@cyanheads/nist-nvd-mcp-server 0.1.3

package/dist/mcp-server/tools/definitions/nvd-audit-cpe.tool.js

@@ -0,0 +1,329 @@
+/**
+ * @fileoverview Tool for finding CVEs affecting a specific product and version by CPE.
+ * @module src/mcp-server/tools/definitions/nvd-audit-cpe
+ */
+import { tool, z } from '@cyanheads/mcp-ts-core';
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+import { getNvdCveService } from '../../../services/nvd-cve/nvd-cve-service.js';
+const CPE_V23_REGEX = /^cpe:2\.3:/i;
+const CvssScoreSchema = z.object({
+    version: z.string().describe('CVSS version (e.g., "2.0", "3.1", "4.0").'),
+    sourceType: z.string().describe('Score source: "Primary" = NVD, "Secondary" = CNA.'),
+    baseScore: z.number().describe('Base score (0.0–10.0).'),
+    severity: z.string().describe('Severity label: CRITICAL, HIGH, MEDIUM, or LOW.'),
+    vectorString: z.string().optional().describe('CVSS vector string.'),
+});
+const TopSeveritySchema = z.object({
+    label: z.string().describe('Highest severity label across all CVSS versions.'),
+    score: z.number().describe('Highest base score (0.0–10.0).'),
+    fromVersion: z.string().describe('Which CVSS version this top score came from.'),
+});
+const CveRecordSchema = z.object({
+    cveId: z.string().describe('CVE identifier (e.g., "CVE-2021-44228").'),
+    vulnStatus: z.string().describe('NVD analysis status.'),
+    published: z.string().describe('ISO 8601 publication datetime.'),
+    lastModified: z.string().describe('ISO 8601 last-modified datetime.'),
+    descriptions: z
+        .array(z
+        .object({
+        lang: z.string().describe('Language code.'),
+        value: z.string().describe('CVE description.'),
+    })
+        .describe('One localized CVE description.'))
+        .describe('CVE descriptions by language.'),
+    cvssScores: z
+        .array(CvssScoreSchema.describe('One CVSS score entry.'))
+        .describe('All available CVSS scores across versions.'),
+    severity: TopSeveritySchema.optional().describe('Top severity. Absent if no CVSS scores present.'),
+    weaknesses: z
+        .array(z
+        .object({
+        source: z.string().describe('Weakness source (NVD or CNA).'),
+        cweIds: z
+            .array(z.string().describe('One CWE identifier.'))
+            .describe('CWE identifiers for this source.'),
+    })
+        .describe('One weakness classification entry.'))
+        .describe('CWE weakness classifications.'),
+    configurations: z
+        .array(z
+        .object({
+        nodes: z
+            .array(z
+            .object({
+            operator: z.string().optional().describe('Logical operator (AND/OR).'),
+            cpeMatch: z
+                .array(z
+                .object({
+                vulnerable: z
+                    .boolean()
+                    .describe('Whether this CPE is the vulnerable component.'),
+                criteria: z.string().describe('CPEv2.3 match criteria string.'),
+                versionStartIncluding: z
+                    .string()
+                    .optional()
+                    .describe('Inclusive lower version bound.'),
+                versionStartExcluding: z
+                    .string()
+                    .optional()
+                    .describe('Exclusive lower version bound.'),
+                versionEndIncluding: z
+                    .string()
+                    .optional()
+                    .describe('Inclusive upper version bound.'),
+                versionEndExcluding: z
+                    .string()
+                    .optional()
+                    .describe('Exclusive upper version bound.'),
+            })
+                .describe('One CPE match criterion.'))
+                .describe('CPE match criteria for this node.'),
+        })
+            .describe('One configuration node with its CPE match criteria.'))
+            .describe('Configuration nodes.'),
+    })
+        .describe('One affected product configuration group.'))
+        .describe('Affected product configurations.'),
+    references: z
+        .array(z
+        .object({
+        url: z.string().describe('Reference URL.'),
+        source: z.string().optional().describe('Reference source.'),
+        tags: z
+            .array(z.string().describe('One classification tag.'))
+            .optional()
+            .describe('Classification tags.'),
+    })
+        .describe('One external reference.'))
+        .optional()
+        .describe('External references.'),
+    cisaKev: z
+        .object({
+        exploitAddDate: z.string().describe('Date added to CISA KEV catalog.'),
+        actionDueDate: z.string().describe('Federal agency remediation deadline.'),
+        requiredAction: z.string().describe('Required remediation steps.'),
+        vulnerabilityName: z.string().describe("CISA's vulnerability name."),
+    })
+        .optional()
+        .describe('CISA KEV fields. Present only when CVE is in the KEV catalog.'),
+});
+export const nvdAuditCpe = tool('nvd_audit_cpe', {
+    title: 'Audit CPE for Vulnerabilities',
+    description: 'Find all CVEs affecting a specific product and version using CPE (Common Platform Enumeration). ' +
+        'Requires either an exact CPE name (cpeName) or a partial match string (virtualMatchString) with optional version range bounds. ' +
+        'With cpeName, NVD scopes results to configurations where the product is directly vulnerable, not merely referenced as a dependency. ' +
+        'Use nvd_search_cpes first to resolve the correct CPE string for a product. ' +
+        'Returns full CVE records.',
+    annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
+    input: z.object({
+        cpeName: z
+            .string()
+            .optional()
+            .describe('Full CPEv2.3 name (e.g., "cpe:2.3:a:apache:http_server:2.4.51:*:*:*:*:*:*:*"). ' +
+            'NVD adds isVulnerable automatically. Mutually exclusive with virtualMatchString.'),
+        virtualMatchString: z
+            .string()
+            .optional()
+            .describe('Partial CPE match pattern (e.g., "cpe:2.3:a:apache:http_server:*"). ' +
+            'Use with versionStart/versionEnd for version range audits. Mutually exclusive with cpeName.'),
+        versionStart: z
+            .string()
+            .optional()
+            .describe('Lower version bound. Requires virtualMatchString.'),
+        versionStartType: z
+            .enum(['including', 'excluding'])
+            .default('including')
+            .describe('Whether the lower version bound is inclusive or exclusive.'),
+        versionEnd: z.string().optional().describe('Upper version bound. Requires virtualMatchString.'),
+        versionEndType: z
+            .enum(['including', 'excluding'])
+            .default('including')
+            .describe('Whether the upper version bound is inclusive or exclusive.'),
+        severityMin: z
+            .enum(['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'])
+            .optional()
+            .describe('Filter out CVEs below this severity level.'),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(2000)
+            .default(20)
+            .describe('Maximum number of CVEs to return (default 20, max 2000).'),
+    }),
+    output: z.object({
+        cves: z
+            .array(CveRecordSchema.describe('Full CVE record for one vulnerability affecting the product.'))
+            .describe('Full CVE records for CVEs affecting the specified product.'),
+        queryMeta: z
+            .object({
+            totalResults: z.number().describe('Total CVEs matched before pagination.'),
+            returned: z.number().describe('Number of CVE records returned.'),
+            cpeName: z
+                .string()
+                .optional()
+                .describe('The exact CPE name used in the query, if provided.'),
+            virtualMatchString: z
+                .string()
+                .optional()
+                .describe('The virtual match string used, if provided.'),
+        })
+            .describe('Query metadata echoing the CPE identifier and match counts for the audit.'),
+    }),
+    errors: [
+        {
+            reason: 'missing_cpe_input',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'Neither cpeName nor virtualMatchString was provided.',
+            recovery: 'Provide either cpeName (exact CPEv2.3 string) or virtualMatchString (partial match pattern) — use nvd_search_cpes to find the correct CPE.',
+        },
+        {
+            reason: 'conflicting_cpe_inputs',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'Both cpeName and virtualMatchString were provided simultaneously.',
+            recovery: 'Provide only one of cpeName or virtualMatchString per call, not both.',
+        },
+        {
+            reason: 'version_range_without_match_string',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'versionStart or versionEnd was provided without virtualMatchString.',
+            recovery: 'Version range parameters require virtualMatchString; provide that parameter or use cpeName for exact-version queries.',
+        },
+        {
+            reason: 'invalid_cpe_format',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'cpeName or virtualMatchString does not start with "cpe:2.3:" — not a valid CPEv2.3 string.',
+            recovery: 'Provide a valid CPEv2.3 string starting with "cpe:2.3:". Use nvd_search_cpes to find the correct CPE name.',
+        },
+        {
+            reason: 'cpe_not_found',
+            code: JsonRpcErrorCode.NotFound,
+            when: 'The cpeName is valid format but NVD returns no matching CVEs — the CPE may be misspelled or absent from NVD.',
+            recovery: 'Use nvd_search_cpes to verify the exact CPE name exists in the NVD dictionary before auditing.',
+        },
+        {
+            reason: 'rate_limited',
+            code: JsonRpcErrorCode.ServiceUnavailable,
+            when: 'NVD returned HTTP 403 indicating the rate limit was exceeded.',
+            retryable: true,
+            recovery: 'Wait for the NVD rate window to reset or set the NVD_API_KEY environment variable for higher limits.',
+        },
+    ],
+    async handler(input, ctx) {
+        // Validate inputs
+        if (!input.cpeName && !input.virtualMatchString) {
+            throw ctx.fail('missing_cpe_input', 'Either cpeName or virtualMatchString is required.', ctx.recoveryFor('missing_cpe_input'));
+        }
+        if (input.cpeName && input.virtualMatchString) {
+            throw ctx.fail('conflicting_cpe_inputs', 'Provide only one of cpeName or virtualMatchString, not both.', ctx.recoveryFor('conflicting_cpe_inputs'));
+        }
+        if ((input.versionStart || input.versionEnd) && !input.virtualMatchString) {
+            throw ctx.fail('version_range_without_match_string', 'versionStart/versionEnd require virtualMatchString.', ctx.recoveryFor('version_range_without_match_string'));
+        }
+        if (input.cpeName && !CPE_V23_REGEX.test(input.cpeName)) {
+            throw ctx.fail('invalid_cpe_format', `Invalid CPE name: "${input.cpeName}". CPEv2.3 names must start with "cpe:2.3:".`, ctx.recoveryFor('invalid_cpe_format'));
+        }
+        if (input.virtualMatchString && !CPE_V23_REGEX.test(input.virtualMatchString)) {
+            throw ctx.fail('invalid_cpe_format', `Invalid CPE string: "${input.virtualMatchString}". CPEv2.3 strings must start with "cpe:2.3:".`, ctx.recoveryFor('invalid_cpe_format'));
+        }
+        ctx.log.info('Auditing CPE for vulnerabilities', {
+            cpeName: input.cpeName,
+            virtualMatchString: input.virtualMatchString,
+            limit: input.limit,
+        });
+        const service = getNvdCveService();
+        const result = await service.auditCpe({
+            ...(input.cpeName && { cpeName: input.cpeName }),
+            ...(input.virtualMatchString && { virtualMatchString: input.virtualMatchString }),
+            ...(input.versionStart && { versionStart: input.versionStart }),
+            versionStartType: input.versionStartType,
+            ...(input.versionEnd && { versionEnd: input.versionEnd }),
+            versionEndType: input.versionEndType,
+            ...(input.severityMin && { severityMin: input.severityMin }),
+            limit: input.limit,
+        }, ctx);
+        return {
+            cves: result.cves,
+            queryMeta: {
+                totalResults: result.totalResults,
+                returned: result.returned,
+                ...(result.cpeName && { cpeName: result.cpeName }),
+                ...(result.virtualMatchString && { virtualMatchString: result.virtualMatchString }),
+            },
+        };
+    },
+    format: (result) => {
+        const lines = [];
+        const cpeName = result.queryMeta.cpeName;
+        const virtualMatchString = result.queryMeta.virtualMatchString;
+        const target = cpeName ?? virtualMatchString ?? 'unknown CPE';
+        lines.push(`**CPE Audit:** ${target}`);
+        if (cpeName)
+            lines.push(`**CPE Name:** ${cpeName}`);
+        if (virtualMatchString)
+            lines.push(`**Virtual Match String:** ${virtualMatchString}`);
+        lines.push(`**Total CVEs:** ${result.queryMeta.totalResults} | **Returned:** ${result.queryMeta.returned}\n`);
+        if (result.cves.length === 0) {
+            lines.push('No CVEs found for this product. Verify the CPE name with nvd_search_cpes.');
+            return [{ type: 'text', text: lines.join('\n') }];
+        }
+        for (const cve of result.cves) {
+            lines.push(`## ${cve.cveId}`);
+            lines.push(`**Status:** ${cve.vulnStatus} | **Published:** ${cve.published} | **Last Modified:** ${cve.lastModified}`);
+            if (cve.severity) {
+                lines.push(`**Severity:** ${cve.severity.label} (${cve.severity.score}) from CVSS ${cve.severity.fromVersion}`);
+            }
+            else {
+                lines.push('**Severity:** Not available (no CVSS scores)');
+            }
+            if (cve.cvssScores && cve.cvssScores.length > 0) {
+                lines.push('**CVSS Scores:**');
+                for (const s of cve.cvssScores) {
+                    lines.push(`  - v${s.version} (${s.sourceType}): ${s.baseScore} ${s.severity}` +
+                        (s.vectorString ? ` — ${s.vectorString}` : ''));
+                }
+            }
+            if (cve.weaknesses && cve.weaknesses.length > 0) {
+                lines.push('**Weaknesses:**');
+                for (const w of cve.weaknesses) {
+                    if (w.cweIds.length > 0) {
+                        lines.push(`  - ${w.source}: ${w.cweIds.join(', ')}`);
+                    }
+                }
+            }
+            // Descriptions — render lang and value for all entries to satisfy format-parity
+            for (const desc of cve.descriptions) {
+                const truncated = desc.value.length > 300 ? `${desc.value.slice(0, 300)}…` : desc.value;
+                lines.push(`\n[${desc.lang}] ${truncated}`);
+            }
+            if (cve.cisaKev) {
+                lines.push(`\n**CISA KEV:** ${cve.cisaKev.vulnerabilityName}`);
+                lines.push(`  - Added: ${cve.cisaKev.exploitAddDate}`);
+                lines.push(`  - Action Due: ${cve.cisaKev.actionDueDate}`);
+                lines.push(`  - Required Action: ${cve.cisaKev.requiredAction}`);
+            }
+            if (cve.configurations && cve.configurations.length > 0) {
+                lines.push(`**Configurations:** ${cve.configurations.length} node group(s)`);
+                for (const cfg of cve.configurations) {
+                    for (const node of cfg.nodes) {
+                        if (node.operator)
+                            lines.push(`  - Operator: ${node.operator}`);
+                    }
+                }
+            }
+            if (cve.references && cve.references.length > 0) {
+                lines.push(`**References (${cve.references.length}):**`);
+                for (const ref of cve.references.slice(0, 5)) {
+                    const sourcePart = ref.source ? ` [${ref.source}]` : '';
+                    const tagPart = ref.tags?.length ? ` (${ref.tags.join(', ')})` : '';
+                    lines.push(`  - ${ref.url}${sourcePart}${tagPart}`);
+                }
+                if (cve.references.length > 5)
+                    lines.push(`  - … ${cve.references.length - 5} more`);
+            }
+            lines.push('');
+        }
+        return [{ type: 'text', text: lines.join('\n') }];
+    },
+});
+//# sourceMappingURL=nvd-audit-cpe.tool.js.map

package/dist/mcp-server/tools/definitions/nvd-audit-cpe.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-audit-cpe.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/nvd-audit-cpe.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;IACpF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CACjF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IACrE,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KAC/C,CAAC;SACD,QAAQ,CAAC,gCAAgC,CAAC,CAC9C;SACA,QAAQ,CAAC,+BAA+B,CAAC;IAC5C,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;SACxD,QAAQ,CAAC,4CAA4C,CAAC;IACzD,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC7C,iDAAiD,CAClD;IACD,UAAU,EAAE,CAAC;SACV,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC5D,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;aACjD,QAAQ,CAAC,kCAAkC,CAAC;KAChD,CAAC;SACD,QAAQ,CAAC,oCAAoC,CAAC,CAClD;SACA,QAAQ,CAAC,+BAA+B,CAAC;IAC5C,cAAc,EAAE,CAAC;SACd,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YACtE,QAAQ,EAAE,CAAC;iBACR,KAAK,CACJ,CAAC;iBACE,MAAM,CAAC;gBACN,UAAU,EAAE,CAAC;qBACV,OAAO,EAAE;qBACT,QAAQ,CAAC,+CAA+C,CAAC;gBAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;gBAC/D,qBAAqB,EAAE,CAAC;qBACrB,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,qBAAqB,EAAE,CAAC;qBACrB,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,mBAAmB,EAAE,CAAC;qBACnB,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,mBAAmB,EAAE,CAAC;qBACnB,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;aAC9C,CAAC;iBACD,QAAQ,CAAC,0BAA0B,CAAC,CACxC;iBACA,QAAQ,CAAC,mCAAmC,CAAC;SACjD,CAAC;aACD,QAAQ,CAAC,qDAAqD,CAAC,CACnE;aACA,QAAQ,CAAC,sBAAsB,CAAC;KACpC,CAAC;SACD,QAAQ,CAAC,2CAA2C,CAAC,CACzD;SACA,QAAQ,CAAC,kCAAkC,CAAC;IAC/C,UAAU,EAAE,CAAC;SACV,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC3D,IAAI,EAAE,CAAC;aACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;aACrD,QAAQ,EAAE;aACV,QAAQ,CAAC,sBAAsB,CAAC;KACpC,CAAC;SACD,QAAQ,CAAC,yBAAyB,CAAC,CACvC;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,sBAAsB,CAAC;IACnC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QACtE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QAC1E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAClE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACrE,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;CAC7E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE;IAC/C,KAAK,EAAE,+BAA+B;IACtC,WAAW,EACT,kGAAkG;QAClG,iIAAiI;QACjI,sIAAsI;QACtI,6EAA6E;QAC7E,2BAA2B;IAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,iFAAiF;YAC/E,kFAAkF,CACrF;QACH,kBAAkB,EAAE,CAAC;aAClB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE;YACpE,6FAA6F,CAChG;QACH,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,mDAAmD,CAAC;QAChE,gBAAgB,EAAE,CAAC;aAChB,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,CAAC,WAAW,CAAC;aACpB,QAAQ,CAAC,4DAA4D,CAAC;QACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC/F,cAAc,EAAE,CAAC;aACd,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,CAAC,WAAW,CAAC;aACpB,QAAQ,CAAC,4DAA4D,CAAC;QACzE,WAAW,EAAE,CAAC;aACX,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,4CAA4C,CAAC;QACzD,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,IAAI,CAAC;aACT,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CAAC,0DAA0D,CAAC;KACxE,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC;aACJ,KAAK,CACJ,eAAe,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CACzF;aACA,QAAQ,CAAC,4DAA4D,CAAC;QACzE,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;YAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YAChE,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,oDAAoD,CAAC;YACjE,kBAAkB,EAAE,CAAC;iBAClB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6CAA6C,CAAC;SAC3D,CAAC;aACD,QAAQ,CAAC,2EAA2E,CAAC;KACzF,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,sDAAsD;YAC5D,QAAQ,EACN,4IAA4I;SAC/I;QACD;YACE,MAAM,EAAE,wBAAwB;YAChC,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,mEAAmE;YACzE,QAAQ,EAAE,uEAAuE;SAClF;QACD;YACE,MAAM,EAAE,oCAAoC;YAC5C,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,qEAAqE;YAC3E,QAAQ,EACN,uHAAuH;SAC1H;QACD;YACE,MAAM,EAAE,oBAAoB;YAC5B,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,4FAA4F;YAClG,QAAQ,EACN,4GAA4G;SAC/G;QACD;YACE,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,8GAA8G;YACpH,QAAQ,EACN,gGAAgG;SACnG;QACD;YACE,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,gBAAgB,CAAC,kBAAkB;YACzC,IAAI,EAAE,+DAA+D;YACrE,SAAS,EAAE,IAAI;YACf,QAAQ,EACN,sGAAsG;SACzG;KACF;IAED,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,kBAAkB;QAClB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAChD,MAAM,GAAG,CAAC,IAAI,CACZ,mBAAmB,EACnB,mDAAmD,EACnD,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAC,IAAI,CACZ,wBAAwB,EACxB,8DAA8D,EAC9D,GAAG,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC,IAAI,CACZ,oCAAoC,EACpC,qDAAqD,EACrD,GAAG,CAAC,WAAW,CAAC,oCAAoC,CAAC,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,CAAC,IAAI,CACZ,oBAAoB,EACpB,sBAAsB,KAAK,CAAC,OAAO,8CAA8C,EACjF,GAAG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9E,MAAM,GAAG,CAAC,IAAI,CACZ,oBAAoB,EACpB,wBAAwB,KAAK,CAAC,kBAAkB,gDAAgD,EAChG,GAAG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CACtC,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CACnC;YACE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACjF,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC/D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACzD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,EACD,GAAG,CACJ,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC;aACpF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACzC,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,IAAI,kBAAkB,IAAI,aAAa,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACpD,IAAI,kBAAkB;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,kBAAkB,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,IAAI,CACR,mBAAmB,MAAM,CAAC,SAAS,CAAC,YAAY,oBAAoB,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,CAClG,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACxF,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,eAAe,GAAG,CAAC,UAAU,qBAAqB,GAAG,CAAC,SAAS,yBAAyB,GAAG,CAAC,YAAY,EAAE,CAC3G,CAAC;YAEF,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,iBAAiB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,eAAe,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CACpG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC7D,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAC/B,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE;wBACjE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAC/B,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,gFAAgF;YAChF,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,cAAc,CAAC,MAAM,gBAAgB,CAAC,CAAC;gBAC7E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;oBACrC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;wBAC7B,IAAI,IAAI,CAAC,QAAQ;4BAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,CAAC;gBACzD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,GAAG,UAAU,GAAG,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC;gBACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;YACvF,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/tools/definitions/nvd-get-cve-history.tool.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Tool for retrieving the change history of a CVE from the NIST NVD API.
+ * @module src/mcp-server/tools/definitions/nvd-get-cve-history
+ */
+import { z } from '@cyanheads/mcp-ts-core';
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+export declare const nvdGetCveHistory: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
+    cveId: z.ZodString;
+    limit: z.ZodDefault<z.ZodNumber>;
+    offset: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    cveId: z.ZodString;
+    changes: z.ZodArray<z.ZodObject<{
+        changeDate: z.ZodString;
+        eventName: z.ZodOptional<z.ZodString>;
+        details: z.ZodArray<z.ZodObject<{
+            action: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+            oldValue: z.ZodOptional<z.ZodString>;
+            newValue: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    queryMeta: z.ZodObject<{
+        totalResults: z.ZodNumber;
+        returned: z.ZodNumber;
+        offset: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>, readonly [{
+    readonly reason: "invalid_cve_id_format";
+    readonly code: JsonRpcErrorCode.InvalidParams;
+    readonly when: "The CVE ID fails format validation (NVD returns HTTP 404 for malformed IDs).";
+    readonly recovery: "Use the format CVE-YYYY-NNNNN (e.g., CVE-2021-44228) and verify the ID is correct.";
+}, {
+    readonly reason: "cve_not_found";
+    readonly code: JsonRpcErrorCode.NotFound;
+    readonly when: "The CVE exists in NVD but has no recorded history events, or the CVE ID does not exist.";
+    readonly recovery: "Confirm the CVE ID exists in NVD using nvd_get_cve; newly published CVEs may have no history yet.";
+}, {
+    readonly reason: "rate_limited";
+    readonly code: JsonRpcErrorCode.ServiceUnavailable;
+    readonly when: "NVD returned HTTP 403 indicating the rate limit was exceeded.";
+    readonly retryable: true;
+    readonly recovery: "Wait for the NVD rate window to reset or set the NVD_API_KEY environment variable for higher limits.";
+}]>;
+//# sourceMappingURL=nvd-get-cve-history.tool.d.ts.map

package/dist/mcp-server/tools/definitions/nvd-get-cve-history.tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-get-cve-history.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/nvd-get-cve-history.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiJ3B,CAAC"}

package/dist/mcp-server/tools/definitions/nvd-get-cve-history.tool.js

@@ -0,0 +1,132 @@
+/**
+ * @fileoverview Tool for retrieving the change history of a CVE from the NIST NVD API.
+ * @module src/mcp-server/tools/definitions/nvd-get-cve-history
+ */
+import { tool, z } from '@cyanheads/mcp-ts-core';
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+import { getNvdCveService } from '../../../services/nvd-cve/nvd-cve-service.js';
+export const nvdGetCveHistory = tool('nvd_get_cve_history', {
+    title: 'Get CVE Change History',
+    description: 'Retrieve the change history for a single CVE — CVSS score revisions, reference additions, ' +
+        'status transitions (e.g., "Received" → "Analyzed"), and CPE configuration updates. ' +
+        "Use when tracking a CVE's escalation or investigating when a score changed. " +
+        'For the current record, call nvd_get_cve instead. ' +
+        'The NVD history endpoint is significantly slower than other NVD endpoints, especially without an API key — set NVD_API_KEY for reliable operation.',
+    annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
+    input: z.object({
+        cveId: z.string().describe('CVE identifier to retrieve history for (e.g., "CVE-2021-44228").'),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(2000)
+            .default(20)
+            .describe('Maximum number of change events to return (default 20, max 2000).'),
+        offset: z
+            .number()
+            .int()
+            .min(0)
+            .default(0)
+            .describe('Zero-based offset for paginating through change events.'),
+    }),
+    output: z.object({
+        cveId: z.string().describe('The CVE ID for which history was retrieved.'),
+        changes: z
+            .array(z
+            .object({
+            changeDate: z.string().describe('ISO 8601 datetime when this change occurred.'),
+            eventName: z
+                .string()
+                .optional()
+                .describe('Name of the change event (e.g., "CVE Modified", "Initial Analysis").'),
+            details: z
+                .array(z
+                .object({
+                action: z
+                    .string()
+                    .optional()
+                    .describe('The action taken (e.g., "Added", "Changed", "Removed").'),
+                type: z
+                    .string()
+                    .optional()
+                    .describe('The type of data changed (e.g., "CVSS V3.1", "CWE", "Reference").'),
+                oldValue: z.string().optional().describe('The value before the change.'),
+                newValue: z.string().optional().describe('The value after the change.'),
+            })
+                .describe('One field-level change within this event.'))
+                .describe('Individual change detail entries within this event.'),
+        })
+            .describe('One CVE change event with its field-level details.'))
+            .describe('CVE change events in reverse-chronological order.'),
+        queryMeta: z
+            .object({
+            totalResults: z.number().describe('Total change events on record for this CVE.'),
+            returned: z.number().describe('Number of change events returned in this response.'),
+            offset: z.number().describe('Page offset used in this query.'),
+        })
+            .describe('Pagination metadata.'),
+    }),
+    errors: [
+        {
+            reason: 'invalid_cve_id_format',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'The CVE ID fails format validation (NVD returns HTTP 404 for malformed IDs).',
+            recovery: 'Use the format CVE-YYYY-NNNNN (e.g., CVE-2021-44228) and verify the ID is correct.',
+        },
+        {
+            reason: 'cve_not_found',
+            code: JsonRpcErrorCode.NotFound,
+            when: 'The CVE exists in NVD but has no recorded history events, or the CVE ID does not exist.',
+            recovery: 'Confirm the CVE ID exists in NVD using nvd_get_cve; newly published CVEs may have no history yet.',
+        },
+        {
+            reason: 'rate_limited',
+            code: JsonRpcErrorCode.ServiceUnavailable,
+            when: 'NVD returned HTTP 403 indicating the rate limit was exceeded.',
+            retryable: true,
+            recovery: 'Wait for the NVD rate window to reset or set the NVD_API_KEY environment variable for higher limits.',
+        },
+    ],
+    async handler(input, ctx) {
+        ctx.log.info('Fetching CVE history', { cveId: input.cveId, limit: input.limit });
+        const service = getNvdCveService();
+        const result = await service.getCveHistory(input.cveId, input.limit, input.offset, ctx);
+        if (result.changes.length === 0) {
+            throw ctx.fail('cve_not_found', `No change history found for ${result.cveId}.`, {
+                ...ctx.recoveryFor('cve_not_found'),
+                cveId: result.cveId,
+            });
+        }
+        return {
+            cveId: result.cveId,
+            changes: result.changes,
+            queryMeta: {
+                totalResults: result.totalResults,
+                returned: result.returned,
+                offset: result.offset,
+            },
+        };
+    },
+    format: (result) => {
+        const lines = [];
+        lines.push(`## Change History: ${result.cveId}`);
+        lines.push(`**Total Events:** ${result.queryMeta.totalResults} | ` +
+            `**Showing:** ${result.queryMeta.returned} (offset ${result.queryMeta.offset})\n`);
+        for (const change of result.changes) {
+            lines.push(`### ${change.eventName ?? 'Change'} — ${change.changeDate}`);
+            for (const detail of change.details) {
+                const action = detail.action ?? '';
+                const type = detail.type ?? '';
+                const label = [action, type].filter(Boolean).join(' — ');
+                lines.push(`- **${label || 'Update'}**`);
+                if (detail.oldValue)
+                    lines.push(`  - Before: ${detail.oldValue}`);
+                if (detail.newValue)
+                    lines.push(`  - After: ${detail.newValue}`);
+            }
+            lines.push('');
+        }
+        return [{ type: 'text', text: lines.join('\n') }];
+    },
+});
+//# sourceMappingURL=nvd-get-cve-history.tool.js.map

package/dist/mcp-server/tools/definitions/nvd-get-cve-history.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-get-cve-history.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/nvd-get-cve-history.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,EAAE;IAC1D,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EACT,4FAA4F;QAC5F,qFAAqF;QACrF,8EAA8E;QAC9E,oDAAoD;QACpD,oJAAoJ;IACtJ,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;IAE/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;QAC9F,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,IAAI,CAAC;aACT,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CAAC,mEAAmE,CAAC;QAChF,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CAAC,yDAAyD,CAAC;KACvE,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QACzE,OAAO,EAAE,CAAC;aACP,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YAC/E,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,sEAAsE,CAAC;YACnF,OAAO,EAAE,CAAC;iBACP,KAAK,CACJ,CAAC;iBACE,MAAM,CAAC;gBACN,MAAM,EAAE,CAAC;qBACN,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,yDAAyD,CAAC;gBACtE,IAAI,EAAE,CAAC;qBACJ,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CACP,mEAAmE,CACpE;gBACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;aACxE,CAAC;iBACD,QAAQ,CAAC,2CAA2C,CAAC,CACzD;iBACA,QAAQ,CAAC,qDAAqD,CAAC;SACnE,CAAC;aACD,QAAQ,CAAC,oDAAoD,CAAC,CAClE;aACA,QAAQ,CAAC,mDAAmD,CAAC;QAChE,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;YACnF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;SAC/D,CAAC;aACD,QAAQ,CAAC,sBAAsB,CAAC;KACpC,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,8EAA8E;YACpF,QAAQ,EACN,oFAAoF;SACvF;QACD;YACE,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,IAAI,EAAE,yFAAyF;YAC/F,QAAQ,EACN,mGAAmG;SACtG;QACD;YACE,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,gBAAgB,CAAC,kBAAkB;YACzC,IAAI,EAAE,+DAA+D;YACrE,SAAS,EAAE,IAAI;YACf,QAAQ,EACN,sGAAsG;SACzG;KACF;IAED,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAEjF,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAExF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,+BAA+B,MAAM,CAAC,KAAK,GAAG,EAAE;gBAC9E,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CACR,qBAAqB,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK;YACrD,gBAAgB,MAAM,CAAC,SAAS,CAAC,QAAQ,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CACpF,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAEzE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,QAAQ,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAClE,IAAI,MAAM,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/tools/definitions/nvd-get-cve.tool.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @fileoverview Tool for fetching one or more CVEs by ID from the NIST NVD API.
+ * @module src/mcp-server/tools/definitions/nvd-get-cve
+ */
+import { z } from '@cyanheads/mcp-ts-core';
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+export declare const nvdGetCve: import("@cyanheads/mcp-ts-core").ToolDefinition<z.ZodObject<{
+    cveIds: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    brief: z.ZodDefault<z.ZodBoolean>;
+    includeReferences: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    brief: z.ZodBoolean;
+    cves: z.ZodArray<z.ZodObject<{}, z.core.$loose>>;
+    queryMeta: z.ZodObject<{
+        requested: z.ZodNumber;
+        returned: z.ZodNumber;
+        missingIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, readonly [{
+    readonly reason: "invalid_cve_id_format";
+    readonly code: JsonRpcErrorCode.InvalidParams;
+    readonly when: "One or more CVE IDs fail format validation (NVD returns HTTP 404 for malformed IDs).";
+    readonly recovery: "Use the format CVE-YYYY-NNNNN (e.g., CVE-2021-44228) and verify each ID.";
+}, {
+    readonly reason: "cve_not_found";
+    readonly code: JsonRpcErrorCode.NotFound;
+    readonly when: "A valid-format CVE ID returns no results — the ID is well-formed but does not exist in NVD.";
+    readonly recovery: "Verify the CVE ID is correct; use nvd_search_cves to search by keyword or date.";
+}, {
+    readonly reason: "rate_limited";
+    readonly code: JsonRpcErrorCode.ServiceUnavailable;
+    readonly when: "NVD returned HTTP 403 indicating the rate limit was exceeded.";
+    readonly retryable: true;
+    readonly recovery: "Wait for the NVD rate window to reset or set the NVD_API_KEY environment variable for higher limits.";
+}]>;
+//# sourceMappingURL=nvd-get-cve.tool.d.ts.map

package/dist/mcp-server/tools/definitions/nvd-get-cve.tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-get-cve.tool.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/nvd-get-cve.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAIjE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiNpB,CAAC"}