Public Docs / MCP / Tools
MCP Tools Reference
Phoenix exposes tools across three categories: CVE intelligence, scoring, and end-of-life risk.
Enterprise tiers unlock additional simulation and explanation tools.
Tools marked Enterprise only require an api_unlimited scope key.
How to Call a Tool
All tool calls use the tools/call JSON-RPC method with name and arguments parameters:
{
"jsonrpc": "2.0",
"id": "1",
"method": "tools/call",
"params": {
"name": "get_cve_intelligence",
"arguments": { "cve_id": "CVE-2024-27198" }
}
}The response wraps the tool result in a content array. For CVE intelligence tools, a markdown summary is also returned as a text content item.
CVE Intelligence Tools
search_cves
Search the CVE database with optional filters. Returns a paginated list of matching CVEs enriched with PS-HP scoring.
Show inputs
| Parameter | Type | Description |
|---|---|---|
query | string | Free-text search |
year | integer | Filter by CVE year |
severity | CRITICAL | HIGH | MEDIUM | LOW | CVSS severity band |
kev_only | boolean | Restrict to CISA KEV entries |
ps_hp_min | number | Minimum PS-HP score (0–100) |
ps_hp_tier | 1 | 2 | 3 | PS-HP tier (1=confirmed, 2=likely, 3=emerging) |
enterprise_watchlist | boolean | Filter to PS-EW flagged CVEs only |
limit | integer | Page size (tier-limited) |
offset | integer | Pagination offset |
get_cve_intelligence
Retrieve full intelligence for a single CVE — PS-HP scoring, EPSS, KEV status, exploit maturity, threat actor associations, and a markdown summary.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID in format CVE-YYYY-NNNNN |
get_threat_actors_by_cve
Return a list of threat actor groups and campaigns known to exploit a specific CVE.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID |
check_enterprise_critical
Check whether a vendor/product combination is classified as enterprise-critical and return its risk category.
Show inputs
| Parameter | Type | Description |
|---|---|---|
vendor required | string | Vendor name |
product required | string | Product name |
Scoring Tools
get_phoenix_score
Calculate and return the PS-HP score for a CVE with component breakdown detail (depth depends on your tier).
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID |
include_rationale | boolean (default true) | Include scoring rationale text |
get_high_profile_cves
Retrieve PS-HP classified CVEs filtered by tier (1=confirmed actively exploited, 2=likely high-risk, 3=emerging threat).
Show inputs
| Parameter | Type | Description |
|---|---|---|
tier | 1 | 2 | 3 | PS-HP tier |
limit | integer (max 100) | Number of results |
enterprise_category | string | Filter by enterprise product category |
get_enterprise_watchlist
Return CVEs on the PS-EW (Enterprise Watchlist) — high-severity vulnerabilities in enterprise-critical products that lack public exploitation evidence but carry significant latent risk.
Show inputs
| Parameter | Type | Description |
|---|---|---|
category | string | Optional enterprise product category filter |
limit | integer (default 25) | Number of results |
volerion_rescore
Fetch the Volerion ML rescore and delta for a CVE. Shows how Volerion's exploitability model diverges from CVSS. Requires Registered tier or above.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID |
calculate_custom_phoenix_score Enterprise only
Compute a hypothetical PS-HP score from custom inputs — useful for threat modelling before a CVE is officially scored.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cvss required | number (0–10) | CVSS base score |
epss | number (0–1) | EPSS probability |
in_kev | boolean | Is in CISA KEV? |
has_ransomware | boolean | Linked to ransomware activity? |
exploit_status | none | poc | verified | weaponized | in_ransomware | Exploit maturity level |
vendor | string | Vendor name (for enterprise CPE weighting) |
product | string | Product name |
github_stars | integer | GitHub stars on associated PoC repos |
github_forks | integer | GitHub forks on associated PoC repos |
bugbounty_reports | integer | Number of public bug bounty reports |
explain_score_components Enterprise only
Return a detailed breakdown of every PS-HP scoring component for a CVE with numeric weights and rationale text.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID |
End-of-Life Risk Tools
list_eol_products
List products from the EOL intelligence catalog with optional filters by status, category, vendor, or search string.
Show inputs
| Parameter | Type | Description |
|---|---|---|
status | string | Lifecycle status filter (e.g. eol, approaching) |
category | string | Product category |
vendor | string | Vendor name |
search | string | Free-text search |
limit / offset | integer | Pagination |
get_eol_product
Retrieve full lifecycle detail for a specific product by its slug identifier.
Show inputs
| Parameter | Type | Description |
|---|---|---|
product_slug required | string | Product slug (e.g. ubuntu-20.04) |
get_eol_cve_correlations
Get CVEs correlated with EOL or approaching-EOL products. Useful for identifying non-fixable vulnerabilities tied to lifecycle gaps.
Show inputs
| Parameter | Type | Description |
|---|---|---|
non_fixable_only | boolean | Only CVEs with no patch path |
kev_only | boolean | Only CISA KEV entries |
min_cvss | number | Minimum CVSS base score |
limit / offset | integer | Pagination |
get_cve_eol_status
Return EOL lifecycle information for the products affected by a specific CVE.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID |
get_eol_replacements
List recommended replacement products for EOL items, optionally filtered by category.
Show inputs
| Parameter | Type | Description |
|---|---|---|
category | string | Product category |
limit | integer | Number of results |
get_eol_replacement
Get the specific replacement recommendation for a single product slug.
Show inputs
| Parameter | Type | Description |
|---|---|---|
product_slug required | string | Product slug |
get_eol_statistics
Return aggregate EOL statistics including counts by status, category, and vendor breakdowns. No inputs required.
get_eol_timeline
Get upcoming EOL events within a time window for timeline visualisation or alerting workflows.
Show inputs
| Parameter | Type | Description |
|---|---|---|
days | integer | Look-ahead window in days |
category | string | Product category filter |
get_eol_risk_score
Calculate the SLR (Software Lifecycle Risk) composite score for a product based on EOL proximity, open CVEs, and patch availability.
Show inputs
| Parameter | Type | Description |
|---|---|---|
product_slug required | string | Product slug |
Advisory & Bundle Tools
These tools appear in tools/list only when their platform feature flags are enabled for the environment. When a flag is off the tool is hidden and calling it returns Unknown tool.
get_advisory_patches
Return advisory patch suggestions for a CVE, sourced from vendor advisories. Gated by the ENABLE_ADV_FETCH feature flag.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE identifier, e.g. CVE-2024-1234 |
bundles_for_cve
Return the CVE bundles (named advisory groupings) that contain a given CVE. Gated by the ENABLE_CVE_BUNDLES feature flag.
Show inputs
| Parameter | Type | Description |
|---|---|---|
cve_id required | string | CVE ID |
get_bundle
Return a CVE bundle by its ID, including all member CVE IDs. Gated by the ENABLE_CVE_BUNDLES feature flag.
Show inputs
| Parameter | Type | Description |
|---|---|---|
bundle_id required | string | Bundle identifier |
Frontier Model Attribution Tools
get_ai_attributed_cves
Return CVEs discovered or co-reported by frontier AI models (Claude, GPT, Gemini, Llama, Grok) or AI-native security firms (AISLE). Gated by the frontier-model-attribution feature flag; when off the tool is hidden.
Show inputs
| Parameter | Type | Description |
|---|---|---|
provider | array of string | Filter by provider: anthropic, openai, google, meta, xai, aisle |
program | array of string | Filter by program: glasswing, quiltworks, madbugs |
min_cvss | number | Minimum CVSS base score |
since | string (date) | Only CVEs with discovered_date >= since |
limit | integer (default 50, max 200) | Page size (tier-limited) |
Supply Chain Firewall Tools
Available when the enable_firewall_mcp_server feature flag is enabled for the environment. Require an MCP-capable API key.
phoenix_check_package
Check a single package against Phoenix Supply Chain Firewall rules. Returns a verdict (allow / warn / block) with context.
Show inputs
| Parameter | Type | Description |
|---|---|---|
purl required | string | Package URL, e.g. pkg:npm/lodash@4.17.21 or simplified ecosystem/name@version |
enriched | boolean (default false) | Include LLM reasoning context and remediation |
phoenix_check_lockfile
Batch-evaluate an array of package URLs against firewall rules. Returns an aggregate pass/fail and per-package verdicts.
Show inputs
| Parameter | Type | Description |
|---|---|---|
purls required | array of string | Package URL strings to evaluate |
phoenix_get_package_intel
Get intelligence for a package: PS-OSS score, vulnerability count, malware status, and supply-chain signals.
Show inputs
| Parameter | Type | Description |
|---|---|---|
ecosystem required | string | npm, pypi, crates.io, rubygems, go, nuget |
name required | string | Package name |
phoenix_get_alternatives
Get safe alternative packages for a blocked or risky package.
Show inputs
| Parameter | Type | Description |
|---|---|---|
ecosystem required | string | Package ecosystem |
name required | string | Package name to find alternatives for |
phoenix_firewall_rules
List the authenticated user's active firewall rules, including rule names, actions, conditions, and priorities. No inputs required.