Loading ToolBench
Recent CVE + GHSA cache for AI agents auditing dependencies — npm/PyPI/Cargo/Maven.
CVE Cache MCP has clear, focused tool definitions with proper schemas and reasonable descriptions. All 4 tools are explicitly registered with input schemas and descriptions. However, parameter descriptions are sparse or missing entirely (ecosystem, since_days, min_cvss lack descriptions), and output schemas are not documented. Error handling is minimal, tools return JSON error objects but provide no recovery guidance. No tool annotations (readOnlyHint, idempotentHint) despite all being read-only. Tool names follow verb_noun convention (lookup_, find_, list_, severity_) which is good. Descriptions average ~80 chars, below the 194-char baseline for A+ tools, but adequate for discovery. The severity_summary tool has an empty input schema with no parameters documented.
All CVEs affecting a package. Optionally filter by ecosystem.
Recent CVEs with CVSS >= threshold. Default: 7-day high-severity feed.
Full record for one CVE by ID. Cited NVD + GHSA URLs.
Counts by severity bucket across the snapshot. Quick agent triage view.
Parameter descriptions missing or incomplete. 'ecosystem' in find_for_package lacks description; 'since_days' and 'min_cvss' in list_recent_critical have no descriptions despite being optional with defaults. LLMs cannot infer parameter meaning from names alone.
Output schemas not documented. Tools return structured JSON (cves array, counts, metadata) but the response schema is not declared. LLMs cannot plan downstream operations or extract fields reliably without knowing the output structure.
Error handling lacks recovery guidance. Tools return {'error': 'message'} but do not tell the LLM what to do next. E.g., 'cve_id not found' should suggest 'Try find_for_package() to search by package name instead.'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 51 | 2026-07-28+ | v2 |
No tool annotations despite all tools being read-only. Adding readOnlyHint: true to all tool definitions would signal to agents that these are safe to call without confirmation, improving planning efficiency.
severity_summary has empty input schema (no parameters). The description should clarify that this tool takes no arguments and returns a snapshot-wide summary, not per-package or per-CVE breakdowns.