Loading ToolBench
Model Context Protocol server for CVEasy AI — exposes scans, findings, CVEs, threat intel, and report context to MCP clients (Claude Desktop / Claude Code) so an LLM can query your live posture and draft/refine reports.
CVEasy MCP has 20 tools with mostly clear naming (verb_noun pattern) and reasonable descriptions (avg ~120 chars). However, critical gaps exist: 12 tools lack visible input schemas in the provided source, parameter descriptions are sparse or missing entirely, and output schemas are undocumented. Error handling is minimal, no recovery guidance or actionable error messages. The server demonstrates domain expertise (CVE/TRIS/EPSS scoring, tenant contextualization, manifest pinning) but falls short of production-grade tool definition quality. Naming is strong; schemas and parameter documentation are weak.
Retrieve banding vocabulary reference showing three different banding vocabularies and their thresholds
Start a BAS (Breach and Attack Simulation) scan with constrained target validation
Get detailed information about a specific CVE
Search for CVEs in the database
Retrieve the top risk CVEs
Retrieve prioritized findings for a tenant with contextualized scoring
List assets in the inventory
12 of 20 tools have no visible input schema in source code. Per HARD SCORING RULES, schema score must be 0 for tools without documented schemas. This caps per-tool scores at ~52 and drags overall quality down significantly.
Parameter descriptions are sparse or missing. Only 8 tools show parameter descriptions in the provided source (e.g., findings_prioritized, threat_headlines, report_render). The remaining 12 tools either have empty input {} or undocumented parameters.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Retrieve KEV (Known Exploited Vulnerabilities) context with denominators
Query the health status of the CVEasy backend and connectivity
Retrieve overall security posture statistics and metrics
Retrieve CVSS, EPSS, and TRIS score paths paired on one row for charting with optional tenant contextualization
Retrieve context data for report generation grounded in live posture data
Generate a report using the backend's own template with local-model narrative
Render a structured report to print-ready HTML with path confinement enforcement
Retrieve recommended report template structure for a given report type
List vulnerability scans
List available MSSP workspaces/tenants
Retrieve threat intelligence headlines with provenance envelope marking third-party sources
Retrieve the tool manifest digest and full tool surface for Secure MCP control (a) - manifest pinning
Retrieve TRIS (Threat Response Intelligence Score) for CVEs
No output schemas documented. The source code does not show return type definitions for any tool. LLMs cannot plan downstream calls or extract fields without knowing what each tool returns.
Error handling is not visible in the provided source. No recovery guidance, error classification (retryable vs fatal), or actionable error messages are documented. Per pattern:recovery-guide, errors must tell the LLM what to do next.
Destructive tools (report_render, report_generate, bas_scan_start) lack confirmation or dry-run patterns. Per pattern:confirmation-request, irreversible operations should support a confirm step to prevent agent mistakes.