Vulnerability intelligence

`vulnetix_vuln`

The one you will use most. Everything Vulnetix knows about an advisory, in one call.

Argument	Type	Default
`identifier`	string, required	none
`detail`	`summary` \| `full` \| `raw`	`summary`

identifier accepts CVE, GHSA, PYSEC, RUSTSEC, GO, EUVD and 70+ other formats.

What comes back

Field	Contents
`threatExposure`	Composite level, score, and the rules that produced it
`attackSurface`	Exposure level with reasoning
`ssvc`	Decision (`Act`, `Attend`, `Track`), priority, methodology, inputs
`kev`	Vendor, product, due date, ransomware flag, required action
`epss`	Probability and percentile
`exploitationMaturity`	Level, score, confidence, reasoning
`remediationTimeline`	Lifecycle stage, age, publication-to-patch, milestones
`affectedRoutines`	The functions and files to grep your codebase for
`attackPaths`	Tactics mapped to ATT&CK techniques
`reachability`	Tree-sitter AST results when the CLI supplied them
`affected`	Total, grouped by ecosystem with examples
`purls`, `cloudLocators`, `references`	Package URLs, cloud resource locators, advisory links

Detail levels

summary (default, ~10 KB) keeps every decision field and collapses the bulk lists into counts and samples. full (~208 KB) returns up to 200 verbatim affected entries and all package URLs, so ask for it only when you need to enumerate. raw is refused above 512 KB, because a 2.6 MB record cannot fit a context window and returning it would just waste the call.

Look up CVE-2021-44228 and tell me the KEV deadline and SSVC decision.

`vulnetix_remediation`

A ranked plan instead of a single version number: 37 actions for Log4Shell, each with concrete steps, effort and impact ratings.

Argument	Type	Default
`identifier`	string, required	none
`maxActions`	1–100	25

Also returns distribution patches, registry fixes, a count and sample of upstream source fixes, CWE mappings, SSVC, severity, and KEV entries.

Give me the remediation plan for CVE-2021-44228 and tell me which action to take first.

`vulnetix_kev_status`

Whether one advisory is in any Known Exploited Vulnerabilities catalogue, with the CISA due date, required action and ransomware flag. Cheaper and more direct than listing the catalogue.

Argument	Type
`identifier`	string, required

`vulnetix_kev`

The catalogue itself: CISA, ENISA/EU, VulnCheck and Vulnetix.

Argument	Type	Default
`limit`	1–200	25
`offset`	number	0

Note dueDate, requiredAction and notes are only populated for CISA-sourced entries. VulnCheck- and ENISA-derived rows carry the membership but no deadline. A missing due date means “this source does not set one”, not “no deadline”.

`vulnetix_timeline`

The lifecycle as a dated event stream, plus a summary that is usually the whole answer:

"meta": {
  "lifecycleStage": "LEGACY",
  "currentAgeDays": 20675,
  "publicationToFirstExploitDays": 20,
  "publicationToKevDays": 18971,
  "insights": [
    "Added to KEV 18971 days after publication",
    "Exploit published within 1 month",
    "Legacy vulnerability (56 years old) still actively exploited",
    "Patches available in 986 versions"
  ]
}

Useful for the argument you have to make to someone else: this class of issue was weaponised within 20 days of disclosure.

Argument	Type
`identifier`	string, required

`vulnetix_advisories`

Vendor advisories: Red Hat errata, Microsoft MSRC patches, per-vendor product coverage, vendor comments and references. Use it to find the advisory for the distribution you run, instead of the generic CVE page.

`vulnetix_workarounds`

Documented mitigations that do not require patching, for when no patch exists, an upgrade is blocked, or you need to survive until a maintenance window.

`vulnetix_vex`

VEX statements published by upstreams and vendors, giving their position on whether a product is affected.

Worth checking before you spend effort: a vendor may already have declared your product not affected, which changes the work from “patch” to “record the justification”.