Cve Scan

CVE lookups against the NVD 2.0 API, cross-referenced with the CISA Known Exploited Vulnerabilities (KEV) catalog.

Asking a language model "are there known CVEs for X, and is any of them being exploited?" produces an impression: sometimes right, never citable, different on the next run. This model answers it as a lookup — NVD's own keyword search joined against CISA's KEV feed — so every result carries its CVE id, CVSS score, publication date, and a knownExploited flag traceable to the KEV catalog entry that set it.

The vendor/product term is always supplied by the caller. Nothing about any specific vendor, product, or estate is baked in.

The guarantee

Every network call goes through a host allowlist that physically refuses any hostname outside services.nvd.nist.gov and www.cisa.gov, re-checked after every redirect — a 302 cannot walk the run onto another host. That is the reason this is an extension model and not a shell step wrapping curl.

Honesty over false calm

If the KEV catalog cannot be read, the run does not silently report every CVE as not-exploited. It sets kevChecked: false and says so in notes, because a missing exploited-in-the-wild flag that reads as "safe" is worse than an error. NVD pages that fail after retries are counted in unreadable, so a partial list can never be mistaken for a complete one.

Methods

• cve_scan — search NVD for CVEs matching a vendor (and optional product) keyword, cross-reference each against the CISA KEV catalog, and emit one advisories resource. Results are sorted known-exploited first, then by CVSS severity, then by recency — the order a human triaging "what bites tonight" wants to read. Supports an optional CVSS-v3 severity filter and a since date (NVD caps any date range at 120 days; a longer span is clamped and noted).

Design notes

NVD works anonymously; an API key only raises the rate limit (5 req/30s anonymous to 50 req/30s keyed). The key is optional and, when supplied, comes from the model definition via a vault expression — never hardcoded. Requests retry 429/5xx with backoff and honour Retry-After.

Read-only throughout: it reads two public feeds and never writes anywhere.

Quick Start

swamp extension pull @hmcrum/cve-scan
swamp model create @hmcrum/cve-scan cve-scan
swamp model @hmcrum/cve-scan method run cve_scan cve-scan \
  --input vendor=openssl \
  --input limit=25

swamp data get cve-scan cve-openssl --json ```

Initial release: NVD 2.0 CVE search cross-referenced with the CISA KEV catalog, host-locked to NVD+CISA, degrades honestly when KEV is unreachable.