Loading ToolBench
Measures what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring, scanner intake, Excel bulk analysis, and an offline dashboard.
Vulnometry provides 12 well-named tools with clear, domain-specific descriptions (avg 85 chars). All tools start with action verbs (measure_, assess_, read_, fetch_, search_, find_, scan_, import_). Input schemas are present and typed for all tools, with nested object structures for complex params like 'asset' and 'findings'. However, output schemas are NOT documented, the rubric requires documented return types for A+ tools. Parameter descriptions are present but terse (avg 45 chars); many lack format/constraint details. Error handling is not visible in the provided code. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all tools being READ_ONLY. The library interface (examples/library_use.py) shows rich return objects (Assessment, portfolio_summary) but these are not formally documented in the tool definitions themselves.
Assess one CVE against one place you run it, returning a full Assessment with weakness, probability, exploitation, bulletins, and directive
Assess many findings and return them worst-first by Business Exposure Index
Fetch NVD CVE record with CVSS and weakness details
Fetch EPSS (Exploit Prediction Scoring System) probability for a CVE
Check if a CVE is in the CISA Known Exploited Vulnerabilities catalogue
Search GitHub for public exploit material and proof-of-concept code for a CVE
Load vulnerability findings from a scanner export (CSV, Excel, JSON) and assess them
Output schemas not documented. Tools return complex objects (Assessment, portfolio_summary) but no formal schema is visible in tool definitions. LLMs cannot plan downstream calls or extract fields without documented return types.
Tool annotations missing. All 12 tools are READ_ONLY but lack readOnlyHint annotation. This prevents agents from understanding which tools are safe to retry and which have side effects.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Measure the Business Exposure Index for a CVE against a specific asset context
Load and return the organization's asset inventory
Parse a dependency manifest (package.json, requirements.txt, go.mod, pom.xml, etc.) and query OSV for vulnerabilities
Search GitHub Security Advisories for a CVE
Search OSV.dev for advisories and vulnerability information by CVE or package
Parameter descriptions lack format/constraint details. E.g., 'lens' accepts 'signal, full, or forensic' but no enum constraint is visible; 'limit' has no min/max bounds; 'path' has no validation pattern. Descriptions are terse (avg 45 chars vs baseline 72 chars).
Error handling not visible. No recovery guidance, error classification, or actionable error messages documented. Agents cannot determine if failures are retryable or require user intervention.
Complex nested parameters (asset, findings, inventory) lack detailed field documentation. 'asset' object has 6 properties but no guidance on which are required, defaults, or validation rules.