Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC
(exploitation/automatable/technical_impact), P1-P4 priority with rationale,
affected products/versions, Debian/Ubuntu/Alpine fixed builds per release
(`distro_fixes`), and (live) public-exploit signal.
Args:
cve_id: e.g. "CVE
Find vulnerabilities affecting a product across NVD (CPE) and OSV
(package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS.
Distinct products that share a name are kept distinct. If one name maps to
several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobileiron,
apache; "Envoy"
Turn a recon'd stack into a ranked dig-order for authorized bug-hunting.
For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC-
active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this
product family repeatedly fails at, ranked by real in-the-wild exp
Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse.
Fingerprints the homepage + JS bundles (recovering the backend identity and API endpoints
homepage detection misses on SPAs), then ranks against live KEV / SSVC-active / high-EPSS
into a dig-order. Fetches only public p
Search the CVE corpus — one entry point, three retrieval modes picked from your arguments:
- query= a concept / technique / weakness (e.g. "SSO SAML assertion replay",
"deserialization gadget chain", "server-side request forgery cloud metadata").
By default it FUSES full-
Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty
report mechanic-cards whose approach is closest (by mechanism) to your query or a seed CVE.
The "what approach worked on a bug like this, on which program, and what did it pay" layer:
grounded in real publicly-disclo
When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold,
stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched
against the full disclosed-report BODIES (the concrete step/payload/precondition), not just the
distilled c
Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you
already tried / couldn't achieve) and get a grounded brief built from the closest REAL disclosed reports:
(1) precedent & validity — is this an accepted class, with citable reports (ammunition if it was
At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug
classes have historically LANDED there — to decide what to look at first and what to skip.
Built from real HackerOne disclosed reports: the class distribution for this program, each with
LIFT over the global b
Find FRESH attack surface: bounty-eligible assets that entered a public bug-bounty program's scope in the
last `days` (HackerOne, Bugcrowd, Intigriti, YesWeHack, mirrored daily), the least-hunted surface there is.
Raw scope additions are mostly not new (in one week 57 of 80 were re-added after a re
Fact-check a claim about a CVE against the corpus — catch hallucinations
before they ship. Verifies: does the CVE exist; does it affect the claimed
product at the claimed version; is the severity right; is it actually
KEV-exploited. Returns per-assertion verdicts (supported / refuted /
unverifiable)
Search public repositories for an exact code string; return WHERE it appears.
Use it to hunt vendored / copy-pasted copies of known-vulnerable code: search a
distinctive line or symbol from the vulnerable function, then FETCH AND READ the hits
to judge which copies are still unpatched, reachable, o
FAQ
Questions
How do I install Vuln Intel?
Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does Vuln Intel need an API key?
No required environment variable is listed on this record.
What transport does Vuln Intel use?
Vuln Intel is reached over HTTP.
When was Vuln Intel last checked?
Last checked 2026-11-10. Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports
