First Epss Mcp Server

Working · 1.9 s

io.github.cyanheads/first-epss-mcp-serverv0.1.3

Look up FIRST EPSS scores and daily history, find CVEs by threshold, and prioritize them with CVSS.

Security

Source Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://first-epss.caseyjhand.com/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

epss_get_scores Read-only

Retrieve latest available or historically dated FIRST EPSS probability and percentile for supplied CVEs. Process up to 500 unique entries from batchOffset; response byte limits can return fewer whole entries. Resume with nextBatchOffset as batchOffset, the original cves and returned score date as date. deferredCves were not queried; withheldCves were processed but omitted, and either list can be a declared preview. Missing scores remain unknown; use epss_list_reference for coverage and interpretation.

cvesarray, required

One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted.

datestring

UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data.

batchOffsetinteger

Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs.

Tools (5)

epss_get_scores

read-only

Argument	Type	Description
cves*	array	One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted.
date	string	UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data.
batchOffset	integer	Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs.

Input schema (JSON)

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "cves"
  ],
  "properties": {
    "cves": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 128,
        "minLength": 1,
        "description": "Complete CVE-YYYY-NNNN identifier; whitespace, case and Unicode dashes are normalized."
      },
      "maxItems": 5000,
      "minItems": 1,
      "description": "One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted."
    },
    "date": {
      "type": "string",
      "pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
      "description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
    },
    "batchOffset": {
      "type": "integer",
      "default": 0,
      "maximum": 9007199254740991,
      "minimum": 0,
      "description": "Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs."
    }
  },
  "additionalProperties": false
}

epss_get_timeseries

Retrieve an EPSS anchor and up to 30 preceding daily observations for up to 50 unique CVEs from batchOffset. Response byte limits retain whole history items. Resume CVE batches with nextBatchOffset as batchOffset, the original cves and returned score date as date; withheldCves were processed, deferredCves were not queried, and lists can be declared previews. Exact 7-day and 30-day deltas require their calendar baselines; gaps remain unknown. Model boundaries do not explain score movement. Re-anchor using previousAnchorDate for the preceding history window; that snapshot may be unavailable.

read-only

Argument	Type	Description
cves*	array	One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted.
date	string	UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data.
batchOffset	integer	Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs.

Input schema (JSON)

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "cves"
  ],
  "properties": {
    "cves": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 128,
        "minLength": 1,
        "description": "Complete CVE-YYYY-NNNN identifier; whitespace, case and Unicode dashes are normalized."
      },
      "maxItems": 5000,
      "minItems": 1,
      "description": "One to 5000 CVE identifiers; whitespace, comma or semicolon-delimited strings are also accepted."
    },
    "date": {
      "type": "string",
      "pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$",
      "description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data."
    },
    "batchOffset": {
      "type": "integer",
      "default": 0,
      "maximum": 9007199254740991,
      "minimum": 0,
      "description": "Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs."
    }
  },
  "additionalProperties": false
}

epss_list_reference

Explain FIRST EPSS interpretation, model publishing dates, lookup coverage and transparent prioritization policy. Use this static reference before interpreting missing scores, score movement or probability versus percentile thresholds.

read-only

Argument	Type	Description
topic	string	interpretation: score meaning; models: publishing history; coverage: limits and missing data; prioritization: tier policy; all: every topic.

Input schema (JSON)

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "topic": {
      "enum": [
        "all",
        "interpretation",
        "models",
        "coverage",
        "prioritization"
      ],
      "type": "string",
      "default": "all",
      "description": "interpretation: score meaning; models: publishing history; coverage: limits and missing data; prioritization: tier policy; all: every topic."
    }
  },
  "additionalProperties": false
}

epss_prioritize_cves

Assign remediation tiers using latest or dated EPSS and caller-supplied CVSS base severity. Defaults are severity >= 7 and EPSS probability >= 0.10; select percentile explicitly for population rank. Missing severity stays in epssOnly and missing EPSS stays unscored. Thresholds are policy conventions, not FIRST guidance. Process up to 500 unique entries from batchOffset, returning whole entries within the byte budget. Resume using nextBatchOffset as batchOffset, the original cves with original cvssBaseScore values, returned score date as date, and the same severityThreshold and likelihood. Deferred lists may be declared previews; withheldCves were already processed.

read-only

Argument	Type	Description
cves*	array	One to 5000 CVEs with optional caller severity; process up to 500 unique identifiers from batchOffset.
date	string	UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data.
likelihood	any	Select one likelihood metric and threshold; omitted uses EPSS >= 0.10.
batchOffset	integer	Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs.
severityThreshold	number	Inclusive high severity threshold, default 7.

Input schema (JSON)

epss_query_threshold

Discover CVEs using inclusive EPSS or percentile bounds, CVE year or dataset-addition recency; filters intersect and at least one is required. Examine one candidate page ordered by EPSS descending. Each serialized response surface fits 65536 UTF-8 bytes; budgetLimited and withheldCount disclose whole matches withheld, with nextOffset at the first withheld match. Year filtering can return an empty page with nextOffset; candidateTotal is a broad-query total, not an exact-year total. Continue with the same filters, limit, returned score date and nextOffset.

read-only

Argument	Type	Description
date	string	UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data.
year	integer	Exact CVE year from 1999 through the current UTC year; candidate pages may contain no matches.
limit	integer	Requested candidates per page; positive safe integers above 10000 are clamped to 10000 before exact-year filtering.
offset	integer	Candidate-space offset; use returned nextOffset for continuation.
maxEpss	number	Inclusive maximum EPSS probability.
minEpss	number	Inclusive minimum EPSS probability.
maxPercentile

{ "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "cves" ], "properties": { "cves": { "type": "array", "items": { "type": "object", "required": [ "cve" ], "properties": { "cve": { "type": "string", "maxLength": 128, "minLength": 1, "description": "Complete CVE-YYYY-NNNN identifier; whitespace, case and Unicode dashes are normalized." }, "cvssBaseScore": { "type": "number", "maximum": 10, "minimum": 0, "description": "Optional caller-supplied severity; absent remains unknown." } }, "description": "CVE identifier with optional supplied severity.", "additionalProperties": false }, "maxItems": 5000, "minItems": 1, "description": "One to 5000 CVEs with optional caller severity; process up to 500 unique identifiers from batchOffset." }, "date": { "type": "string", "pattern": "^\\s*(?:\\d{4}-\\d{2}-\\d{2}\\s*)?$", "description": "UTC date YYYY-MM-DD from 2021-04-14 through today; omitted or blank selects latest available data." }, "likelihood": { "oneOf": [ { "type": "object", "required": [ "metric", "threshold" ], "properties": { "metric": { "type": "string", "const": "epss", "description": "Exploitation probability metric." }, "threshold": { "type": "number", "maximum": 1, "minimum": 0, "description": "0–1 inclusive probability cutoff." } }, "description": "Probability-based likelihood policy.", "additionalProperties": false }, { "type": "object", "required": [ "metric", "threshold" ], "properties": { "metric": { "type": "string", "const": "percentile", "description": "Population rank metric; not probability." }, "threshold": { "type": "number", "maximum": 1, "minimum": 0, "description": "0–1 inclusive percentile cutoff." } }, "description": "Percentile-based likelihood policy.", "additionalProperties": false } ], "description": "Select one likelihood metric and threshold; omitted uses EPSS >= 0.10." }, "batchOffset": { "type": "integer", "default": 0, "maximum": 9007199254740991, "minimum": 0, "description": "Resume in first-occurrence normalized unique input order; resubmit the original cves, returned score date and original policy/severity inputs." }, "severityThreshold": { "type": "number", "default": 7, "maximum": 10, "minimum": 0, "description": "Inclusive high severity threshold, default 7." } }, "additionalProperties": false }