Cursor
Grok Bot
Grok
MuseTitle99/100
Get vulnerability
The title clearly communicates the tool’s action and subject. Keep it concise.
Description97/100
Get one vulnerability entry by CVE, GHSA or OSV id, as JSON. Includes CISA SSVC decision points (exploitation, automatable, technicalImpact) when CISA published them, and, when cve.now has read the vendor advisory, context (a plain sentence, sourced conditions, vendor severity, fix, FAQ) with exposure: Actively exploited, Default setups, Specific setups only or Unclear. fixedIn lists the fixed versions cve.now leads with: the vendor's own, without distro package builds or another product's versions. fixedInByProduct lists each affected product's fixed versions (product, versions), the entry's own product first, then products that ship the bug, such as Node.js on a Brotli CVE. fixStatus, when cve.now has registry data for an affected npm, PyPI, Go, Maven, crates.io or NuGet package, gives per package: status (fixed or none, meaning no fix is released), the fixed versions with their release dates and days from disclosure (negative when the fix shipped before the advisory), and the latest release with whether it is still affected. downloadExposure, for affected npm and crates.io packages, gives per package the share of its downloads that were affected versions: ecosystem, package, window (last-week on npm, 90d on crates.io), affectedShare (0 to 1), affectedDownloads, totalDownloads and asOf (when the counts were read). Counts are registry downloads, not users or installs: CI runs and mirrors inflate them.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
id
CVE, GHSA or OSV id, e.g. CVE-2026-12345
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
Annotations100/100
All four behavior hints are declared.
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}Output schema67/100
Declare the result fields and their types in the output schema.
View output schema
{
"type": "object",
"properties": {
"id": {
"description": "The entry id (CVE, GHSA or OSV)"
},
"title": {
"description": "Short title"
},
"fixedIn": {
"description": "Fixed versions cve.now leads with"
},
"exposure": {
"description": "Actively exploited, Default setups, Specific setups only or Unclear"
},
"severity": {
"description": "Severity rating"
},
"fixStatus": {
"description": "Per registry package: fixed versions with release dates and days from disclosure, whether any fix is released, and whether the latest release is still affected; absent without registry data"
},
"downloadExposure": {
"description": "Per npm or crates.io package: the share of its downloads in the window (last-week or 90d) that were affected versions, with the affected and total download counts and when they were read; absent without download data"
},
"fixedInByProduct": {
"description": "Fixed versions per affected product"
}
},
"description": "One vulnerability entry",
"additionalProperties": true
}