type":"string","enum":["yes","no","not assessed"]}},"ssvcImpact":{"type":"array","items":{"type":"string","enum":["partial","total","not assessed"]}},"kev":{"type":"array","items":{"type":"string","enum":["in kev","not in kev"]},"description":"Membership of CISA's Known Exploited Vulnerabilities catalog."},"kevRansomware":{"type":"array","items":{"type":"string","enum":["known","unknown","not in kev","not stated"]}},"scoreMin":{"type":"number","description":"Minimum CVSS base score, 0-10."},"scoreMax":{"type":"number","description":"Maximum CVSS base score, 0-10."},"yearFrom":{"type":"integer","description":"Earliest year in the CVE identifier — when it was reserved, not published."},"yearTo":{"type":"integer","description":"Latest year in the CVE identifier — when it was reserved, not published."},"publishedFrom":{"type":"string","description":"Published on or after this YYYY-MM-DD date."},"publishedTo":{"type":"string","description":"Published on or before this YYYY-MM-DD date."},"updatedFrom":{"type":"string","description":"Last updated on or after this YYYY-MM-DD date."},"updatedTo":{"type":"string","description":"Last updated on or before this YYYY-MM-DD date."},"kevAddedFrom":{"type":"string","description":"Added to KEV on or after this YYYY-MM-DD date."},"kevAddedTo":{"type":"string","description":"Added to KEV on or before this YYYY-MM-DD date."},"kevDueFrom":{"type":"string","description":"KEV remediation due on or after this YYYY-MM-DD."},"kevDueTo":{"type":"string","description":"KEV remediation due on or before this YYYY-MM-DD."},"cveId":{"type":"string","description":"One exact identifier, e.g. \"CVE-2021-44228\". For reading a record, prefer cve_detail."},"state":{"type":"string","enum":["published","rejected","all"],"description":"Which records to count. Defaults to \"published\"; REJECTED identifiers are withdrawn, not vulnerabilities, and including them inflates every count."}}},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"cve_detail","kind":"answer","impl":"imperative","description":"Read one CVE record in full by its identifier — description, CVSS, CWEs, affected products, and its CISA KEV entry if it has one.","title":"cve detail","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"cveId":{"type":"string","description":"A canonical identifier, e.g. \"CVE-2021-44228\"."}},"required":["cveId"]},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"kev_lookup","kind":"act","impl":"imperative","description":"Ask whether one CVE is in CISA's Known Exploited Vulnerabilities catalog, and read its entry. Answers \"not in the catalog, per CISA\" when it is absent, and refuses outright when this browser holds no catalog.","title":"kev lookup","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"cveId":{"type":"string","description":"A canonical identifier, e.g. \"CVE-2021-44228\"."}},"required":["cveId"]},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"sql","kind":"act","impl":"imperative","description":"Run one read-only SELECT against the local SQLite copy, for questions the other tools cannot express. The database refuses anything but a read. Prefer aggregate when it fits — its results are charted and the user can edit them.","title":"sql","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"sql":{"type":"string","description":"One SELECT statement."}},"required":["sql"]},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"compute","kind":"act","impl":"imperative","description":"Run JavaScript over the full rows of the most recent result — the last aggregate, record search or sql that ran, all of its rows, not the window you were shown — in an isolated sandbox with no network, no storage and a 10— which is what you get back, cut at 12000 characters. Prefer sql when SQLite can answer directly; compute is for working on a result you already ran.","title":"compute","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"code":{"type":"string","description":"A JavaScript function body. Example: \"return data.filter(r => /deserializ/i.test(r.description)).map(r => r.cve)\"."}},"required":["code"]},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"}],"category":"Developer Tools","favicon":"/favicons/cve.meenan.dev.png","apiSurface":"spec","toolCount":7}}