vuln-intel

Vuln Lookup

Get prioritized remediation intelligence for a known CVE. Use this when the user asks 'should I patch X', 'how bad is CVE-...', what the fix version is, or how to prioritize a vulnerability. Fast and cheap (~$0.005): aggregates NVD, CISA KEV and FIRST EPSS and returns a priority (P1-P4), fix versions, remediation steps, and a ServiceNow Vulnerability Response note. For public exploit / active-campaign intel, use vuln_deep_sweep instead. Args: cve_id: A CVE i

Vuln Deep Sweep

Deep exploit-intelligence sweep for a CVE using live web search. Use this when the user needs the real-time exploitation picture — is there public proof-of-concept or exploit code, is it in Metasploit, is it being actively exploited or used in ransomware campaigns, what is the latest advisory. Slower and costlier (~$0.14) than vuln_lookup because it runs live web searches. Returns everything vuln_lookup does plus a live_exploit_intel block with sources. Args:

Vuln Resolve

Map a free-form description to specific CVE identifier(s). Use this first when the user does NOT give an exact CVE id — e.g. a product and version ("Confluence 7.13"), an incident nickname ("Log4Shell", "the MOVEit hack"), or a vendor advisory URL. Returns candidate CVE ids with a short reason for each; then call vuln_lookup or vuln_deep_sweep on the one the user means. Args: query: Free-form product, description, nickname, or advisory URL.

Vuln Ledger

Cost and turnaround ledger for this agent. Returns how many lookups have been served, the average cost and turnaround per tier (fast / deep / resolve), and a comparison against commercial threat-intelligence subscription pricing. Useful for demonstrating the cost of producing threat intel from public data with an agent.