Public Docs / MCP / Tools

MCP Tools Reference

Phoenix exposes tools across three categories: CVE intelligence, scoring, and end-of-life risk. Enterprise tiers unlock additional simulation and explanation tools. Tools marked Enterprise only require an api_unlimited scope key.

How to Call a Tool

All tool calls use the tools/call JSON-RPC method with name and arguments parameters:

{
  "jsonrpc": "2.0",
  "id": "1",
  "method": "tools/call",
  "params": {
    "name": "get_cve_intelligence",
    "arguments": { "cve_id": "CVE-2024-27198" }
  }
}

The response wraps the tool result in a content array. For CVE intelligence tools, a markdown summary is also returned as a text content item.

CVE Intelligence Tools

search_cves

Search the CVE database with optional filters. Returns a paginated list of matching CVEs enriched with PS-HP scoring.

Show inputs

Parameter	Type	Description
`query`	string	Free-text search
`year`	integer	Filter by CVE year
`severity`	CRITICAL \| HIGH \| MEDIUM \| LOW	CVSS severity band
`kev_only`	boolean	Restrict to CISA KEV entries
`ps_hp_min`	number	Minimum PS-HP score (0–100)
`ps_hp_tier`	1 \| 2 \| 3	PS-HP tier (1=confirmed, 2=likely, 3=emerging)
`enterprise_watchlist`	boolean	Filter to PS-EW flagged CVEs only
`limit`	integer	Page size (tier-limited)
`offset`	integer	Pagination offset

get_cve_intelligence

Retrieve full intelligence for a single CVE — PS-HP scoring, EPSS, KEV status, exploit maturity, threat actor associations, and a markdown summary.

Show inputs

Parameter	Type	Description
`cve_id` required	string	CVE ID in format `CVE-YYYY-NNNNN`

get_threat_actors_by_cve

Return a list of threat actor groups and campaigns known to exploit a specific CVE.

Show inputs

Parameter	Type	Description
`cve_id` required	string	CVE ID

check_enterprise_critical

Check whether a vendor/product combination is classified as enterprise-critical and return its risk category.

Show inputs

Parameter	Type	Description
`vendor` required	string	Vendor name
`product` required	string	Product name

Scoring Tools

get_phoenix_score

Calculate and return the PS-HP score for a CVE with component breakdown detail (depth depends on your tier).

Show inputs

Parameter	Type	Description
`cve_id` required	string	CVE ID
`include_rationale`	boolean (default true)	Include scoring rationale text

get_high_profile_cves

Retrieve PS-HP classified CVEs filtered by tier (1=confirmed actively exploited, 2=likely high-risk, 3=emerging threat).

Show inputs

Parameter	Type	Description
`tier`	1 \| 2 \| 3	PS-HP tier
`limit`	integer (max 100)	Number of results
`enterprise_category`	string	Filter by enterprise product category

get_enterprise_watchlist

Return CVEs on the PS-EW (Enterprise Watchlist) — high-severity vulnerabilities in enterprise-critical products that lack public exploitation evidence but carry significant latent risk.

Show inputs

Parameter	Type	Description
`category`	string	Optional enterprise product category filter
`limit`	integer (default 25)	Number of results

volerion_rescore

Fetch the Volerion ML rescore and delta for a CVE. Shows how Volerion's exploitability model diverges from CVSS. Requires Registered tier or above.

Show inputs

Parameter	Type	Description
`cve_id` required	string	CVE ID

calculate_custom_phoenix_score Enterprise only

Compute a hypothetical PS-HP score from custom inputs — useful for threat modelling before a CVE is officially scored.

Show inputs

Parameter	Type	Description
`cvss` required	number (0–10)	CVSS base score
`epss`	number (0–1)	EPSS probability
`in_kev`	boolean	Is in CISA KEV?
`has_ransomware`	boolean	Linked to ransomware activity?
`exploit_status`	none \| poc \| verified \| weaponized \| in_ransomware	Exploit maturity level
`vendor`	string	Vendor name (for enterprise CPE weighting)
`product`	string	Product name
`github_stars`	integer	GitHub stars on associated PoC repos
`github_forks`	integer	GitHub forks on associated PoC repos
`bugbounty_reports`	integer	Number of public bug bounty reports

explain_score_components Enterprise only

Return a detailed breakdown of every PS-HP scoring component for a CVE with numeric weights and rationale text.

Show inputs

Parameter	Type	Description
`cve_id` required	string	CVE ID

End-of-Life Risk Tools

list_eol_products

List products from the EOL intelligence catalog with optional filters by status, category, vendor, or search string.

Show inputs

Parameter	Type	Description
`status`	string	Lifecycle status filter (e.g. `eol`, `approaching`)
`category`	string	Product category
`vendor`	string	Vendor name
`search`	string	Free-text search
`limit` / `offset`	integer	Pagination

get_eol_product

Retrieve full lifecycle detail for a specific product by its slug identifier.

Show inputs

Parameter	Type	Description
`product_slug` required	string	Product slug (e.g. `ubuntu-20.04`)

get_eol_cve_correlations

Get CVEs correlated with EOL or approaching-EOL products. Useful for identifying non-fixable vulnerabilities tied to lifecycle gaps.

Show inputs

Parameter	Type	Description
`non_fixable_only`	boolean	Only CVEs with no patch path
`kev_only`	boolean	Only CISA KEV entries
`min_cvss`	number	Minimum CVSS base score
`limit` / `offset`	integer	Pagination

get_cve_eol_status

Return EOL lifecycle information for the products affected by a specific CVE.

Show inputs

Parameter	Type	Description
`cve_id` required	string	CVE ID

get_eol_replacements

List recommended replacement products for EOL items, optionally filtered by category.

Show inputs

Parameter	Type	Description
`category`	string	Product category
`limit`	integer	Number of results

get_eol_replacement

Get the specific replacement recommendation for a single product slug.

Show inputs

Parameter	Type	Description
`product_slug` required	string	Product slug

get_eol_statistics

Return aggregate EOL statistics including counts by status, category, and vendor breakdowns. No inputs required.

get_eol_timeline

Get upcoming EOL events within a time window for timeline visualisation or alerting workflows.

Show inputs

Parameter	Type	Description
`days`	integer	Look-ahead window in days
`category`	string	Product category filter

get_eol_risk_score

Calculate the SLR (Software Lifecycle Risk) composite score for a product based on EOL proximity, open CVEs, and patch availability.

Show inputs

Parameter	Type	Description
`product_slug` required	string	Product slug