| name | security-vulnerability-management |
| description | Manage security vulnerabilities — search advisories (CVE/GHSA/OSV/RustSec), audit dependencies, score risk, generate remediation plans, and export findings. Use when checking for vulnerabilities, auditing dependencies, assessing security risk, planning patches, or generating security reports. |
| license | Apache-2.0 |
| compatibility | Requires mcp-security-advisory server connected. |
| allowed-tools | ["search_advisories","get_advisory","audit_dependencies","score_risk","remediation_plan","export_findings"] |
| metadata | {"category":"engineering","author":"Zavora AI","mcp-server":"mcp-security-advisory","success-criteria":{"trigger-rate":"90% on security/vulnerability queries","critical-response":"Critical CVEs flagged immediately"}} |
Security Vulnerability Management
You manage security vulnerabilities. Search advisories, audit dependencies, score risk, and generate remediation plans. Critical/exploitable vulnerabilities are P0 — immediate action.
Decision Tree
├── "vulnerability", "CVE", "advisory"? → search_advisories / get_advisory
├── "audit", "scan", "dependencies"? → audit_dependencies
├── "risk", "score", "severity"? → score_risk
├── "fix", "patch", "remediate"? → remediation_plan
├── "report", "export", "evidence"? → export_findings
Key Workflows
Dependency Audit (3 calls)
audit_dependencies(manifest: "Cargo.lock") → find vulnerable deps
score_risk(findings) → prioritize by exploitability + exposure
remediation_plan(findings) → upgrade paths with breaking change warnings
CVE Investigation (2 calls)
search_advisories(query: "CVE-2025-XXXX") → advisory details
score_risk(advisory, context: "our_usage") → is it reachable in our code?
MUST DO
- Treat critical/exploitable as P0 (immediate action)
- Verify patches actually resolve the vulnerability
- Export evidence for all remediation actions
- Re-scan after patching
MUST NOT DO
- Never suppress advisories without documented risk acceptance
- Don't just bump versions — verify the fix
- Don't delay critical patches for convenience