vuln-intel

Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC (exploitation/automatable/technical_impact), P1-P4 priority with rationale, affected products/versions, and (live) public-exploit signal. Args: cve_id: e.g. "CVE-2025-12345". include_poc: also query GitHub for public PoC/exploit repos (live).

Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Distinct products that share a name are kept distinct. If one name maps to several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobileiron, apache; "Envoy" → envoyproxy, enphase), the result is flagged `ambiguous` with `distinct_ve

Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC- active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this product family repeatedly fails at, ranked by real in-the-wild exploitation — i.e. WHERE to look first and WHAT shape to expect. Components are or

Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse. Fingerprints the homepage + JS bundles (recovering the backend identity and API endpoints homepage detection misses on SPAs), then ranks against live KEV / SSVC-active / high-EPSS into a dig-order. Fetches only public pages — authorized targets only. NON-BLOCKING: a scan takes ~1-4 min, so observe

Search the CVE corpus — one entry point, three retrieval modes picked from your arguments: - query= a concept / technique / weakness (e.g. "SSO SAML assertion replay", "deserialization gadget chain", "server-side request forgery cloud metadata"). By default it FUSES full-text keyword search AND semantic mechanism-search, so you don't have t

Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty report mechanic-cards whose approach is closest (by mechanism) to your query or a seed CVE. The "what approach worked on a bug like this, on which program, and what did it pay" layer: grounded in real publicly-disclosed, paid HackerOne reports, each distilled to a transferable mechanic (bug_class

When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched against the full disclosed-report BODIES (the concrete step/payload/precondition), not just the distilled card. This is the "I have a messy pile of capabilities, what are my legal moves?" lay

Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you already tried / couldn't achieve) and get a grounded brief built from the closest REAL disclosed reports: (1) precedent & validity — is this an accepted class, with citable reports (ammunition if it was disputed/closed); (2) what's novel/stronger about yours — what to lead with; (3) an

At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug classes have historically LANDED there — to decide what to look at first and what to skip. Built from real HackerOne disclosed reports: the class distribution for this program, each with LIFT over the global base-rate, sample size, and cited example reports; plus `lands_rarely` — the clas

Fact-check a claim about a CVE against the corpus — catch hallucinations before they ship. Verifies: does the CVE exist; does it affect the claimed product at the claimed version; is the severity right; is it actually KEV-exploited. Returns per-assertion verdicts (supported / refuted / unverifiable) with cited evidence. Use it to check what another agent (or a draft report)

Corpus size and data freshness (CVE / KEV / EPSS counts and latest timestamps).

Search public repositories for an exact code string; return WHERE it appears. Use it to hunt vendored / copy-pasted copies of known-vulnerable code: search a distinctive line or symbol from the vulnerable function, then FETCH AND READ the hits to judge which copies are still unpatched, reachable, or just fossils/forks. Returns RAW search results only -- it makes no vulnerability j