Starstruk Logo MarkStarstruk

v0.2.0

UNITRONIX/BetterDeskv0.2.0Jun 22, 2026by mukul975

AI Summary

This release introduces a new `triage_cve` orchestrator for concurrent CVE analysis using multiple data sources, alongside significant security hardening measures. It features new data sources, enhanced MCP capabilities with new resources and prompts, and infrastructure improvements for reliability and security.

Key Highlights

  • Introduction of the `triage_cve` orchestrator for concurrent checks against NVD, EPSS, CISA KEV, and PoC discovery with SSVC v2 decision support.
  • Comprehensive security hardening including removal of sampling handlers, SSRF defense, and centralized secrets management.
  • New data sources (VulnCheck NVD++, CIRCL, HIBP) and enhanced MCP capabilities with new resources, prompts, and HTTP transport.
  • Infrastructure improvements such as multi-stage non-root Dockerfiles and SQLite WAL pragmas for concurrent reads.

New Features

  • Added `triage_cve` orchestrator tool with depth options (quick/standard/deep) and composite risk scoring.
  • VulnCheck NVD++ fallback for when NIST NVD is unreachable or throttled.
  • CIRCL hashlookup integration for known-good allowlists.
  • HIBP Pwned Passwords range API integration using keyless k-anonymity.
  • New MCP Resources: `kev://catalog`, `epss://scores/{cve_id}`, and `manifest://tool-hash`.
  • New MCP Prompts: `patch_decision`, `compare_and_prioritize`, and `dependency_triage`.
  • Streamable-HTTP transport support via `MCP_TRANSPORT=http`.
  • CISA KEV hard override logic ensuring KEV-listed CVEs are always CRITICAL.
  • Multi-stage non-root Dockerfile and SQLite WAL pragmas for concurrent reads.
  • Null-object rate limiter and fixed-interval deterministic retry logic.

Full Release Notes

## CVE MCP Server v0.2.0

A major feature release. **Additive** — all existing tools remain registered; the new `triage_cve` orchestrator is the recommended entry point.

### ⭐ Orchestration
- **`triage_cve`** — one tool call fans out NVD + EPSS + CISA KEV (+ public PoC discovery) concurrently, computes the composite risk score, and returns a clean report. `depth` = `quick` / `standard` / `deep`; **`deep`** also emits an SSVC v2 gated decision (CISA Deployer model → `Act` / `Attend` / `Track*` / `Track`).
- Transparent **VulnCheck NVD++ fallback** used automatically when NIST NVD is unreachable or throttled.

### 🎯 Scoring
- **CISA KEV hard override** — a KEV-listed CVE is always **CRITICAL** (score clamped ≥ 76), regardless of CVSS/EPSS.
- **`scoring_version`** stamped into `triage_cve`, `calculate_risk_score`, and `health_check`.
- CVSS reframed as a **severity** signal (not exploitation-likelihood), per Allodi & Massacci 2014.

### 🔌 New data sources
- **VulnCheck NVD++** (NVD-schema fallback), **CIRCL hashlookup** (known-good allowlist), **HIBP Pwned Passwords** range API (keyless k-anonymity).

### 🧩 MCP enhancements
- **Resources**: `kev://catalog`, `epss://scores/{cve_id}`, `manifest://tool-hash` (SHA-256 over the registered tool surface).
- **Prompts**: `patch_decision`, `compare_and_prioritize`, `dependency_triage`.
- **Streamable-HTTP transport** via `MCP_TRANSPORT=http` (stdio remains the default).
- Expanded `health_check` (scoring version, manifest hash, configured-key status).

### 🔐 Security hardening
- Server **never** registers a sampling handler / never issues `sampling/createMessage` (Unit 42 MCP-sampling attack vector).
- **SSRF** defense: scheme allowlist + resolve-then-validate (rejects private/reserved IPs).
- Secrets centralized as Pydantic `SecretStr`.

### 🏗️ Infrastructure
- Multi-stage non-root **Dockerfile** + `.dockerignore`.
- SQLite **WAL** pragmas for concurrent reads; null-object rate limiter; fixed-interval deterministic retry; async fan-out helper; static Admiralty source-trust table.

**Verified:** ruff clean, 30/30 tests passing.

**Full Changelog:** https://github.com/mukul975/cve-mcp-server/compare/v0.1.0...v0.2.0


## What's Changed
* fix(7): set correct default values for cache and audit by @fergoid in https://github.com/mukul975/cve-mcp-server/pull/8

## New Contributors
* @fergoid made their first contribution in https://github.com/mukul975/cve-mcp-server/pull/8

**Full Changelog**: https://github.com/mukul975/cve-mcp-server/compare/v0.1.0...v0.2.0