vuln·telMCP serverToolsGuidesField notesGet a key

EPSS API Documentation

EPSS (the Exploit Prediction Scoring System, from FIRST) is a daily-recomputed probability that a CVE will be exploited within 30 days. vulntel serves EPSS the way an agent needs it: fused per CVE with KEV status, the SSVC decision and a public-exploit signal, so one call gives you a prioritization answer, not a lone number. New to the metric? Start with what is EPSS.

There are three ways to read EPSS through or alongside vulntel: the MCP tool (the supported product surface), a self-hostable REST endpoint, and FIRST's own API for the raw score.

This is the supported way for an AI agent. Connect the MCP server, then call enrich_cve with a CVE ID. The relevant EPSS fields in the response:

{
  "cve_id": "CVE-2021-44228",
  "priority": "P1",
  "cvss": 10.0,
  "kev": true,
  "epss_score": 0.945,
  "epss_percentile": 0.9999,
  "ssvc": { "exploitation": "active", "automatable": "yes", "technical_impact": "total" },
  "public_exploit": { "available": true }
}
  • epss_score : the 0-to-1 probability of exploitation in the next 30 days.
  • epss_percentile : where that score ranks against all scored CVEs (0 to 1).
  • kev, ssvc, public_exploit : the exploitation context EPSS is best read alongside.

Values above are illustrative of the shape. epss_score and epss_percentile reflect FIRST's daily recompute at the time of the call.

To score a list of CVEs, call enrich_cve per CVE, or use check_technology / hunt_plan to enrich a whole product or stack at once (each returned CVE carries its epss_percentile).

2. Self-hostable REST endpoint

The open-source server ships a plain REST companion for non-agent use (curl, scripts, a UI). Run it yourself, then:

GET /cve/{CVE-ID}

It returns the same enriched record (including epss_score and epss_percentile) as JSON. This companion ships without auth by design; run it behind your own network controls. Source and setup are in the GitHub repo.

3. FIRST's EPSS API (the upstream source)

For the raw EPSS score with no fusion, FIRST publishes the canonical API and a daily bulk file:

GET https://api.first.org/data/v1/epss?cve=CVE-2021-44228

FIRST's API is the right choice when you only need the score itself and want it straight from the source. vulntel's value is the fusion (KEV + SSVC + PoC) and the agent fact-check around it. See FIRST's EPSS documentation for its parameters and bulk download.

FAQ

How do I access the EPSS API? Three ways: call vulntel's enrich_cve MCP tool (returns EPSS fused with KEV, SSVC and PoC), run the self-hostable REST companion and GET /cve/{CVE-ID}, or query FIRST's own API at api.first.org/data/v1/epss for the raw score.

What does the EPSS response include? Through vulntel: epss_score (0-to-1 probability), epss_percentile (rank against all scored CVEs), plus the surrounding exploitation context (kev, ssvc, public_exploit) so you can prioritize in one call.

How do I get EPSS scores for many CVEs at once? Enrich per CVE, or enrich a whole product or stack with check_technology / hunt_plan (each returned CVE carries its EPSS percentile). For a large raw-score batch, FIRST's bulk EPSS CSV is the most efficient source.

Is the EPSS score live? It reflects FIRST's daily recompute. EPSS updates once per day, so a CVE's score can move sharply the day an exploit becomes public.