Agent-ready workflow · intelligence
Disclosure to Stack Relevance
Turn a CVE or public report into a stack-specific hypothesis without replaying an exploit blindly.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- new CVE
- critical disclosure
- known exploited issue
- matching product
Prerequisites
- exact product evidence
- version or deployment clues
- current scope
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Separate source facts
Keep vendor advisory, CVE, CVSS, EPSS, KEV, report narrative, and Vulns.co analysis in distinct evidence lanes.
Inputs
- primary advisory
- stack evidence
Outputs
- source fact table
- Evidence gate
- Every claim has a named source and date.
- Negative control
- Popularity or severity alone does not establish reachability.
- Stop condition
- Do not use third-party exploit code as a fingerprint.
Match exact deployment conditions
Compare product, build, module, configuration, protocol, exposure, and authentication prerequisites.
Inputs
- reachable service evidence
Outputs
- applicability matrix
- Evidence gate
- The affected component is reachable and plausibly matches the advisory conditions.
- Negative control
- Similar branding or shared framework is insufficient.
- Stop condition
- Stop if product identity or scope is uncertain.
Extract the root primitive
Translate the disclosure into parser, authorization, file, request, memory, or state-machine behavior.
Inputs
- source fact table
Outputs
- behavior hypothesis
- safe discriminator
- Evidence gate
- The discriminator tests the primitive rather than a destructive exploit chain.
- Negative control
- A known-unaffected or disabled path is identified where possible.
- Stop condition
- No crash, persistence, or sensitive data access on production.
Run a bounded applicability check
Use the cheapest non-destructive observation permitted by policy.
Inputs
- safe discriminator
Outputs
- supported, rejected, or unknown status
- Evidence gate
- The result is reproducible and does not overstate exploitability.
- Negative control
- The same check against the non-affected path differs as expected.
- Stop condition
- Escalate only with explicit scope and a separate safe plan.
Related methods
Continue with the right depth.
Sources