Cve Lookup

Context for a CVE — CVSS, CISA KEV, EPSS, SSVC, exploit and patch signals, and the CVE's internet-exposure footprint — as a CLI and a local MCP server.

It reads the EchelonGraph CVE Pulse public API, which fuses NVD, MITRE-CNA (pre-NVD), CISA KEV, FIRST EPSS, GitHub advisories and SSVC into one record per CVE. No API key, no account.

Among the sibling lookup tools, this is the licence-free answer to "what is this CVE, how bad is it, and is it being exploited?". otx-lookup then tells you which campaigns use it, and gti-lookup adds Google's curated context where a commercial licence exists.

• No verdict of its own. The vendor's fused score is reported as the vendor's, next to the raw CVSS / KEV / EPSS it was built from.
• A negative answer is never manufactured. A CVE the exposure radar does not track is reported as untracked, not as "0 hosts"; an upstream failure is an error, not "not found".
• Read-only by design. No writes, no subscriptions, no scanning.

Only a third-party index is read, so no packet reaches any party under investigation. A query is attributed to your IP address only. The words of a search and the vendor and product names of a match do reach EchelonGraph.

Requirements

• Network access to app.echelongraph.io. Nothing else: no key, no account, no runtime.

Installation

Homebrew (macOS arm64, Apple-notarized build):

brew install nlink-jp/tap/cve-lookup

Or download an archive for your platform from the releases page (darwin-arm64 zip is notarized; linux amd64/arm64 tar.gz; windows amd64 zip).

Or build from source:

make build        # → dist/cve-lookup

Configuration

None is needed. To change a default, copy config.example.toml to ~/.config/cve-lookup/config.toml. The file is looked for in $XDG_CONFIG_HOME/cve-lookup/, then ~/.config/cve-lookup/, then (macOS) ~/Library/Application Support/cve-lookup/; cve-lookup cache status prints which one was read. A section or key the tool does not know is an error, and so are a --config path that does not exist, a key set to "", and a number out of its range (default_limit is 1-200, upstream's page ceiling). Environment variables override the file: CVE_LOOKUP_BASE_URL, CVE_LOOKUP_DEFAULT_LIMIT, CVE_LOOKUP_CACHE_DIR, CVE_LOOKUP_CVE_TTL_MINUTES, CVE_LOOKUP_EXPOSURE_TTL_MINUTES, CVE_LOOKUP_SEARCH_TTL_MINUTES, CVE_LOOKUP_TIMEOUT_SECONDS and CVE_LOOKUP_REQUESTS_PER_MINUTE — the example file documents every setting.

Commands

cve-lookup get <CVE-ID>...          CVSS, KEV, EPSS, SSVC, exploit and patch signals for a CVE
cve-lookup search [<text>]          Search CVE descriptions; filter by severity, KEV, year, ...
cve-lookup match                    CVEs affecting a product (--product, optional --vendor)
cve-lookup exposure <CVE-ID>        Internet-exposure footprint of a CVE
cve-lookup related <CVE-ID>         CVEs sharing a product, a vendor advisory or a CWE
cve-lookup advisories               Vendor advisories, newest first (--vendor, --has-cve, --no-cve)
cve-lookup advisory <vendor> <id>   One vendor advisory in full, by the vendor's own ID
cve-lookup status                   Feed freshness and counts by severity (always live)
cve-lookup cache status|clear       Inspect or clear the result cache
cve-lookup mcp                      Run as a local MCP server (stdio)
cve-lookup version                  Print the version

cve-lookup get CVE-2021-44228                       # the whole picture for one CVE
cve-lookup get CVE-2021-44228 --section references  # one large section in full
cve-lookup search tomcat --kev --sort epss          # KEV-listed CVEs mentioning "tomcat"
cve-lookup match --vendor f5 --product nginx        # CVEs that apply to a product
cve-lookup exposure CVE-2023-44487                  # how exposed the internet is
cve-lookup related CVE-2021-44228                   # its neighbours, and what ties them
cve-lookup advisories --vendor redhat --no-cve      # disclosed by the vendor, no CVE ID yet
cve-lookup advisory github GHSA-xxxx-xxxx-xxxx      # one advisory: CVEs, products, remediation
cve-lookup get CVE-2021-44228 --json | jq .kev      # complete JSON for pipelines

Vendor advisories come from Microsoft, Red Hat, GitHub, Cisco, AWS, Google Cloud and GitLab (--vendor aws|cisco|gcp|github|gitlab|microsoft|redhat). There is no text search over advisories upstream; filter by vendor and page, or start from a CVE — related names the advisory that ties two CVEs together.

Flags may come before or after the target. --json is complete (nothing is trimmed), --refresh bypasses the cache, --timeout <seconds> overrides the configured network timeout (above 0, at most 3600), and get --raw prints upstream's own JSON document, bookkeeping fields included — the same document for a parser, not always the same bytes: the characters a terminal obeys are escaped (below), a carriage return between tokens becomes a newline, and a copy served from the cache is compacted, with <, > and & inside strings written as \u003c, \u003e and \u0026. A numeric flag is either left out or given a value inside its range: --limit 0, --year 0 and --min-cvss NaN are refused, not read as the flag's absence.

Text output is for a terminal, and CVE descriptions and advisory prose are written by third parties: every control character, escape sequence and bidirectional override in upstream's data is shown as an escape (\x1b, \u202e), never obeyed, and multi-line text is printed behind a | gutter. --json and --raw stay the same documents for a parser, with those few characters written as the \u escapes they equal.

Reading the answers:

• absent lists the blocks upstream holds no data for. Absent is not negative: a CVE published today has no EPSS yet, which says nothing about its risk.
• search looks through the free text of CVE descriptions. Whether a product is affected is what match answers, by CPE vendor and product tokens (nginx, linux_kernel, http_server). A search with no hits is not evidence that a product is unaffected. match sends no version upstream.
• match says product_known: false when upstream does not know the product token — that is "unknown product", not "no CVEs".
• match --vendor does not filter. Upstream keeps every CVE that matches the product name and marks the rows whose vendor it could not confirm. --vendor microsoft --product nginx returns F5's nginx CVEs, each marked vendor_unverified; the headline then reads VENDOR NOT CONFIRMED, and vendor_unverified in the JSON counts such rows (it equals the row count when the vendor matched nothing).
• related with three empty lists is either "upstream indexes this CVE and relates nothing to it" (a note says so) or INCOMPLETE — upstream sends the same empty lists for a CVE it has never heard of, and the check that tells the two apart could not be made. INCOMPLETE exits 1 and sets "incomplete": true; it is not an answer.
• exposure says tracked: false when upstream's radar does not follow the CVE — that is not "nobody is exposed".
• "Not in EchelonGraph's index" is what a not_found means. It is not a statement that the CVE does not exist.
• The EchelonGraph score is one vendor's model, shown beside the raw CVSS, KEV and EPSS it was built from.

Exit codes: 0 every query was answered — an empty answer, "not tracked" and "not in the index" are answers; 1 upstream could not be asked, or not fully (an INCOMPLETE related included); 2 usage or configuration error.

MCP server

cve-lookup mcp speaks MCP over stdio. Register it with your client as a stdio server whose command is the binary and whose only argument is mcp:

{
  "mcpServers": {
    "cve-lookup": { "command": "/path/to/cve-lookup", "args": ["mcp"] }
  }
}

Tool	What it answers
get_cve	What is this CVE, how bad, is it exploited, is there a patch? Compact by default; section pages cpe / references / score_factors / description in full
match_product	Which CVEs apply to this product (CPE vendor and product tokens)?
search_cves	Free-text search over descriptions, with severity / KEV / year / CVSS filters
get_exposure	How much of the internet is exposed to this CVE?
get_related	Which other CVEs sit next to this one — same product, same vendor advisory, same CWE?
search_advisories	What have vendors disclosed lately, including what has no CVE ID yet?
get_advisory	What does this vendor advisory say? Compact by default; section pages description / remediation / affected_products / references / cve_ids in full
feed_status	Is upstream's feed alive and fresh? (always live)
cache_status	State of the local result cache
get_usage	The embedded manual: arguments, result schemas, how to read the answers, error recovery

get_usage is the canonical tool reference. A tool result is sized for a model's context: the default get_cve answer keeps the scalar blocks whole, caps the two large lists and says how many entries it left out; everything left out is reachable through section, paged. Behind those caps sit two backstops: any other single string over 1000 characters is shortened and named in a note, and no result leaves the server over 128 KB — it is withheld whole as response_too_large rather than cut at an arbitrary byte. The CLI's --json is always complete.

Arguments are decoded strictly by every tool: one a tool does not declare is an invalid_argument error that names it, never ignored.

Descriptions, reference URLs and advisory prose in results are third-party text — anyone can get a CVE description published. They are passed as data fields only.

Data source and terms

All data comes from the EchelonGraph public API and is subject to their terms. The API is free and documented at https://echelongraph.io/pulse/api; it allows 60 requests per minute per IP address. Each cve-lookup process paces itself at half of that by default, because every process on the address — a shell loop, the MCP server of each agent runtime — spends from the same 60. Raise requests_per_minute only when one process has the address to itself.

The free API carries no service-level commitment. When it cannot be reached the tool reports an upstream error rather than an empty answer, and base_url is configurable should the host move.

Documentation

• Design (RFP), Japanese / English

Acknowledgements

EchelonGraph's own MCP server, echelongraph-mcp (MIT), was the reference for the tool surface. This project is an independent Go implementation and shares no code with it.

License

MIT — see LICENSE.