echelongraph-mcp 2.3.1 → 2.3.3

package/README.md

@@ -17,7 +17,7 @@ API call a tool needs to answer.
 
 | Tool | What it does |
 |---|---|
-| `cve_summary` | Counts of active CVEs by severity, and when the feed was last updated. |
+| `cve_summary` | Counts of active CVEs by severity band, the count with no severity band from any source (`summary.none`, sent again as `summary.unscored`: CVEs not yet scored, not a rating of None), and when the feed was last updated. |
 | `search_cves` | Search/filter CVEs (severity, min CVSS, text, sort) with EchelonGraph scores and `score_assessed`; the note names each row not yet scored. |
 | `get_cve` | Full record for one CVE: CVSS v3 and (when scored) v4, the EchelonGraph score and its confidence, whether EchelonGraph has scored it (`score_assessed`), EPSS, CISA-KEV status and known ransomware use, the GitHub GHSA id, references, and its published, modified and `updated_at` times. |
 | `cve_exposure` | Internet-exposure footprint for a CVE: exposed service count (distinct ip:port, the `exposed_hosts` field) + country/product breakdown, from the KEV-exposure radar. |

package/dist/index.js

@@ -386,6 +386,26 @@ function rowsScoreNote(d) {
     }
     return out.map((s) => ` ${s}`).join("");
 }
+// ── summary.none, the not-yet-scored bucket (#2610) ──
+//
+// core-backend cve/store.go Summary buckets the active CVEs on effectiveSeverityExpr: the
+// EchelonGraph band, else NVD's, else the CVSS v2 band, else NONE, where a band of NONE or UNKNOWN
+// counts as none. So summary.none counts the CVEs with no severity band from any source, and the
+// store sends the same number again as summary.unscored (CVESummary: "the residual band-less
+// bucket … numerically identical to None"; Critical+High+Medium+Low+Unscored == Total). It is not
+// a count of CVEs rated severity None, but a model handed "counts by severity … none" reports
+// "3,381 CVEs rated None" (production on 2026-09-30: none 3,381, unscored 3,381). The JSON is
+// relayed as sent; the note says what the count is whenever it is above zero, and names
+// summary.unscored as the same count when the answer carries it equal. A zero is not labelled:
+// there is no CVE in it to misreport.
+function summaryNoneNote(d) {
+    const none = numAt(d, "summary", "none");
+    if (none === undefined || none <= 0)
+        return "";
+    const unscored = numAt(d, "summary", "unscored");
+    const same = unscored === none ? ` summary.unscored (${unscored}) is the same count under its own name.` : "";
+    return ` summary.none (${none}) is not a severity rating of None: it counts the active CVEs with no severity band from any source, that is, CVEs not yet scored.${same} Report them as not yet scored, not as CVEs rated None.`;
+}
 async function cveSummary() {
     const tool = "cve_summary";
     try {
@@ -408,14 +428,15 @@ async function cveSummary() {
             ],
         };
         const total = numAt(r.data, "summary", "total");
+        const none = summaryNoneNote(r.data);
         if (total === undefined)
-            return succeeded(r.data, head, env);
+            return succeeded(r.data, `${head}${none}`, env);
         if (total === 0) {
-            return succeeded(r.data, `${head} The feed reports 0 active CVEs — a measured empty result (we looked and found nothing), not a lookup failure.`, env);
+            return succeeded(r.data, `${head} The feed reports 0 active CVEs — a measured empty result (we looked and found nothing), not a lookup failure.${none}`, env);
         }
         // A stamp that is not a real instant stays in the JSON and is not repeated as prose.
         const stamp = realInstant(updated) ? ` (last updated ${updated})` : "";
-        return succeeded(r.data, `${head} The feed holds ${total} active CVEs${stamp}.`, env);
+        return succeeded(r.data, `${head} The feed holds ${total} active CVEs${stamp}.${none}`, env);
     }
     catch (e) {
         return crashed(tool, e);
@@ -1652,7 +1673,9 @@ const CVE_SUMMARY_OUTPUT = envelopeSchema({
             high: opt(z.number()),
             medium: opt(z.number()),
             low: opt(z.number()),
-            none: opt(z.number()),
+            // #2610: the not-yet-scored bucket, not a rating (see summaryNoneNote).
+            none: opt(z.number()).describe("The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None."),
+            unscored: opt(z.number()).describe("The same count as none, under its own name."),
             last_updated: opt(z.string()),
         })
             .optional(),
@@ -1818,6 +1841,9 @@ const ANNOTATIONS = { readOnlyHint: true, destructiveHint: false, idempotentHint
 const CVE_ID_ARG = z.string().describe("a CVE ID, e.g. CVE-2023-44487");
 // What each description says about its structured result, naming only fields its schema holds.
 const FEED_ENVELOPE = "Its structured result carries state (measured), measured_at, method, coverage, freshness (null: the feed serves no poll-completion time) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
+// #2610: what cve_summary says summary.none is (summaryNoneNote), one constant string for the same
+// reason as SCORE_ASSESSED_DESCRIPTION below.
+const SUMMARY_NONE_DESCRIPTION = "summary.none is not a severity rating of None: it counts the active CVEs with no severity band from any source, that is, CVEs not yet scored, and the answer may carry the same count again as summary.unscored. Whenever summary.none is above zero the note says so: report those CVEs as not yet scored, not as CVEs rated None.";
 // #2535: what search_cves and get_cve say about score_assessed, one constant string, since the
 // site's tool-claims check (marketing-site lib/mcpToolClaims.test.ts) folds only constant strings.
 const SCORE_ASSESSED_DESCRIPTION = "echelongraph_score, echelongraph_severity and echelongraph_risk are EchelonGraph's score only when score_assessed is true. With score_assessed false the CVE is NOT YET SCORED, not scored 0: any of those three it carries (0, NONE, 0) is a placeholder, not a rating, and does not mean the CVE is harmless; the API may leave them out instead, score_confidence is NONE, and score_unassessed_reason says why (a rejected record, withdrawn by its numbering authority, is never scored, and the note says NOT SCORED). The note labels each such CVE NOT YET SCORED: report it that way, never as a score of 0. An answer with no score_assessed (an API older than that field) does not say whether the CVE was scored, the note says so, and a 0 there is not a rating either.";
@@ -1827,7 +1853,7 @@ function createServer() {
     const server = new McpServer({ name: NAME, version: VERSION }, { instructions: INSTRUCTIONS, capabilities: { tools: { listChanged: false } } });
     server.registerTool("cve_summary", {
         title: "CVE feed summary",
-        description: `Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs and their counts by severity (summary.critical, summary.high, summary.medium, summary.low, summary.none), plus summary.last_updated, the newest modification time among those records. The feed is polled from its sources on a schedule, so this is the state as of that update. ${FEED_ENVELOPE}`,
+        description: `Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs, their counts by severity band (summary.critical, summary.high, summary.medium, summary.low), the count with no band (summary.none), and summary.last_updated, the newest modification time among those records. ${SUMMARY_NONE_DESCRIPTION} The feed is polled from its sources on a schedule, so this is the state as of that update. ${FEED_ENVELOPE}`,
         outputSchema: CVE_SUMMARY_OUTPUT,
         annotations: ANNOTATIONS,
     }, async () => checked("cve_summary", CVE_SUMMARY_OUTPUT, await cveSummary()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echelongraph-mcp",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "mcpName": "io.echelongraph/echelongraph-mcp",
   "description": "EchelonGraph CVE and internet-exposure data as an MCP server: CVEs with EchelonGraph multi-source scores, CISA-KEV and EPSS, plus a per-CVE internet-exposure footprint derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Free and keyless, for Claude, Cursor and any MCP client.",
   "type": "module",

package/server.json

@@ -8,12 +8,12 @@
     "url": "https://github.com/echelongraph/echelongraph-mcp",
     "source": "github"
   },
-  "version": "2.3.1",
+  "version": "2.3.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "echelongraph-mcp",
-      "version": "2.3.1",
+      "version": "2.3.3",
       "transport": {
         "type": "stdio"
       },