Know which of a vendor's CVEs are actually being exploited
One call rolls up NVD CVEs by severity, CISA KEV actively-exploited flags, top EPSS exploit probability, and CWE weakness types into a single exposure verdict.
Tools:
security_exposure cve_lookup cve_search_by_vendor kev_status_check epss_score cwe_lookup- Call security_exposure for a vendor, product, or package and get CVE counts by severity, the CISA KEV (actively-exploited) count, the top FIRST EPSS score, and MITRE CWE weakness types in one rollup.
- Prioritize patching by real-world risk, not raw CVSS, using kev_status_check and epss_score to separate the exploited from the theoretical.
- Vet an open-source dependency's health with npm_package, pypi_package, cargo_crate, and github_repo, then cross-check it against the CVE tools.
How it works in one call
Your agent calls security_exposure with a vendor or package name and gets an exposure rollup: NVD CVEs by severity, KEV actively-exploited count, top EPSS probability, and CWE types, enough to triage without opening five tabs.
Start free
One API key, one MCP endpoint, 284 tools across 59 US public-data domains. Free tier is 1,000 queries a month, no card.