VulnSea for agentic workflows

VulnSea is built to be read by machines first. Every vulnerability is a structured markdown document with stable YAML frontmatter, mirrored as JSON and exposed through an incremental, cache-aware HTTP API. That makes it a clean knowledge source to wire directly into an agent loop — for automated triage, vulnerability management, and risk assessment — without scraping HTML or parsing prose.

API usage guide →OpenAPI 3.1 spec ↗/llms.txt ↗

Try it in ten seconds

No account needed: paste your dependencies (a package.json, requirements.txt, or go.mod) and see which are hit by known CVEs, ranked by our depth score — a single 0–100 urgency number that blends CVSS, EPSS, and proof of exploitation. Check pipeline freshness anytime on the status page.

Why it fits agents

Stable structure. Frontmatter fields (id, severity, cvss, epss, kev, exploited, affected/patched) are typed and consistent — safe to branch on without an LLM call.
Two depths. Scan a compact /api/digest line per CVE for cheap filtering, then pull the full /cve/<id>.md only for the ones that survive triage — keeps token cost down.
Delta-first. An ingestedAt high-water mark + cursor paging means the agent only ever processes what is new since its last run.
Cheap idle. If-None-Match → 304 when nothing changed, so a frequent poll costs almost nothing.
Self-describing. Point any tool-use model or codegen at /openapi.json to mint a typed client or agent tool automatically.

Pattern 1 — Automated triage loop

A scheduled agent that watches for new vulnerabilities, filters to what matters to you, and escalates. Cheap to run on a tight schedule.

Poll the delta

Ask for everything ingested after your high-water mark, oldest → newest, paging on next until it is null. Send the last ETag to short-circuit when idle.

AUTH="Authorization: Bearer vsk_your_key"
curl -H "$AUTH" -H "If-None-Match: $ETAG" \
     "https://beta.vulnsea.com/api/digest?since=$HWM&order=asc&format=ndjson"
#   304 => nothing new, sleep   |   200 => one CVE per line

Filter without an LLM

Branch on structured fields first — no model tokens spent on noise. Typical gate: kev=true OR exploited=true OR severity=critical OR epss over your threshold, intersected with vendors/products in your asset inventory.

# server-side narrowing also supported:
curl -H "$AUTH" \
  "https://beta.vulnsea.com/api/cve?since=$HWM&severity=critical,high&exploited=true&order=asc"

Deep-read survivors

For each CVE that passes the gate, fetch the canonical markdown and feed it straight to the model as context — no HTML parsing.

curl -H "$AUTH" https://beta.vulnsea.com/cve/CVE-2021-44228.md

Decide & route

Have the model map the CVE against your stack and emit a structured verdict (affected? exploit maturity? fix available? owner?), then route: open a ticket, post to chat, or page on-call. Advance the high-water mark and ETag, then sleep.

Pattern 2 — Continuous vuln management

Keep a running picture of exposure across your inventory rather than reacting per-CVE.

Inventory join. Match vendor/product and affected/patched version ranges against your SBOM/CMDB to flag what you actually run — or hand a component list to POST /api/sbom (and the triage_sbom MCP tool) and let VulnSea do the matching.
Prioritize with signal. Rank by kev → exploited → epss → cvss so remediation effort tracks real-world risk, not just base score.
Saved searches. Persist your standing queries (e.g. critical KEV affecting nginx) and let the agent re-run them each cycle — see your account.
Close the loop. Re-query patched versions to auto-verify remediation and burn down the backlog.

Pattern 3 — On-demand risk assessment

Answer a point question — "are we exposed to X?" — by giving a model the search and read tools and letting it investigate.

# 1. find candidates
curl -H "$AUTH" "https://beta.vulnsea.com/api/search?q=log4shell&kev=true"
# 2. pull full detail for the model to reason over
curl -H "$AUTH" https://beta.vulnsea.com/api/cve/CVE-2021-44228
curl -H "$AUTH" https://beta.vulnsea.com/cve/CVE-2021-44228.md

Search is typo-tolerant (FTS5). Use /api/search to locate, /api/cve/<id> for structured facts, and the .md for narrative the model can cite.

Wiring it into a model

Minimal, high-leverage tool surface to expose to a tool-use agent:

search_cves(q, severity?, kev?) → /api/search
list_new_cves(since, order=asc) → /api/cve (cursor paging)
get_cve(id) → /api/cve/<id> (structured)
read_cve_markdown(id) → /cve/<id>.md (narrative)

All four are described in https://beta.vulnsea.com/openapi.json — generate the tool definitions instead of hand-writing them.

Access model

The whole corpus is free and needs no auth. Anonymous callers are rate-limited per IP; send an API key (or call from a logged-in session) for a higher limit. See the API usage guide for auth, paging, and caching detail.

Data sources & attribution

VulnSea does not originate vulnerability data. Every record is aggregated from the public sources below, normalised, and enriched; each source remains the authority for its own content and stays subject to its own terms. The current freshness of each feed is on the status page.

NVDNational Institute of Standards and Technology
CVE descriptions, CVSS metrics, CWE and CPE data come from the National Vulnerability Database via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.
CVE ProgramThe MITRE Corporation, on behalf of the CVE Program
CVE identifiers and CVE Records are used under the CVE Terms of Use. CVE® is a registered trademark of The MITRE Corporation.
GitHub Advisory DatabaseGitHub, Inc.
Package-ecosystem advisories (GHSA) are sourced from the github/advisory-database repository, licensed under Creative Commons Attribution 4.0 International (CC-BY 4.0).
EPSSFIRST.org, Inc.
Exploit Prediction Scoring System scores and percentiles are provided by FIRST.org and used per the EPSS usage terms. EPSS is a community effort of the FIRST EPSS Special Interest Group.
CISA KEVCybersecurity and Infrastructure Security Agency
Known-exploited flags and due dates come from the Known Exploited Vulnerabilities Catalog, a U.S. Government work in the public domain.
Exploit-DBOffSec
Public exploit availability is cross-referenced against the Exploit Database maintained by OffSec.
inthewild.iointhewild.io
In-the-wild exploitation reports are drawn from inthewild.io.
OSV.devOpen Source Vulnerabilities
Additional open-source ecosystem advisories (PYSEC, RUSTSEC, Go) come from OSV.dev; each advisory is subject to the license of the ecosystem database that publishes it.
Red Hat CSAFRed Hat, Inc.
Vendor advisories, product status and Red Hat's own CVSS come from the Red Hat CSAF security data, licensed under CC-BY 4.0.
Cisco CSAFCisco Systems, Inc.
Cisco security advisories are read from Cisco's CSAF provider and remain subject to Cisco's terms of use.

VulnSea's own presentation, scoring (depth score) and API are ours; see Terms of Service § 6 — Intellectual property for how source data and our work are treated, and the Privacy Policy for what we collect about you.

Follow along:Bluesky LinkedIn