@cyanheads/nist-nvd-mcp-server 0.1.3

package/dist/mcp-server/tools/definitions/nvd-search-cves.tool.js

@@ -0,0 +1,342 @@
+/**
+ * @fileoverview Tool for searching CVEs by keyword, severity, CWE, date range, or KEV status.
+ * @module src/mcp-server/tools/definitions/nvd-search-cves
+ */
+import { tool, z } from '@cyanheads/mcp-ts-core';
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+import { getNvdCveService } from '../../../services/nvd-cve/nvd-cve-service.js';
+const MAX_DATE_RANGE_DAYS = 120;
+/** Returns the date N days ago from now as ISO 8601 string (milliseconds zeroed, UTC). */
+function daysAgo(days) {
+    const d = new Date();
+    d.setDate(d.getDate() - days);
+    return d.toISOString().replace(/\.\d{3}Z$/, '.000Z');
+}
+/** Returns the current datetime as ISO 8601 string (milliseconds zeroed, UTC). */
+function nowIso() {
+    return new Date().toISOString().replace(/\.\d{3}Z$/, '.000Z');
+}
+const BriefCveRecordSchema = z.object({
+    cveId: z.string().describe('CVE identifier (e.g., "CVE-2021-44228").'),
+    vulnStatus: z.string().describe('NVD analysis status.'),
+    published: z.string().describe('ISO 8601 publication datetime.'),
+    severity: z
+        .object({
+        label: z.string().describe('Highest severity label across all CVSS versions.'),
+        score: z.number().describe('Highest base score (0.0–10.0).'),
+        fromVersion: z.string().describe('CVSS version this score came from.'),
+    })
+        .optional()
+        .describe('Top severity. Absent if no CVSS scores are present.'),
+    cisaVulnerabilityName: z
+        .string()
+        .optional()
+        .describe('CISA KEV vulnerability name. Present only when in the KEV catalog.'),
+});
+export const nvdSearchCves = tool('nvd_search_cves', {
+    title: 'Search CVEs',
+    description: 'Search CVEs by keyword, severity, CWE, date range, or CISA KEV status. ' +
+        'The primary discovery tool for vulnerability surveillance and triage workflows. ' +
+        'pubDays and lastModDays are convenience shorthands that expand to date pairs; values over 120 days are clamped to the NVD maximum and reported in queryMeta. ' +
+        'Returns brief summaries — call nvd_get_cve for full detail on specific IDs. ' +
+        'At least one filter is recommended; omitting all filters returns CVEs in default NVD index order (oldest first by CVE ID).',
+    annotations: { readOnlyHint: true, openWorldHint: false },
+    input: z.object({
+        keyword: z
+            .string()
+            .optional()
+            .describe('Full-text search across CVE descriptions (AND-semantics across words).'),
+        severity: z
+            .enum(['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'])
+            .optional()
+            .describe('Filter to CVEs at this CVSS severity level or above.'),
+        severityVersion: z
+            .enum(['v2', 'v3', 'v4'])
+            .default('v3')
+            .describe('CVSS version to use for the severity filter. Default: v3 (maps to cvssV3Severity).'),
+        cweId: z
+            .string()
+            .optional()
+            .describe('Filter by CWE weakness ID (e.g., "CWE-79", "NVD-CWE-Other").'),
+        pubDays: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe('CVEs published in the last N days (max 120; values over 120 are clamped). ' +
+            'Mutually exclusive with pubStartDate/pubEndDate.'),
+        lastModDays: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe('CVEs last modified in the last N days (max 120; values over 120 are clamped). ' +
+            'Mutually exclusive with lastModStartDate/lastModEndDate.'),
+        pubStartDate: z
+            .string()
+            .optional()
+            .describe('ISO 8601 datetime for publication range start. Both pubStartDate and pubEndDate required together. ' +
+            'Mutually exclusive with pubDays.'),
+        pubEndDate: z
+            .string()
+            .optional()
+            .describe('ISO 8601 datetime for publication range end. Both pubStartDate and pubEndDate required together.'),
+        lastModStartDate: z
+            .string()
+            .optional()
+            .describe('ISO 8601 datetime for last-modified range start. Both required together. Mutually exclusive with lastModDays.'),
+        lastModEndDate: z
+            .string()
+            .optional()
+            .describe('ISO 8601 datetime for last-modified range end. Both required together.'),
+        kevOnly: z
+            .boolean()
+            .default(false)
+            .describe('When true, filters results to CVEs in the CISA Known Exploited Vulnerabilities catalog.'),
+        noRejected: z
+            .boolean()
+            .default(true)
+            .describe('When true (default), excludes CVEs with REJECT/Rejected status.'),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(2000)
+            .default(20)
+            .describe('Maximum number of results to return (default 20, max 2000).'),
+        offset: z.number().int().min(0).default(0).describe('Zero-based page offset for pagination.'),
+    }),
+    output: z.object({
+        cves: z
+            .array(BriefCveRecordSchema.describe('Brief summary for one matching CVE.'))
+            .describe('Matching CVE summaries. Call nvd_get_cve for full detail on specific IDs.'),
+        queryMeta: z
+            .object({
+            totalResults: z.number().describe('Total matching CVEs in NVD before pagination.'),
+            returned: z.number().describe('Number of CVEs returned in this response.'),
+            offset: z.number().describe('Page offset used in this query.'),
+            datesClamped: z
+                .array(z
+                .object({
+                param: z
+                    .string()
+                    .describe('The parameter that was clamped (pubDays or lastModDays).'),
+                original: z.number().describe('The original value supplied.'),
+                clamped: z.number().describe('The clamped value used (max 120).'),
+            })
+                .describe('A single clamping event for one convenience date parameter.'))
+                .optional()
+                .describe('Entries for any pubDays/lastModDays values that exceeded 120 and were auto-clamped. ' +
+                'Absent when no clamping occurred.'),
+        })
+            .describe('Query execution metadata including total count and any date clamping applied.'),
+    }),
+    errors: [
+        {
+            reason: 'mutually_exclusive_params',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'Both pubDays and pubStartDate/pubEndDate provided, or both lastModDays and lastModStartDate/lastModEndDate.',
+            recovery: 'Use either the convenience shorthand (pubDays) or the explicit date range (pubStartDate + pubEndDate), not both.',
+        },
+        {
+            reason: 'missing_date_pair',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'Only one of pubStartDate/pubEndDate (or lastModStartDate/lastModEndDate) was provided — NVD requires both.',
+            recovery: 'Provide both the start and end date, or use pubDays/lastModDays instead of an explicit date range.',
+        },
+        {
+            reason: 'date_range_inverted',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'The end date is before the start date.',
+            recovery: 'Ensure the end date is after the start date.',
+        },
+        {
+            reason: 'date_range_exceeds_max',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'Explicit pubStartDate/pubEndDate or lastModStartDate/lastModEndDate span more than 120 days.',
+            recovery: 'Narrow the date range to 120 days or fewer, or use multiple paginated queries.',
+        },
+        {
+            reason: 'invalid_date_format',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'A date string provided for pubStartDate, pubEndDate, lastModStartDate, or lastModEndDate is not a valid ISO 8601 datetime.',
+            recovery: 'Use ISO 8601 format, e.g. 2024-01-01T00:00:00.000Z.',
+        },
+        {
+            reason: 'invalid_severity_for_version',
+            code: JsonRpcErrorCode.InvalidParams,
+            when: 'severity="CRITICAL" was specified with severityVersion="v2" — CVSS v2 has no CRITICAL tier.',
+            recovery: 'Use LOW, MEDIUM, or HIGH when severityVersion is "v2". Use v3 or v4 for CRITICAL.',
+        },
+        {
+            reason: 'rate_limited',
+            code: JsonRpcErrorCode.ServiceUnavailable,
+            when: 'NVD returned HTTP 403 indicating the rate limit was exceeded.',
+            retryable: true,
+            recovery: 'Wait for the NVD rate window to reset or set the NVD_API_KEY environment variable for higher limits.',
+        },
+    ],
+    async handler(input, ctx) {
+        ctx.log.info('Searching CVEs', {
+            keyword: input.keyword,
+            severity: input.severity,
+            kevOnly: input.kevOnly,
+            limit: input.limit,
+        });
+        // Validate mutual exclusivity
+        if (input.pubDays !== undefined && (input.pubStartDate || input.pubEndDate)) {
+            throw ctx.fail('mutually_exclusive_params', 'pubDays and pubStartDate/pubEndDate are mutually exclusive.', ctx.recoveryFor('mutually_exclusive_params'));
+        }
+        if (input.lastModDays !== undefined && (input.lastModStartDate || input.lastModEndDate)) {
+            throw ctx.fail('mutually_exclusive_params', 'lastModDays and lastModStartDate/lastModEndDate are mutually exclusive.', {
+                recovery: {
+                    hint: 'Use either the convenience shorthand (lastModDays) or the explicit date range (lastModStartDate + lastModEndDate), not both.',
+                },
+            });
+        }
+        // Validate co-requirement: start and end must be provided together.
+        if (input.pubStartDate && !input.pubEndDate) {
+            throw ctx.fail('missing_date_pair', 'pubStartDate requires pubEndDate.', ctx.recoveryFor('missing_date_pair'));
+        }
+        if (input.pubEndDate && !input.pubStartDate) {
+            throw ctx.fail('missing_date_pair', 'pubEndDate requires pubStartDate.', ctx.recoveryFor('missing_date_pair'));
+        }
+        if (input.lastModStartDate && !input.lastModEndDate) {
+            throw ctx.fail('missing_date_pair', 'lastModStartDate requires lastModEndDate.', ctx.recoveryFor('missing_date_pair'));
+        }
+        if (input.lastModEndDate && !input.lastModStartDate) {
+            throw ctx.fail('missing_date_pair', 'lastModEndDate requires lastModStartDate.', ctx.recoveryFor('missing_date_pair'));
+        }
+        const datesClamped = [];
+        let pubStartDate = input.pubStartDate;
+        let pubEndDate = input.pubEndDate;
+        let lastModStartDate = input.lastModStartDate;
+        let lastModEndDate = input.lastModEndDate;
+        // Track whether dates came from convenience params — those are always within range.
+        let pubDatesFromConvenience = false;
+        let lastModDatesFromConvenience = false;
+        // Expand pubDays convenience param
+        if (input.pubDays !== undefined) {
+            let days = input.pubDays;
+            if (days > MAX_DATE_RANGE_DAYS) {
+                datesClamped.push({ param: 'pubDays', original: days, clamped: MAX_DATE_RANGE_DAYS });
+                days = MAX_DATE_RANGE_DAYS;
+            }
+            pubStartDate = daysAgo(days);
+            pubEndDate = nowIso();
+            pubDatesFromConvenience = true;
+        }
+        // Expand lastModDays convenience param
+        if (input.lastModDays !== undefined) {
+            let days = input.lastModDays;
+            if (days > MAX_DATE_RANGE_DAYS) {
+                datesClamped.push({ param: 'lastModDays', original: days, clamped: MAX_DATE_RANGE_DAYS });
+                days = MAX_DATE_RANGE_DAYS;
+            }
+            lastModStartDate = daysAgo(days);
+            lastModEndDate = nowIso();
+            lastModDatesFromConvenience = true;
+        }
+        // Validate severity cross-field constraint: CVSS v2 has no CRITICAL tier.
+        if (input.severity === 'CRITICAL' && input.severityVersion === 'v2') {
+            throw ctx.fail('invalid_severity_for_version', 'CVSS v2 has no CRITICAL severity tier. Valid values for severityVersion="v2" are LOW, MEDIUM, HIGH.', ctx.recoveryFor('invalid_severity_for_version'));
+        }
+        // Validate explicit date range spans — skip when dates came from convenience params
+        // (those are always within the max range after clamping).
+        if (!pubDatesFromConvenience && pubStartDate && pubEndDate) {
+            const start = new Date(pubStartDate);
+            const end = new Date(pubEndDate);
+            if (Number.isNaN(start.getTime())) {
+                throw ctx.fail('invalid_date_format', `Invalid date for pubStartDate: "${pubStartDate}". Expected ISO 8601 format.`, ctx.recoveryFor('invalid_date_format'));
+            }
+            if (Number.isNaN(end.getTime())) {
+                throw ctx.fail('invalid_date_format', `Invalid date for pubEndDate: "${pubEndDate}". Expected ISO 8601 format.`, ctx.recoveryFor('invalid_date_format'));
+            }
+            const days = (end.getTime() - start.getTime()) / (1000 * 60 * 60 * 24);
+            if (days < 0) {
+                throw ctx.fail('date_range_inverted', 'pubEndDate is before pubStartDate — the date range is inverted.', ctx.recoveryFor('date_range_inverted'));
+            }
+            if (days > MAX_DATE_RANGE_DAYS) {
+                throw ctx.fail('date_range_exceeds_max', `Publication date range spans ${Math.ceil(days)} days; maximum is 120.`, ctx.recoveryFor('date_range_exceeds_max'));
+            }
+        }
+        if (!lastModDatesFromConvenience && lastModStartDate && lastModEndDate) {
+            const start = new Date(lastModStartDate);
+            const end = new Date(lastModEndDate);
+            if (Number.isNaN(start.getTime())) {
+                throw ctx.fail('invalid_date_format', `Invalid date for lastModStartDate: "${lastModStartDate}". Expected ISO 8601 format.`, ctx.recoveryFor('invalid_date_format'));
+            }
+            if (Number.isNaN(end.getTime())) {
+                throw ctx.fail('invalid_date_format', `Invalid date for lastModEndDate: "${lastModEndDate}". Expected ISO 8601 format.`, ctx.recoveryFor('invalid_date_format'));
+            }
+            const days = (end.getTime() - start.getTime()) / (1000 * 60 * 60 * 24);
+            if (days < 0) {
+                throw ctx.fail('date_range_inverted', 'lastModEndDate is before lastModStartDate — the date range is inverted.', ctx.recoveryFor('date_range_inverted'));
+            }
+            if (days > MAX_DATE_RANGE_DAYS) {
+                throw ctx.fail('date_range_exceeds_max', `Last-modified date range spans ${Math.ceil(days)} days; maximum is 120.`, ctx.recoveryFor('date_range_exceeds_max'));
+            }
+        }
+        const service = getNvdCveService();
+        const result = await service.searchCves({
+            ...(input.keyword && { keyword: input.keyword }),
+            ...(input.severity && { severityParam: input.severity }),
+            severityVersion: input.severityVersion,
+            ...(input.cweId && { cweId: input.cweId }),
+            ...(pubStartDate && { pubStartDate }),
+            ...(pubEndDate && { pubEndDate }),
+            ...(lastModStartDate && { lastModStartDate }),
+            ...(lastModEndDate && { lastModEndDate }),
+            kevOnly: input.kevOnly,
+            noRejected: input.noRejected,
+            limit: input.limit,
+            offset: input.offset,
+        }, ctx);
+        return {
+            cves: result.cves,
+            queryMeta: {
+                totalResults: result.totalResults,
+                returned: result.returned,
+                offset: result.offset,
+                ...(datesClamped.length > 0 && { datesClamped }),
+            },
+        };
+    },
+    format: (result) => {
+        const lines = [];
+        lines.push(`**Total:** ${result.queryMeta.totalResults} matching CVEs | ` +
+            `**Showing:** ${result.queryMeta.returned} (offset ${result.queryMeta.offset})`);
+        if (result.queryMeta.datesClamped && result.queryMeta.datesClamped.length > 0) {
+            for (const c of result.queryMeta.datesClamped) {
+                lines.push(`> **Note:** ${c.param} value ${c.original} exceeded the 120-day maximum and was clamped to ${c.clamped}.`);
+            }
+        }
+        if (result.cves.length === 0) {
+            if (result.queryMeta.totalResults > 0) {
+                lines.push(`\nOffset ${result.queryMeta.offset} is past the end of the result set ` +
+                    `(${result.queryMeta.totalResults} total). Use a lower offset to page through results.`);
+            }
+            else {
+                lines.push('\nNo CVEs matched the search criteria. Try broadening the keyword or date range.');
+            }
+            return [{ type: 'text', text: lines.join('\n') }];
+        }
+        lines.push('');
+        for (const cve of result.cves) {
+            lines.push(`### ${cve.cveId}`);
+            lines.push(`**Status:** ${cve.vulnStatus} | **Published:** ${cve.published}`);
+            if (cve.severity) {
+                lines.push(`**Severity:** ${cve.severity.label} (${cve.severity.score}) from CVSS ${cve.severity.fromVersion}`);
+            }
+            else {
+                lines.push('**Severity:** Not available');
+            }
+            if (cve.cisaVulnerabilityName) {
+                lines.push(`**CISA KEV:** ${cve.cisaVulnerabilityName}`);
+            }
+            lines.push('');
+        }
+        return [{ type: 'text', text: lines.join('\n') }];
+    },
+});
+//# sourceMappingURL=nvd-search-cves.tool.js.map

package/dist/mcp-server/tools/definitions/nvd-search-cves.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-search-cves.tool.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/nvd-search-cves.tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,0FAA0F;AAC1F,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,kFAAkF;AAClF,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAChE,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;KACvE,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,qBAAqB,EAAE,CAAC;SACrB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oEAAoE,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE;IACnD,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,yEAAyE;QACzE,kFAAkF;QAClF,+JAA+J;QAC/J,8EAA8E;QAC9E,4HAA4H;IAC9H,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;IAEzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,wEAAwE,CAAC;QACrF,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;aAC3C,QAAQ,EAAE;aACV,QAAQ,CAAC,sDAAsD,CAAC;QACnE,eAAe,EAAE,CAAC;aACf,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;aACxB,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,oFAAoF,CACrF;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,8DAA8D,CAAC;QAC3E,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,4EAA4E;YAC1E,kDAAkD,CACrD;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,gFAAgF;YAC9E,0DAA0D,CAC7D;QACH,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,qGAAqG;YACnG,kCAAkC,CACrC;QACH,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,kGAAkG,CACnG;QACH,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,+GAA+G,CAChH;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,wEAAwE,CAAC;QACrF,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,yFAAyF,CAC1F;QACH,UAAU,EAAE,CAAC;aACV,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CAAC,iEAAiE,CAAC;QAC9E,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,IAAI,CAAC;aACT,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CAAC,6DAA6D,CAAC;QAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;KAC9F,CAAC;IAEF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC;aACJ,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;aAC3E,QAAQ,CAAC,2EAA2E,CAAC;QACxF,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;YAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YAC9D,YAAY,EAAE,CAAC;iBACZ,KAAK,CACJ,CAAC;iBACE,MAAM,CAAC;gBACN,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,CAAC,0DAA0D,CAAC;gBACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;aAClE,CAAC;iBACD,QAAQ,CAAC,6DAA6D,CAAC,CAC3E;iBACA,QAAQ,EAAE;iBACV,QAAQ,CACP,sFAAsF;gBACpF,mCAAmC,CACtC;SACJ,CAAC;aACD,QAAQ,CAAC,+EAA+E,CAAC;KAC7F,CAAC;IAEF,MAAM,EAAE;QACN;YACE,MAAM,EAAE,2BAA2B;YACnC,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,6GAA6G;YACnH,QAAQ,EACN,kHAAkH;SACrH;QACD;YACE,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,4GAA4G;YAClH,QAAQ,EACN,oGAAoG;SACvG;QACD;YACE,MAAM,EAAE,qBAAqB;YAC7B,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,wCAAwC;YAC9C,QAAQ,EAAE,8CAA8C;SACzD;QACD;YACE,MAAM,EAAE,wBAAwB;YAChC,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,8FAA8F;YACpG,QAAQ,EAAE,gFAAgF;SAC3F;QACD;YACE,MAAM,EAAE,qBAAqB;YAC7B,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,4HAA4H;YAClI,QAAQ,EAAE,qDAAqD;SAChE;QACD;YACE,MAAM,EAAE,8BAA8B;YACtC,IAAI,EAAE,gBAAgB,CAAC,aAAa;YACpC,IAAI,EAAE,6FAA6F;YACnG,QAAQ,EAAE,mFAAmF;SAC9F;QACD;YACE,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,gBAAgB,CAAC,kBAAkB;YACzC,IAAI,EAAE,+DAA+D;YACrE,SAAS,EAAE,IAAI;YACf,QAAQ,EACN,sGAAsG;SACzG;KACF;IAED,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QAEH,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,CAAC,IAAI,CACZ,2BAA2B,EAC3B,6DAA6D,EAC7D,GAAG,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACxF,MAAM,GAAG,CAAC,IAAI,CACZ,2BAA2B,EAC3B,yEAAyE,EACzE;gBACE,QAAQ,EAAE;oBACR,IAAI,EAAE,8HAA8H;iBACrI;aACF,CACF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,GAAG,CAAC,IAAI,CACZ,mBAAmB,EACnB,mCAAmC,EACnC,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,GAAG,CAAC,IAAI,CACZ,mBAAmB,EACnB,mCAAmC,EACnC,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,mBAAmB,EACnB,2CAA2C,EAC3C,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC,IAAI,CACZ,mBAAmB,EACnB,2CAA2C,EAC3C,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAgE,EAAE,CAAC;QACrF,IAAI,YAAY,GAAuB,KAAK,CAAC,YAAY,CAAC;QAC1D,IAAI,UAAU,GAAuB,KAAK,CAAC,UAAU,CAAC;QACtD,IAAI,gBAAgB,GAAuB,KAAK,CAAC,gBAAgB,CAAC;QAClE,IAAI,cAAc,GAAuB,KAAK,CAAC,cAAc,CAAC;QAC9D,oFAAoF;QACpF,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,2BAA2B,GAAG,KAAK,CAAC;QAExC,mCAAmC;QACnC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;YACzB,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACtF,IAAI,GAAG,mBAAmB,CAAC;YAC7B,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,UAAU,GAAG,MAAM,EAAE,CAAC;YACtB,uBAAuB,GAAG,IAAI,CAAC;QACjC,CAAC;QAED,uCAAuC;QACvC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC;YAC7B,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1F,IAAI,GAAG,mBAAmB,CAAC;YAC7B,CAAC;YACD,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,cAAc,GAAG,MAAM,EAAE,CAAC;YAC1B,2BAA2B,GAAG,IAAI,CAAC;QACrC,CAAC;QAED,0EAA0E;QAC1E,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACpE,MAAM,GAAG,CAAC,IAAI,CACZ,8BAA8B,EAC9B,qGAAqG,EACrG,GAAG,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAChD,CAAC;QACJ,CAAC;QAED,oFAAoF;QACpF,0DAA0D;QAC1D,IAAI,CAAC,uBAAuB,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC,IAAI,CACZ,qBAAqB,EACrB,mCAAmC,YAAY,8BAA8B,EAC7E,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,CAAC,IAAI,CACZ,qBAAqB,EACrB,iCAAiC,UAAU,8BAA8B,EACzE,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,IAAI,CACZ,qBAAqB,EACrB,iEAAiE,EACjE,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBAC/B,MAAM,GAAG,CAAC,IAAI,CACZ,wBAAwB,EACxB,gCAAgC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EACvE,GAAG,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,2BAA2B,IAAI,gBAAgB,IAAI,cAAc,EAAE,CAAC;YACvE,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC,IAAI,CACZ,qBAAqB,EACrB,uCAAuC,gBAAgB,8BAA8B,EACrF,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,CAAC,IAAI,CACZ,qBAAqB,EACrB,qCAAqC,cAAc,8BAA8B,EACjF,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,IAAI,CACZ,qBAAqB,EACrB,yEAAyE,EACzE,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBAC/B,MAAM,GAAG,CAAC,IAAI,CACZ,wBAAwB,EACxB,kCAAkC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EACzE,GAAG,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CACrC;YACE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1C,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;YACjC,GAAG,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAC7C,GAAG,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,GAAG,CACJ,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;aACjD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,cAAc,MAAM,CAAC,SAAS,CAAC,YAAY,mBAAmB;YAC5D,gBAAgB,MAAM,CAAC,SAAS,CAAC,QAAQ,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAClF,CAAC;QAEF,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC9C,KAAK,CAAC,IAAI,CACR,eAAe,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,QAAQ,oDAAoD,CAAC,CAAC,OAAO,GAAG,CAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CACR,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,qCAAqC;oBACtE,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,sDAAsD,CAC1F,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CACR,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,UAAU,qBAAqB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YAE9E,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,iBAAiB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,eAAe,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CACpG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC"}

package/dist/services/nvd-cpe/nvd-cpe-service.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @fileoverview Service for the NIST NVD CPE API 2.0.
+ * Provides CPE dictionary search by keyword and match string.
+ * @module services/nvd-cpe/nvd-cpe-service
+ */
+import type { Context } from '@cyanheads/mcp-ts-core';
+import type { AppConfig } from '@cyanheads/mcp-ts-core/config';
+import type { StorageService } from '@cyanheads/mcp-ts-core/storage';
+import type { CpeRecord } from './types.js';
+export declare class NvdCpeService {
+    constructor(_config: AppConfig, _storage: StorageService);
+    /**
+     * Search CPEs by keyword or partial match string.
+     */
+    searchCpes(params: {
+        keyword?: string;
+        cpeMatchString?: string;
+        limit?: number;
+    }, ctx: Context): Promise<{
+        cpes: CpeRecord[];
+        totalResults: number;
+        returned: number;
+    }>;
+}
+export declare function initNvdCpeService(config: AppConfig, storage: StorageService): void;
+export declare function getNvdCpeService(): NvdCpeService;
+//# sourceMappingURL=nvd-cpe-service.d.ts.map

package/dist/services/nvd-cpe/nvd-cpe-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-cpe-service.d.ts","sourceRoot":"","sources":["../../../src/services/nvd-cpe/nvd-cpe-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,SAAS,EAA8B,MAAM,YAAY,CAAC;AAqBxE,qBAAa,aAAa;gBAEZ,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc;IAExD;;OAEG;IACG,UAAU,CACd,MAAM,EAAE;QACN,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAsB1E;AAMD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAElF;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}

package/dist/services/nvd-cpe/nvd-cpe-service.js

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview Service for the NIST NVD CPE API 2.0.
+ * Provides CPE dictionary search by keyword and match string.
+ * @module services/nvd-cpe/nvd-cpe-service
+ */
+import { getNvdHttpClient } from '../nvd-http/nvd-http-client.js';
+/** Normalize a raw CPE item to a CpeRecord. */
+function normalizeCpe(raw) {
+    const titles = (raw.titles ?? [])
+        .filter((t) => t.lang === 'en' && t.title)
+        .map((t) => t.title);
+    const deprecatedBy = (raw.deprecatedBy ?? [])
+        .filter((d) => d.cpeName)
+        .map((d) => d.cpeName);
+    return {
+        cpeName: raw.cpeName ?? '',
+        ...(titles.length > 0 && { title: titles[0] }),
+        deprecated: raw.deprecated ?? false,
+        ...(deprecatedBy.length > 0 && { deprecatedBy }),
+        ...(raw.lastModified && { lastModified: raw.lastModified }),
+    };
+}
+export class NvdCpeService {
+    // biome-ignore lint/complexity/noUselessConstructor: preserves framework init-pattern signature
+    constructor(_config, _storage) { }
+    /**
+     * Search CPEs by keyword or partial match string.
+     */
+    async searchCpes(params, ctx) {
+        const client = getNvdHttpClient();
+        const apiParams = {
+            resultsPerPage: Math.min(params.limit ?? 20, 10_000),
+            startIndex: 0,
+        };
+        if (params.keyword)
+            apiParams.keywordSearch = params.keyword;
+        if (params.cpeMatchString)
+            apiParams.cpeMatchString = params.cpeMatchString;
+        const response = await client.get('cpes/2.0', apiParams, ctx);
+        const items = (response.products ?? []).map((p) => p.cpe).filter((c) => !!c);
+        const cpes = items.map(normalizeCpe);
+        const totalResults = response.totalResults ?? 0;
+        ctx.log.info('CPE search completed', { totalResults, returned: cpes.length });
+        return { cpes, totalResults, returned: cpes.length };
+    }
+}
+// --- Init/accessor pattern ---
+let _service;
+export function initNvdCpeService(config, storage) {
+    _service = new NvdCpeService(config, storage);
+}
+export function getNvdCpeService() {
+    if (!_service) {
+        throw new Error('NvdCpeService not initialized — call initNvdCpeService() in setup()');
+    }
+    return _service;
+}
+//# sourceMappingURL=nvd-cpe-service.js.map

package/dist/services/nvd-cpe/nvd-cpe-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-cpe-service.js","sourceRoot":"","sources":["../../../src/services/nvd-cpe/nvd-cpe-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,+CAA+C;AAC/C,SAAS,YAAY,CAAC,GAAe;IACnC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC;IAEnC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;QAC1B,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;QACnC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAa;IACxB,gGAAgG;IAChG,YAAY,OAAkB,EAAE,QAAwB,IAAG,CAAC;IAE5D;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,MAIC,EACD,GAAY;QAEZ,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,MAAM,SAAS,GAA0D;YACvE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC;YACpD,UAAU,EAAE,CAAC;SACd,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7D,IAAI,MAAM,CAAC,cAAc;YAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAE5E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiB,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9F,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;QAEhD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;CACF;AAED,gCAAgC;AAEhC,IAAI,QAAmC,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,OAAuB;IAC1E,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/services/nvd-cpe/types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Domain types for the NVD CPE API 2.0 response shapes and normalized domain objects.
+ * @module services/nvd-cpe/types
+ */
+/** Raw CPE item from the NVD API response. */
+export interface RawCpeItem {
+    cpeName?: string;
+    cpeNameId?: string;
+    created?: string;
+    deprecated?: boolean;
+    deprecatedBy?: Array<{
+        cpeName?: string;
+        cpeNameId?: string;
+    }>;
+    lastModified?: string;
+    titles?: Array<{
+        title?: string;
+        lang?: string;
+    }>;
+}
+/** Raw NVD CPE search response. */
+export interface RawCpeResponse {
+    format?: string;
+    products?: Array<{
+        cpe?: RawCpeItem;
+    }>;
+    resultsPerPage?: number;
+    startIndex?: number;
+    timestamp?: string;
+    totalResults?: number;
+    version?: string;
+}
+/** Normalized CPE record. */
+export interface CpeRecord {
+    cpeName: string;
+    deprecated: boolean;
+    deprecatedBy?: string[];
+    lastModified?: string;
+    title?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/services/nvd-cpe/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/nvd-cpe/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8CAA8C;AAC9C,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED,mCAAmC;AACnC,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/services/nvd-cpe/types.js

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Domain types for the NVD CPE API 2.0 response shapes and normalized domain objects.
+ * @module services/nvd-cpe/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/services/nvd-cpe/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/nvd-cpe/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/services/nvd-cve/nvd-cve-service.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @fileoverview Service for the NIST NVD CVE API 2.0 and CVE History API.
+ * Provides normalized CVE records, search, audit-by-CPE, and change history.
+ * @module services/nvd-cve/nvd-cve-service
+ */
+import type { Context } from '@cyanheads/mcp-ts-core';
+import type { AppConfig } from '@cyanheads/mcp-ts-core/config';
+import type { StorageService } from '@cyanheads/mcp-ts-core/storage';
+import type { BriefCveRecord, CveChangeEvent, CveRecord } from './types.js';
+export interface SearchCvesParams {
+    cweId?: string;
+    kevOnly?: boolean;
+    keyword?: string;
+    lastModEndDate?: string;
+    lastModStartDate?: string;
+    limit?: number;
+    noRejected?: boolean;
+    offset?: number;
+    pubEndDate?: string;
+    pubStartDate?: string;
+    severityParam?: string;
+    severityVersion?: 'v2' | 'v3' | 'v4';
+}
+export interface AuditCpeParams {
+    cpeName?: string;
+    limit?: number;
+    severityMin?: string;
+    versionEnd?: string;
+    versionEndType?: 'including' | 'excluding';
+    versionStart?: string;
+    versionStartType?: 'including' | 'excluding';
+    virtualMatchString?: string;
+}
+export declare class NvdCveService {
+    constructor(_config: AppConfig, _storage: StorageService);
+    /**
+     * Fetch one or more CVEs by ID (up to 100).
+     * Returns full records. Throws `invalid_cve_id_format` for malformed IDs (HTTP 404 from NVD)
+     * and `cve_not_found` when NVD returns empty results for a valid-format ID.
+     */
+    fetchById(rawIds: string[], includeReferences: boolean, ctx: Context): Promise<{
+        cves: CveRecord[];
+        returned: number;
+        requested: number;
+        missingIds: string[];
+    }>;
+    /**
+     * Search CVEs using various filters. Always returns brief records.
+     */
+    searchCves(params: SearchCvesParams, ctx: Context): Promise<{
+        cves: BriefCveRecord[];
+        totalResults: number;
+        returned: number;
+        offset: number;
+    }>;
+    /**
+     * Find CVEs affecting a specific CPE (by name or virtual match string with version range).
+     */
+    auditCpe(params: AuditCpeParams, ctx: Context): Promise<{
+        cves: CveRecord[];
+        totalResults: number;
+        returned: number;
+        cpeName?: string;
+        virtualMatchString?: string;
+    }>;
+    /**
+     * Retrieve the change history for a CVE.
+     */
+    getCveHistory(rawId: string, limit: number, offset: number, ctx: Context): Promise<{
+        cveId: string;
+        changes: CveChangeEvent[];
+        totalResults: number;
+        returned: number;
+        offset: number;
+    }>;
+}
+export declare function initNvdCveService(config: AppConfig, storage: StorageService): void;
+export declare function getNvdCveService(): NvdCveService;
+//# sourceMappingURL=nvd-cve-service.d.ts.map

package/dist/services/nvd-cve/nvd-cve-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-cve-service.d.ts","sourceRoot":"","sources":["../../../src/services/nvd-cve/nvd-cve-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EACV,cAAc,EAEd,cAAc,EACd,SAAS,EAOV,MAAM,YAAY,CAAC;AAoJpB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD,qBAAa,aAAa;gBAEZ,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc;IAExD;;;;OAIG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EAAE,EAChB,iBAAiB,EAAE,OAAO,EAC1B,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA6C5F;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QACT,IAAI,EAAE,cAAc,EAAE,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IA+CF;;OAEG;IACG,QAAQ,CACZ,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QACT,IAAI,EAAE,SAAS,EAAE,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IA8DF;;OAEG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QACT,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,cAAc,EAAE,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CAwCH;AAMD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAElF;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}