@cyanheads/nist-nvd-mcp-server 0.1.3

package/changelog/template.md

@@ -0,0 +1,119 @@
+---
+# FORMAT REFERENCE — do not edit. Copy this file to
+# `changelog/<major.minor>.x/<version>.md` (e.g. `changelog/0.8.x/0.8.6.md`)
+# to author a new release. Set that file's H1 to `# <version> — YYYY-MM-DD`
+# with a concrete date.
+
+# Required. One-line GitHub Release-style headline. 350 character cap.
+# Default short and scannable. Don't pad, don't stitch unrelated changes with
+# semicolons — pick the headline. Quotes required: unquoted YAML treats `: `
+# inside the value as a key separator and fails GitHub's strict parser.
+summary: ""
+
+# Set `true` when consumers must change code to upgrade: API removals,
+# signature changes, config renames, behavior changes that break existing
+# usage. Flagged as `Breaking` in the rollup.
+breaking: false
+
+# Set `true` if this release contains any security fix. Pairs with the
+# `## Security` section below. Flagged as `Security` in the rollup so
+# users can triage upgrade urgency at a glance.
+security: false
+---
+
+# <version> — YYYY-MM-DD
+
+<!--
+  AUTHORING GUIDE — applies to the new per-version file you create from this
+  template.
+
+  Audience: someone scanning release notes to decide what affects them. Lead
+  each bullet with the symbol or concept name in **bold** so they can skip
+  what's irrelevant and zoom in on what's not.
+
+  Tone: terse, fact-dense, not verbose. Default to one sentence per bullet —
+  name the symbol, state what changed, stop. Use a second sentence only when
+  it carries weight. If a bullet feels long, it is.
+
+  Cut: mechanism walkthroughs (those belong in JSDoc, AGENTS.md, or the
+  relevant skill), ceremonial framings ("This release introduces…",
+  backwards-compat paragraphs), file-by-file test enumerations, internal
+  implementation notes. Prefer code/symbol names over English re-explanations.
+
+  Narrative intro: skip by default. Add one short sentence only when the
+  release theme genuinely needs framing the bullets can't carry.
+
+  Sections: Keep a Changelog order — Added, Changed, Deprecated, Removed,
+  Fixed, Security. Include only sections with entries; delete the rest
+  (including the commented-out scaffolding below). Don't ship empty headers.
+
+  Include: every distinct fact a reader needs to adopt or audit the release —
+  new exports, signatures, lint rule IDs, env vars, breaking changes, version
+  bumps on shipped skills. Nothing more.
+
+  Links: link issues, PRs, docs, or skills where they help a reader jump to
+  context. Once per item per entry — don't re-link the same issue in summary,
+  narrative, and bullet. Skip links for inline symbol names; code spans speak
+  for themselves.
+
+  Issue/PR URLs: use full URLs. GitHub's bare `#NN` auto-link only resolves
+  inside its own UI, not in npm reads or local editors.
+
+      [#38](https://github.com/cyanheads/mcp-ts-core/issues/38)   ← issue
+      [#42](https://github.com/cyanheads/mcp-ts-core/pull/42)     ← PR
+
+  Verify numbers exist before linking (`gh issue view NN`, `gh pr view NN`).
+  Never speculate on a future number — `#42` for an upcoming PR silently
+  resolves to whatever real item already owns 42, and timeline previews pull
+  in that unrelated item's metadata.
+
+  TAG ANNOTATIONS — the annotated tag body renders as the GitHub Release body
+  via `gh release create --notes-from-tag`. The tag is a derivative of this
+  changelog entry — a condensed, scannable version, not a copy. Format:
+
+    <theme — omit version number, GitHub prepends it>
+                                                          ← blank line
+    <1-2 sentence context: what this release does>
+                                                          ← blank line
+    Dependency bumps:                                     ← section header
+                                                          ← blank line
+    - `@cyanheads/mcp-ts-core` ^0.9.1 → ^0.9.6          ← bullet
+                                                          ← blank line
+    Changed:                                              ← only sections with entries
+                                                          ← blank line
+    - `format()` output includes `query` in text mode
+                                                          ← blank line
+    Added:
+                                                          ← blank line
+    - `manifest.json` scaffolded for MCPB bundle support
+    - Install badges (Claude Desktop, Cursor, VS Code)
+                                                          ← blank line
+    <N> tests pass; `bun run devcheck` clean.             ← footer
+
+  Never a flat comma-separated string. Always structured markdown with
+  sections. The tag must scan well as a rendered GitHub Release page.
+-->
+
+## Added
+
+-
+
+## Changed
+
+-
+
+<!-- ## Deprecated
+
+- -->
+
+<!-- ## Removed
+
+- -->
+
+## Fixed
+
+-
+
+<!-- ## Security
+
+- -->

package/dist/config/server-config.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview Server-specific configuration for nist-nvd-mcp-server.
+ * Parses NVD API key and request timeout from environment variables.
+ * @module config/server-config
+ */
+import { z } from '@cyanheads/mcp-ts-core';
+declare const ServerConfigSchema: z.ZodObject<{
+    apiKey: z.ZodOptional<z.ZodString>;
+    requestTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type ServerConfig = z.infer<typeof ServerConfigSchema>;
+/** Returns the parsed server config, parsing from environment variables on first call. */
+export declare function getServerConfig(): ServerConfig;
+export {};
+//# sourceMappingURL=server-config.d.ts.map

package/dist/config/server-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAG3C,QAAA,MAAM,kBAAkB;;;iBAWtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,0FAA0F;AAC1F,wBAAgB,eAAe,IAAI,YAAY,CAM9C"}

package/dist/config/server-config.js

@@ -0,0 +1,27 @@
+/**
+ * @fileoverview Server-specific configuration for nist-nvd-mcp-server.
+ * Parses NVD API key and request timeout from environment variables.
+ * @module config/server-config
+ */
+import { z } from '@cyanheads/mcp-ts-core';
+import { parseEnvConfig } from '@cyanheads/mcp-ts-core/config';
+const ServerConfigSchema = z.object({
+    apiKey: z
+        .string()
+        .optional()
+        .describe('NIST NVD API key. Without it, rate limit is 5 req/30s. With it, 50 req/30s. Get one free at nvd.nist.gov/developers/request-an-api-key.'),
+    requestTimeoutMs: z.coerce
+        .number()
+        .default(10_000)
+        .describe('HTTP request timeout in milliseconds. Default: 10000 (10s).'),
+});
+let _config;
+/** Returns the parsed server config, parsing from environment variables on first call. */
+export function getServerConfig() {
+    _config ??= parseEnvConfig(ServerConfigSchema, {
+        apiKey: 'NVD_API_KEY',
+        requestTimeoutMs: 'NVD_REQUEST_TIMEOUT_MS',
+    });
+    return _config;
+}
+//# sourceMappingURL=server-config.js.map

package/dist/config/server-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yIAAyI,CAC1I;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM;SACvB,MAAM,EAAE;SACR,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,6DAA6D,CAAC;CAC3E,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,0FAA0F;AAC1F,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,cAAc,CAAC,kBAAkB,EAAE;QAC7C,MAAM,EAAE,aAAa;QACrB,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * @fileoverview nist-nvd-mcp-server MCP server entry point.
+ * Registers NVD tools and resources, initializes HTTP client and domain services.
+ * @module index
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG"}

package/dist/index.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * @fileoverview nist-nvd-mcp-server MCP server entry point.
+ * Registers NVD tools and resources, initializes HTTP client and domain services.
+ * @module index
+ */
+import { createApp } from '@cyanheads/mcp-ts-core';
+import { getServerConfig } from './config/server-config.js';
+import { nvdCveResource } from './mcp-server/resources/definitions/index.js';
+import { nvdAuditCpe, nvdGetCve, nvdGetCveHistory, nvdSearchCpes, nvdSearchCves, } from './mcp-server/tools/definitions/index.js';
+import { initNvdCpeService } from './services/nvd-cpe/nvd-cpe-service.js';
+import { initNvdCveService } from './services/nvd-cve/nvd-cve-service.js';
+import { initNvdHttpClient } from './services/nvd-http/nvd-http-client.js';
+await createApp({
+    tools: [nvdGetCve, nvdSearchCves, nvdAuditCpe, nvdSearchCpes, nvdGetCveHistory],
+    resources: [nvdCveResource],
+    prompts: [],
+    instructions: 'This server provides read-only access to the NIST National Vulnerability Database (NVD).\n' +
+        '- Use nvd_search_cves to discover CVEs by keyword, severity, CWE, date range, or CISA KEV status.\n' +
+        '- Use nvd_get_cve for full CVSS details on specific CVE IDs (up to 100 per call).\n' +
+        '- Use nvd_search_cpes to find the correct CPE name for a product before auditing.\n' +
+        '- Use nvd_audit_cpe to find all CVEs affecting a specific product version.\n' +
+        '- Use nvd_get_cve_history to track when a CVE was re-scored or escalated.\n' +
+        '- Rate limit: 5 req/30s without API key, 50 req/30s with NVD_API_KEY.',
+    setup(core) {
+        const cfg = getServerConfig();
+        initNvdHttpClient(cfg.apiKey, cfg.requestTimeoutMs);
+        initNvdCveService(core.config, core.storage);
+        initNvdCpeService(core.config, core.storage);
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAE3E,MAAM,SAAS,CAAC;IACd,KAAK,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,CAAC;IAC/E,SAAS,EAAE,CAAC,cAAc,CAAC;IAC3B,OAAO,EAAE,EAAE;IACX,YAAY,EACV,4FAA4F;QAC5F,qGAAqG;QACrG,qFAAqF;QACrF,qFAAqF;QACrF,8EAA8E;QAC9E,6EAA6E;QAC7E,uEAAuE;IAEzE,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACpD,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/resources/definitions/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Barrel export for all NVD MCP resource definitions.
+ * @module mcp-server/resources/definitions
+ */
+export { nvdCveResource } from './nvd-cve.resource.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp-server/resources/definitions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/mcp-server/resources/definitions/index.js

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Barrel export for all NVD MCP resource definitions.
+ * @module mcp-server/resources/definitions
+ */
+export { nvdCveResource } from './nvd-cve.resource.js';
+//# sourceMappingURL=index.js.map

package/dist/mcp-server/resources/definitions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/mcp-server/resources/definitions/nvd-cve.resource.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Resource exposing a single CVE record by ID via a stable URI.
+ * @module src/mcp-server/resources/definitions/nvd-cve
+ */
+import { z } from '@cyanheads/mcp-ts-core';
+export declare const nvdCveResource: import("@cyanheads/mcp-ts-core").ResourceDefinition<z.ZodObject<{
+    cveId: z.ZodString;
+}, z.core.$strip>, undefined, undefined>;
+//# sourceMappingURL=nvd-cve.resource.d.ts.map

package/dist/mcp-server/resources/definitions/nvd-cve.resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-cve.resource.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/nvd-cve.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAY,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAMrD,eAAO,MAAM,cAAc;;wCAiCzB,CAAC"}

package/dist/mcp-server/resources/definitions/nvd-cve.resource.js

@@ -0,0 +1,36 @@
+/**
+ * @fileoverview Resource exposing a single CVE record by ID via a stable URI.
+ * @module src/mcp-server/resources/definitions/nvd-cve
+ */
+import { resource, z } from '@cyanheads/mcp-ts-core';
+import { notFound, validationError } from '@cyanheads/mcp-ts-core/errors';
+import { getNvdCveService } from '../../../services/nvd-cve/nvd-cve-service.js';
+const CVE_ID_REGEX = /^CVE-\d{4}-\d{4,}$/i;
+export const nvdCveResource = resource('nvd://cve/{cveId}', {
+    name: 'NVD CVE Record',
+    description: 'Fetch a single CVE record by ID from the NIST NVD via a stable URI. ' +
+        'Returns the same full data as nvd_get_cve for a single ID: CVSS scores, CWE weaknesses, ' +
+        'CPE configurations, CISA KEV fields, and references.',
+    mimeType: 'application/json',
+    params: z.object({
+        cveId: z
+            .string()
+            .describe('CVE identifier (e.g., "CVE-2021-44228"). Must match the format CVE-YYYY-NNNNN.'),
+    }),
+    async handler(params, ctx) {
+        const { cveId } = params;
+        if (!CVE_ID_REGEX.test(cveId)) {
+            throw validationError(`Invalid CVE ID format: "${cveId}". Expected format: CVE-YYYY-NNNNN.`, {
+                cveId,
+            });
+        }
+        ctx.log.debug('Fetching CVE resource', { cveId });
+        const service = getNvdCveService();
+        const result = await service.fetchById([cveId.toUpperCase()], true, ctx);
+        if (result.cves.length === 0) {
+            throw notFound(`CVE ${cveId} not found in the NVD database.`, { cveId });
+        }
+        return result.cves[0];
+    },
+});
+//# sourceMappingURL=nvd-cve.resource.js.map

package/dist/mcp-server/resources/definitions/nvd-cve.resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-cve.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/nvd-cve.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE;IAC1D,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACT,sEAAsE;QACtE,0FAA0F;QAC1F,sDAAsD;IACxD,QAAQ,EAAE,kBAAkB;IAE5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,CAAC,gFAAgF,CAAC;KAC9F,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;QACvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,eAAe,CAAC,2BAA2B,KAAK,qCAAqC,EAAE;gBAC3F,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEzE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,CAAC,OAAO,KAAK,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/tools/definitions/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Barrel export for all NVD MCP tool definitions.
+ * @module mcp-server/tools/definitions
+ */
+export { nvdAuditCpe } from './nvd-audit-cpe.tool.js';
+export { nvdGetCve } from './nvd-get-cve.tool.js';
+export { nvdGetCveHistory } from './nvd-get-cve-history.tool.js';
+export { nvdSearchCpes } from './nvd-search-cpes.tool.js';
+export { nvdSearchCves } from './nvd-search-cves.tool.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp-server/tools/definitions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/mcp-server/tools/definitions/index.js

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Barrel export for all NVD MCP tool definitions.
+ * @module mcp-server/tools/definitions
+ */
+export { nvdAuditCpe } from './nvd-audit-cpe.tool.js';
+export { nvdGetCve } from './nvd-get-cve.tool.js';
+export { nvdGetCveHistory } from './nvd-get-cve-history.tool.js';
+export { nvdSearchCpes } from './nvd-search-cpes.tool.js';
+export { nvdSearchCves } from './nvd-search-cves.tool.js';
+//# sourceMappingURL=index.js.map

package/dist/mcp-server/tools/definitions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/mcp-server/tools/definitions/nvd-audit-cpe.tool.d.ts

@@ -0,0 +1,116 @@
+/**
+ * @fileoverview Tool for finding CVEs affecting a specific product and version by CPE.
+ * @module src/mcp-server/tools/definitions/nvd-audit-cpe
+ */
+import { z } from '@cyanheads/mcp-ts-core';
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+export declare const nvdAuditCpe: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
+    cpeName: z.ZodOptional<z.ZodString>;
+    virtualMatchString: z.ZodOptional<z.ZodString>;
+    versionStart: z.ZodOptional<z.ZodString>;
+    versionStartType: z.ZodDefault<z.ZodEnum<{
+        including: "including";
+        excluding: "excluding";
+    }>>;
+    versionEnd: z.ZodOptional<z.ZodString>;
+    versionEndType: z.ZodDefault<z.ZodEnum<{
+        including: "including";
+        excluding: "excluding";
+    }>>;
+    severityMin: z.ZodOptional<z.ZodEnum<{
+        LOW: "LOW";
+        MEDIUM: "MEDIUM";
+        HIGH: "HIGH";
+        CRITICAL: "CRITICAL";
+    }>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    cves: z.ZodArray<z.ZodObject<{
+        cveId: z.ZodString;
+        vulnStatus: z.ZodString;
+        published: z.ZodString;
+        lastModified: z.ZodString;
+        descriptions: z.ZodArray<z.ZodObject<{
+            lang: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strip>>;
+        cvssScores: z.ZodArray<z.ZodObject<{
+            version: z.ZodString;
+            sourceType: z.ZodString;
+            baseScore: z.ZodNumber;
+            severity: z.ZodString;
+            vectorString: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        severity: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+            score: z.ZodNumber;
+            fromVersion: z.ZodString;
+        }, z.core.$strip>>;
+        weaknesses: z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            cweIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        configurations: z.ZodArray<z.ZodObject<{
+            nodes: z.ZodArray<z.ZodObject<{
+                operator: z.ZodOptional<z.ZodString>;
+                cpeMatch: z.ZodArray<z.ZodObject<{
+                    vulnerable: z.ZodBoolean;
+                    criteria: z.ZodString;
+                    versionStartIncluding: z.ZodOptional<z.ZodString>;
+                    versionStartExcluding: z.ZodOptional<z.ZodString>;
+                    versionEndIncluding: z.ZodOptional<z.ZodString>;
+                    versionEndExcluding: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        references: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            url: z.ZodString;
+            source: z.ZodOptional<z.ZodString>;
+            tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
+        cisaKev: z.ZodOptional<z.ZodObject<{
+            exploitAddDate: z.ZodString;
+            actionDueDate: z.ZodString;
+            requiredAction: z.ZodString;
+            vulnerabilityName: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    queryMeta: z.ZodObject<{
+        totalResults: z.ZodNumber;
+        returned: z.ZodNumber;
+        cpeName: z.ZodOptional<z.ZodString>;
+        virtualMatchString: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>, readonly [{
+    readonly reason: "missing_cpe_input";
+    readonly code: JsonRpcErrorCode.InvalidParams;
+    readonly when: "Neither cpeName nor virtualMatchString was provided.";
+    readonly recovery: "Provide either cpeName (exact CPEv2.3 string) or virtualMatchString (partial match pattern) — use nvd_search_cpes to find the correct CPE.";
+}, {
+    readonly reason: "conflicting_cpe_inputs";
+    readonly code: JsonRpcErrorCode.InvalidParams;
+    readonly when: "Both cpeName and virtualMatchString were provided simultaneously.";
+    readonly recovery: "Provide only one of cpeName or virtualMatchString per call, not both.";
+}, {
+    readonly reason: "version_range_without_match_string";
+    readonly code: JsonRpcErrorCode.InvalidParams;
+    readonly when: "versionStart or versionEnd was provided without virtualMatchString.";
+    readonly recovery: "Version range parameters require virtualMatchString; provide that parameter or use cpeName for exact-version queries.";
+}, {
+    readonly reason: "invalid_cpe_format";
+    readonly code: JsonRpcErrorCode.InvalidParams;
+    readonly when: "cpeName or virtualMatchString does not start with \"cpe:2.3:\" — not a valid CPEv2.3 string.";
+    readonly recovery: "Provide a valid CPEv2.3 string starting with \"cpe:2.3:\". Use nvd_search_cpes to find the correct CPE name.";
+}, {
+    readonly reason: "cpe_not_found";
+    readonly code: JsonRpcErrorCode.NotFound;
+    readonly when: "The cpeName is valid format but NVD returns no matching CVEs — the CPE may be misspelled or absent from NVD.";
+    readonly recovery: "Use nvd_search_cpes to verify the exact CPE name exists in the NVD dictionary before auditing.";
+}, {
+    readonly reason: "rate_limited";
+    readonly code: JsonRpcErrorCode.ServiceUnavailable;
+    readonly when: "NVD returned HTTP 403 indicating the rate limit was exceeded.";
+    readonly retryable: true;
+    readonly recovery: "Wait for the NVD rate window to reset or set the NVD_API_KEY environment variable for higher limits.";
+}]>;
+//# sourceMappingURL=nvd-audit-cpe.tool.d.ts.map

package/dist/mcp-server/tools/definitions/nvd-audit-cpe.tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-audit-cpe.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/nvd-audit-cpe.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AA2HjE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoRtB,CAAC"}