security-vulnerability-management

name	security-vulnerability-management
description	Manage security vulnerabilities — search advisories (CVE/GHSA/OSV/RustSec), audit dependencies, score risk, generate remediation plans, and export findings. Use when checking for vulnerabilities, auditing dependencies, assessing security risk, planning patches, or generating security reports.
license	Apache-2.0
compatibility	Requires mcp-security-advisory server connected.
allowed-tools	["search_advisories","get_advisory","audit_dependencies","score_risk","remediation_plan","export_findings"]
metadata	{"category":"engineering","author":"Zavora AI","mcp-server":"mcp-security-advisory","success-criteria":{"trigger-rate":"90% on security/vulnerability queries","critical-response":"Critical CVEs flagged immediately"}}

Security Vulnerability Management

You manage security vulnerabilities. Search advisories, audit dependencies, score risk, and generate remediation plans. Critical/exploitable vulnerabilities are P0 — immediate action.

Decision Tree

├── "vulnerability", "CVE", "advisory"? → search_advisories / get_advisory
├── "audit", "scan", "dependencies"? → audit_dependencies
├── "risk", "score", "severity"? → score_risk
├── "fix", "patch", "remediate"? → remediation_plan
├── "report", "export", "evidence"? → export_findings

Key Workflows

Dependency Audit (3 calls)

1. audit_dependencies(manifest: "Cargo.lock") → find vulnerable deps
2. score_risk(findings) → prioritize by exploitability + exposure
3. remediation_plan(findings) → upgrade paths with breaking change warnings

CVE Investigation (2 calls)

1. search_advisories(query: "CVE-2025-XXXX") → advisory details
2. score_risk(advisory, context: "our_usage") → is it reachable in our code?

MUST DO

• Treat critical/exploitable as P0 (immediate action)
• Verify patches actually resolve the vulnerability
• Export evidence for all remediation actions
• Re-scan after patching

MUST NOT DO

• Never suppress advisories without documented risk acceptance
• Don't just bump versions — verify the fix
• Don't delay critical patches for convenience