# Changelog

All notable changes to CVE MCP Server are documented here.
This project follows [Semantic Versioning](https://semver.org/).

## [Unreleased]

### Added
- (Next release items go here)

## [0.2.0] — 2026-06-22

### Added
- **`triage_cve` orchestrator tool** — one-call CVE triage that fans out NVD + EPSS + CISA KEV (+ public PoC discovery for `depth != "quick"`) concurrently via `utils.fanout.fan_out`, computes the composite risk score, and returns a formatted report. `depth` is `quick` / `standard` (default) / `deep`; `deep` additionally emits an SSVC v2 gated decision (`utils.ssvc.ssvc_decision`).
- **Transparent NVD fallback** — when NIST NVD is unreachable/throttled, `triage_cve` automatically falls back to the VulnCheck NVD++ index (`api.vulncheck_client.fetch_cve_vulncheck`).
- **New upstream sources** — VulnCheck NVD++, CIRCL hashlookup (`hashlookup.circl.lu`), and the HIBP Pwned Passwords range API (`api.pwnedpasswords.com`); the latter two require no API key.
- **MCP resources** — `kev://catalog` (pre-warmed KEV catalog summary), `epss://scores/{cve_id}` (per-CVE EPSS score), and `manifest://tool-hash` (SHA-256 over the canonical JSON of every registered tool's `{name, description, inputSchema}`, sorted).
- **MCP prompts** — `patch_decision(cve_id, asset_context="internet-facing")`, `compare_and_prioritize`, and `dependency_triage`, all guiding the model to call `triage_cve`.
- **Streamable-HTTP transport** — `MCP_TRANSPORT=http` serves streamable-HTTP on `HOST:PORT` (default `0.0.0.0:8000`, stateless); anything else keeps stdio. Bundled `Dockerfile` + `.dockerignore`.
- `health_check` now also reports the scoring version, the tool-manifest hash, cache read-back status, KEV catalog size, and which optional API keys are configured (names/yes-no only — never the key values).

### Changed
- **KEV hard-override scoring** — a CISA KEV-listed CVE is now always labelled `CRITICAL` with a risk score clamped to `≥ 76`, regardless of CVSS/EPSS (KEV = confirmed in-the-wild exploitation). The linear weighted sum remains the v1 default for the numeric score otherwise.
- Risk scorer now reports `scoring_version` (`"1.0"`) and documents CVSS as a *severity* (not exploitation-likelihood) signal in its component breakdown (per Allodi & Massacci 2014).
- SQLite cache opens with WAL journal mode + tuned pragmas (`synchronous=NORMAL`, `busy_timeout`, `temp_store=MEMORY`, `cache_size`) for better concurrency on local disk.

### Security
- The server **never registers a sampling handler / never issues `sampling/createMessage`** (Unit 42 MCP-sampling prompt-injection / exfiltration attack vector).
- Added outbound URL hardening helpers (`validators.validate_scheme`, `validate_outbound_url`, DNS-resolution SSRF check) and extended the host allowlist to the new sources.
- Secrets are wrapped in `pydantic.SecretStr` (`config.SECRETS` / `get_secret` / `redact`) for masked storage; `health_check` reports key presence without revealing values.

## [0.1.0] — 2026-04-14

### Added
- Initial public release with 27 MCP security intelligence tools across 21 APIs
- **Core Vulnerability Intelligence (8 tools):** `lookup_cve`, `search_cves`, `get_epss_score`, `check_kev`, `parse_cvss`, `get_cve_summary`, `check_package_vulns`, `health_check`
- **Exploit & ATT&CK Intelligence (4 tools):** `check_exploit_availability`, `get_vendor_advisory`, `get_attack_mapping`, `get_cve_timeline`
- **Advanced Risk & Reporting (4 tools):** `check_poc_exists`, `calculate_risk_score`, `generate_vuln_report`, `compare_cves`
- **Network Intelligence (4 tools):** `check_ip_reputation`, `get_domain_intel`, `passive_dns_lookup`, `shodan_host_lookup`
- **Threat Intelligence (4 tools):** `lookup_file_hash`, `check_url_safety`, `lookup_malware_family`, `check_ransomware_intel`
- **DevSecOps (3 tools):** `scan_dependencies`, `scan_container_packages`, `scan_repo_secrets`
- Composite risk scoring engine: CVSS×0.20 + EPSS×0.35 + KEV×0.30 + PoC×0.15 with boost multipliers
- PoC confidence ladder: WEAPONIZED → PUBLIC_EXPLOIT_REMOTE → PUBLIC_EXPLOIT → PUBLIC_POC_HIGH_QUALITY → PUBLIC_POC_LOW_QUALITY → NONE
- aiosqlite response cache with per-source TTLs (1h CVEs, 6h EPSS, 24h ATT&CK)
- Token bucket rate limiter for NVD API (5 req/30s without key, 50 req/30s with key)
- Private IP blocking for all network tools (RFC 1918, loopback, link-local)
- `defusedxml` protection for all XML parsing
- Structured audit logging — no keys, no payloads, timing and status only
- GreyNoise v3 API support (`/v3/ip/{ip}` — the `/v3/community` endpoint was deprecated January 2026)
- CIRCL Passive DNS with HTTP Basic Auth
