Using prompts

Invoking one

Claude Code

Prompts appear as namespaced slash commands:

/mcp__vulnetix__vulnetix_vuln CVE-2021-44228
/mcp__vulnetix__vulnetix_incident_respond CVE-2021-44228
/mcp__vulnetix__vulnetix_dep_add_guard left-pad --ecosystem npm

Type /mcp__vulnetix__ and let completion do the rest.

VS Code

/mcp.vulnetix.vulnetix_vuln

VS Code prompts for the argument if the prompt declares one.

Claude Desktop

Click + in the message box, choose the server, then the prompt. Fill in the argument when asked.

Anywhere else

Clients without a prompt picker can still be asked directly:

Use the vulnetix_incident_respond workflow for CVE-2021-44228.

The agent fetches the prompt through prompts/get and follows it.

Arguments

Most prompts take a single free-form string, mirroring the CLI conventions they came from:

vulnetix_vuln                CVE-2021-44228
vulnetix_package_search      express
vulnetix_dep_add_guard       lodash --ecosystem npm
vulnetix_kev_watch           --since 2026-08-01 --catalog cisa
vulnetix_sast_scan           --paths src/ --baseline
vulnetix_exploits_search     --ecosystem npm --severity critical --in-kev

The prompt’s argument-hint shows the shape. Omit it and the workflow still runs, asking for what it needs.

What each prompt carries

Beyond the body, each prompt exposes metadata in _meta:

Key	Meaning
`vulnetix/skill`	Source skill directory name
`vulnetix/triggers`	Phrases that suggest this workflow
`vulnetix/chain`	Workflows that usually follow
`vulnetix/outputBudget`	`short` (≤30 lines), `medium` (≤80), `long`
`vulnetix/localExecution`	Whether it needs your machine

chain is the useful one. vulnetix_vuln chains to exploits, fix and remediation; vulnetix_fix chains to verify_fix and vex_publish. A capable agent uses it to suggest the next step, and you can read it to see how the workflows compose.

Prompts and tools together

They complement each other.

Reach for a tool when you have a specific question: is this in KEV, what is the EPSS score, which version is safe.

Reach for a prompt when you want the procedure: triage this properly, decide whether to add this dependency, run an incident.

A server-side prompt calls the tools for you. It carries the procedural knowledge about which to call, in what order, and what to conclude.

Output budgets

Each prompt declares how much output it should produce. short means under about 30 lines, medium under 80, long is unbounded (used by incident_respond, which needs the room).

It is a soft contract. Ask for more detail and you get it. The budget stops a routine lookup turning into three pages, and it will not stop you digging.

When a prompt asks for the CLI

Sixteen of them need your machine and say so in their opening lines. If the CLI is not installed, the workflow tells your agent to install it:

curl -fsSL https://cli.vulnetix.com/install.sh | sh

See Local workflows.