Automated CVE triage and PoC verification with cve.now MCP and unst33r-deepseek

Dependency scanners flag vulnerable package versions in your lockfile. Turning a raw advisory into an engineering verdict still requires reading upstream vulnerability details, tracing your local call graph to the affected sink, and writing a minimal reproducer (PoC) test that confirms whether untrusted input can trigger the flaw.

Pairing the public cve.now MCP server with unst33r-deepseek (or unst33r-flash) gives your security agent both halves of that loop: live multi-source vulnerability intelligence and a reduced-refusal model tier that synthesizes exploit reproducers and patches without stopping mid-run.

Assumption throughout: you are running reachability checks and PoC generation only against repositories, dependency trees, and isolated staging environments you own or have explicit written authorization to test.

What cve.now brings to an agent loop

Most vulnerability feeds expose a single database with inconsistent schema coverage. Launched by Sazabi in October 2026, cve.now merges eight public sources into one canonical entry per vulnerability: the official CVE List, GitHub Advisory Database (GHSA), OSV, NVD, ENISA EUVD, CISA Known Exploited Vulnerabilities (KEV), FIRST EPSS, and Exploit-DB.

Three implementation details make cve.now practical inside an automated security harness:

• Zero-auth Streamable HTTP MCP (https://mcp.cve.now/mcp): Any MCP-capable coding or security agent can call three read-only tools (check_stack, list_feed, and get_vulnerability) without provisioning or rotating an external API key.
• High-signal criticality filtering: Instead of flooding a queue with every low-severity NVD record, cve.now marks an entry critical when it appears in CISA KEV, scores CVSS 9.0 or higher on a tracked technology, or scores CVSS 7.0 or higher with an EPSS exploitation probability of at least 0.1.
• Direct lockfile and JSON API parity: The check_stack tool parses package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, mix.lock, and flake.lock. For non-MCP batch scripts, /api/v1/entries/<id> and /feed?filter=critical&format=json return the exact same merged records over plain HTTPS.

Why standard models stall on step 3 of CVE verification

A complete CVE verification pipeline executes three distinct phases:

1. Match dependencies or poll active threats: The agent calls check_stack against your repository lockfile or polls list_feed for newly disclosed critical advisories in your stack's ecosystem.
2. Pull merged advisory context: For each hit (for example, CVE-2026-116811, an 8.7 CVSS sandbox escape RCE in OpenPanel's webhook JavaScript template engine, or CVE-2026-116818, an 8.8 CVSS unauthenticated ClickHouse SQL injection over WebSocket), the agent calls get_vulnerability to extract affected package versions, vulnerable symbols, CVSS vectors, EPSS scores, and public Exploit-DB references.
3. Verify reachability with a PoC: The agent searches your codebase for call sites reaching the affected function, traces whether attacker-controlled input crosses into that sink without sanitization, and writes a unit or integration test that triggers the crash, injection, or bypass.

When backed by a standard consumer safety-tuned API, an agent reliably completes steps 1 and 2, then aborts on step 3 as soon as the prompt asks for a concrete trigger payload (such as a sandbox-escape template string, a crafted SQL fragment, or a malformed serialization object). Even worse, in unattended CI pipelines a soft refusal often masquerades as a "no reachable exploit found" conclusion, silently passing a vulnerable build. Running step 3 on a reduced-refusal tier from the UNST33R catalog keeps payload synthesis and regression test generation deterministic.

Architecture and model tier selection

All UNST33R tiers sit behind one OpenAI-compatible endpoint (https://api.unst33r.si/v1) and support SSE streaming and structured tool calling, so switching models between pipeline stages is a one-line change to the model field (full tier comparison · live pricing):

Public leaderboards evaluate unmodified upstream base models (how abliteration works); while abliterated and uncensored variants retain core coding and reasoning capability, always verify strict JSON and MCP tool-call formatting on your own harness before running unattended sweeps.

Wiring cve.now MCP + UNST33R in an interactive agent

1. Configure the UNST33R endpoint

In OpenClaw, Hermes, Claude Code, or any OpenAI-compatible agent harness, point the provider base URL at https://api.unst33r.si/v1 and export your API key (or generate a ready-made profile with the config generator):

export OPENAI_BASE_URL="https://api.unst33r.si/v1"
export OPENAI_API_KEY="<your-unst33r-api-key>"

2. Attach the cve.now MCP server

Add cve-now as a Streamable HTTP MCP server in your agent's MCP configuration file:

{
  "mcpServers": {
    "cve-now": {
      "type": "http",
      "url": "https://mcp.cve.now/mcp"
    }
  }
}

3. Run the three-stage verification prompt

With both the model provider and MCP server active, run a structured task prompt that separates reachability analysis from PoC execution:

1. Call the cve-now `check_stack` tool on our repository lockfile and list all High and Critical matches (or entries with EPSS >= 0.1).
2. For each match, call `get_vulnerability` to extract the vulnerable package versions, affected symbols/endpoints, and Exploit-DB or KEV references.
3. Search this repository for call sites reaching those symbols. Output a JSON verdict per CVE (`reachable`, `guarded`, or `unused`) with exact file:line citations.
4. For every `reachable` sink, write a minimal reproduction test in our existing test runner that triggers the vulnerability on the current lockfile and passes once the dependency is upgraded or patched.

Headless CI pipeline: Piping cve.now JSON API into unst33r-deepseek

When running scheduled CI checks across dozens of repositories, you do not need a full interactive agent session for every advisory. You can fetch the merged JSON record directly from https://cve.now/api/v1/entries/<id> (following HTTP redirects with -L, as cve.now can redirect entry lookups to static JSON snapshots) and combine it with local call-site context in a single unst33r-deepseek completion:

#!/usr/bin/env bash
set -euo pipefail

CVE_ID="CVE-2026-116818"
ADVISORY_JSON=$(curl -fsSL "https://cve.now/api/v1/entries/${CVE_ID}")
CALL_SITES=$(git grep -n "live/visitors" src/ || true)

curl -fsSL https://api.unst33r.si/v1/chat/completions \
  -H "Authorization: Bearer $UNST33R_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg cve "$CVE_ID" \
    --arg adv "$ADVISORY_JSON" \
    --arg code "$CALL_SITES" \
    '{
      model: "unst33r-deepseek",
      temperature: 0.1,
      messages: [
        {
          role: "system",
          content: "You are an application security verification engine. Return strict JSON with keys: cve_id, verdict (reachable|guarded|not_present), call_chain, poc_test_code, and remediation_diff."
        },
        {
          role: "user",
          content: ("Advisory (" + $cve + "):\n" + $adv + "\n\nRepository call sites:\n" + $code + "\n\nTrace reachability and draft a minimal reproduction test plus parameter-binding patch.")
        }
      ]
    }')"

Because unst33r-deepseek supports a 1M token context window and up to 384k output tokens, you can pass entire source modules alongside the cve.now JSON payload and receive both the complete reproduction test file and a unified git diff in one round trip.

Failure modes seen in practice

• Advisory text containing indirect prompt injection. Public vulnerability descriptions, commit messages, and Exploit-DB notes are untrusted external input. Always wrap fetched cve.now descriptions inside explicit delimiter blocks and restrict your triage agent to read-only repository tools plus an isolated test-runner sandbox (see our LangChain & MCP CVE testing guide).
• Transitive lockfile matches without symbol imports. Up to 70% of SCA alerts flag a sub-dependency whose vulnerable function is never imported by your direct dependency. Instruct the agent to trace the intermediate package's call graph before spending tokens drafting a PoC; if the symbol is dead code, mark it unused on unst33r-flash and stop early.
• flake.lock and source-pinned dependencies. As cve.now documents in its reference, flake.lock pins Git commit hashes rather than semantic package versions; its matches rely on OSV commit tracking and do not cover nixpkgs package CVEs. Supplement Nix environments with direct source-diff checks (like the PHP2Shell commit diff workflow).
• Unpinned /api/v1/entries/<id> HTTP clients. Because cve.now may issue a 302/307 redirect from /api/v1/entries/<id> to a static JSON copy, HTTP clients that omit redirect following (curl without -L, or default fetch with redirect: "manual") receive an empty body and cause the model to hallucinate advisory details.
• Running PoCs outside a network-isolated container. Reproducers for SSRF (such as CVE-2026-116827 and CVE-2026-116826 in YesWiki) or webhook sandbox escapes (CVE-2026-116811) attempt outbound connections or process execution by design. Execute generated tests inside an ephemeral container with egress blocked and dummy loopback listeners.

Cost arithmetic for continuous lockfile verification

Suppose your engineering org maintains 25 service repositories and runs an automated verification pass whenever cve.now publishes a new High or Critical advisory matching your ecosystems (~40 advisories per week across all stacks):

1. Stage 1: Stack check & call-graph pre-screen (unst33r-flash at $0.50 / $1.50 per 1M): 40 advisories × ~8,000 input tokens (advisory JSON + git grep context) and ~800 output tokens per check = 320k input + 32k output tokens ≈ $0.21 per week.
2. Stage 2: Deep PoC synthesis & patch drafting on reachable hits (unst33r-deepseek at $1.20 / $3.20 per 1M): Assuming 15% of alerts (6 hits/week) have a plausible call path requiring full source-tree trace and PoC test generation at ~35,000 input tokens and ~6,000 output tokens per hit = 210k input + 36k output tokens ≈ $0.37 per week.

The entire two-tier verification loop across 25 repositories costs under $0.60 per week (~$2.50/month) in API tokens, while eliminating hours of manual advisory cross-referencing and giving reviewers a runnable regression test on every PR.

Pre-launch checklist

• https://mcp.cve.now/mcp registered and verified (check_stack, list_feed, get_vulnerability listed).
• HTTP client configured to follow redirects (-L) when querying /api/v1/entries/<id>.
• Two-stage routing configured: unst33r-flash for call-graph pre-screening, unst33r-deepseek for PoC test and patch generation.
• Generated PoC tests executed exclusively inside network-isolated, ephemeral CI containers.
• Strict JSON and MCP tool-call schemas validated on a 10-advisory sample using your actual agent harness.
• Target repositories and staging environments confirmed within authorized scope (acceptable-use policy).

FAQ

Does cve.now require an API key or paid account? No. Both the Streamable HTTP MCP server (https://mcp.cve.now/mcp) and the JSON/RSS feeds (/feed?format=json, /api/v1/entries/<id>) are public and free, with model-written summaries licensed under CC-BY 4.0 and severity/version metadata pulled directly from upstream sources.

What happens to our lockfile when an agent calls check_stack? Per cve.now's documentation, the uploaded lockfile is parsed in private storage and deleted immediately after reading; only the extracted list of package names and versions is retained to compute vulnerability matches and stack feeds.

When should I escalate from unst33r-deepseek to unst33r-pro? Use unst33r-deepseek whenever the task is reading source files, constructing a single-shot or multi-turn test file, and writing a patch diff. Escalate to unst33r-pro ($2.50 / $4.50 per 1M) when reproducing the vulnerability requires a 15+ turn interactive shell loop—attaching gdb, inspecting live container logs, or coordinating multi-container race conditions (see how Shannon, Strix, and T3MP3ST structure long-horizon loops).

Get an UNST33R API key to wire up the verification loop, or explore the model catalog for copy-paste SDK snippets.