# Changelog

All notable changes to CVE MCP Server are documented here.
This project follows [Semantic Versioning](https://semver.org/).

## [Unreleased]

### Added
- (Next release items go here)

## [0.1.0] — 2026-04-14

### Added
- Initial public release with 27 MCP security intelligence tools across 21 APIs
- **Core Vulnerability Intelligence (8 tools):** `lookup_cve`, `search_cves`, `get_epss_score`, `check_kev`, `parse_cvss`, `get_cve_summary`, `check_package_vulns`, `health_check`
- **Exploit & ATT&CK Intelligence (4 tools):** `check_exploit_availability`, `get_vendor_advisory`, `get_attack_mapping`, `get_cve_timeline`
- **Advanced Risk & Reporting (4 tools):** `check_poc_exists`, `calculate_risk_score`, `generate_vuln_report`, `compare_cves`
- **Network Intelligence (4 tools):** `check_ip_reputation`, `get_domain_intel`, `passive_dns_lookup`, `shodan_host_lookup`
- **Threat Intelligence (4 tools):** `lookup_file_hash`, `check_url_safety`, `lookup_malware_family`, `check_ransomware_intel`
- **DevSecOps (3 tools):** `scan_dependencies`, `scan_container_packages`, `scan_repo_secrets`
- Composite risk scoring engine: CVSS×0.20 + EPSS×0.35 + KEV×0.30 + PoC×0.15 with boost multipliers
- PoC confidence ladder: WEAPONIZED → PUBLIC_EXPLOIT_REMOTE → PUBLIC_EXPLOIT → PUBLIC_POC_HIGH_QUALITY → PUBLIC_POC_LOW_QUALITY → NONE
- aiosqlite response cache with per-source TTLs (1h CVEs, 6h EPSS, 24h ATT&CK)
- Token bucket rate limiter for NVD API (5 req/30s without key, 50 req/30s with key)
- Private IP blocking for all network tools (RFC 1918, loopback, link-local)
- `defusedxml` protection for all XML parsing
- Structured audit logging — no keys, no payloads, timing and status only
- GreyNoise v3 API support (`/v3/ip/{ip}` — the `/v3/community` endpoint was deprecated January 2026)
- CIRCL Passive DNS with HTTP Basic Auth
