Starstruk Logo MarkStarstruk

v0.2.0

NVIDIA/NeMo-Speech.cppv0.2.0Jun 22, 2026by mukul975

AI Summary

This release introduces a new `triage_cve` orchestrator for concurrent CVE risk assessment and implements significant security hardening measures. It adds new data sources and refines scoring logic while maintaining backward compatibility with existing tools.

Key Highlights

  • New `triage_cve` orchestrator for concurrent analysis of NVD, EPSS, and CISA KEV data.
  • Security hardening including SSRF defense and removal of vulnerable sampling handlers.
  • Integration of new data sources like VulnCheck NVD++ and HIBP Pwned Passwords.
  • CISA KEV hard override ensuring critical severity for known exploited vulnerabilities.
  • Support for Streamable-HTTP transport and expanded MCP resources.

New Features

  • New `triage_cve` orchestrator with depth levels (quick/standard/deep) and SSVC v2 decision gating.
  • CISA KEV hard override (score clamped to ≥ 76) for known exploited vulnerabilities.
  • VulnCheck NVD++ fallback for NIST NVD unreachability or throttling.
  • CIRCL hashlookup integration for known-good allowlists.
  • HIBP Pwned Passwords range API integration.
  • Streamable-HTTP transport support via `MCP_TRANSPORT=http`.
  • New MCP resources (`kev://catalog`, `epss://scores/{cve_id}`, `manifest://tool-hash`).
  • SSRF defense with scheme allowlist and resolve-then-validate IP validation.
  • Centralized Secrets management using Pydantic `SecretStr`.

Full Release Notes

## CVE MCP Server v0.2.0

A major feature release. **Additive** — all existing tools remain registered; the new `triage_cve` orchestrator is the recommended entry point.

### ⭐ Orchestration
- **`triage_cve`** — one tool call fans out NVD + EPSS + CISA KEV (+ public PoC discovery) concurrently, computes the composite risk score, and returns a clean report. `depth` = `quick` / `standard` / `deep`; **`deep`** also emits an SSVC v2 gated decision (CISA Deployer model → `Act` / `Attend` / `Track*` / `Track`).
- Transparent **VulnCheck NVD++ fallback** used automatically when NIST NVD is unreachable or throttled.

### 🎯 Scoring
- **CISA KEV hard override** — a KEV-listed CVE is always **CRITICAL** (score clamped ≥ 76), regardless of CVSS/EPSS.
- **`scoring_version`** stamped into `triage_cve`, `calculate_risk_score`, and `health_check`.
- CVSS reframed as a **severity** signal (not exploitation-likelihood), per Allodi & Massacci 2014.

### 🔌 New data sources
- **VulnCheck NVD++** (NVD-schema fallback), **CIRCL hashlookup** (known-good allowlist), **HIBP Pwned Passwords** range API (keyless k-anonymity).

### 🧩 MCP enhancements
- **Resources**: `kev://catalog`, `epss://scores/{cve_id}`, `manifest://tool-hash` (SHA-256 over the registered tool surface).
- **Prompts**: `patch_decision`, `compare_and_prioritize`, `dependency_triage`.
- **Streamable-HTTP transport** via `MCP_TRANSPORT=http` (stdio remains the default).
- Expanded `health_check` (scoring version, manifest hash, configured-key status).

### 🔐 Security hardening
- Server **never** registers a sampling handler / never issues `sampling/createMessage` (Unit 42 MCP-sampling attack vector).
- **SSRF** defense: scheme allowlist + resolve-then-validate (rejects private/reserved IPs).
- Secrets centralized as Pydantic `SecretStr`.

### 🏗️ Infrastructure
- Multi-stage non-root **Dockerfile** + `.dockerignore`.
- SQLite **WAL** pragmas for concurrent reads; null-object rate limiter; fixed-interval deterministic retry; async fan-out helper; static Admiralty source-trust table.

**Verified:** ruff clean, 30/30 tests passing.

**Full Changelog:** https://github.com/mukul975/cve-mcp-server/compare/v0.1.0...v0.2.0


## What's Changed
* fix(7): set correct default values for cache and audit by @fergoid in https://github.com/mukul975/cve-mcp-server/pull/8

## New Contributors
* @fergoid made their first contribution in https://github.com/mukul975/cve-mcp-server/pull/8

**Full Changelog**: https://github.com/mukul975/cve-mcp-server/compare/v0.1.0...v0.2.0