Ask crowbar the hard questions.

Triage one CVE

One command returns the description, the severity, the exploitation signals and the affected version ranges. Read it in a fixed order.

crowbar cve CVE-2021-44228 --json | jq \
  '{id,severity,cvss,epss,kev,cwe,ssvc,
    exploits:(.exploits|length), nuclei:(.nuclei|length)}'

1. KEV

   kev == 1 means exploitation was confirmed in the wild. Nothing else outranks it.

2. SSVC

   ssvc.exploitation is active, poc or none.

3. EPSS

   The estimated probability of exploitation in the next 30 days. It is a model estimate, not a verdict.

4. CVSS

   The impact if the vulnerability is triggered. Never present it on its own as risk.

Match a version

This is the command that answers “are we affected”. It tests the version against every CPE range in the index and returns only the real hits, each with the range that matched.

crowbar product nginx --version 1.18.0 --json

Exact versions, start bounds and end bounds are all checked. Rows are ranked by KEV, then EPSS, then whether a working exploit exists.

NVD's CPE data is incomplete for some vendors, notably Apple. Cross-check Windows, iOS and macOS with crowbar os.

Ecosystem packages

Package advisories carry the range that introduced and the version that fixed the problem, so the answer can name the upgrade.

crowbar advisory --package lodash --ecosystem npm --json
crowbar advisory "prototype pollution" --limit 20

The same information is attached to a CVE record under advisories, and the Debian fixed version appears next to it.

Windows, iOS and macOS

Vendor advisories are normalized into one table with a severity and an impact label, so they can be filtered the same way as everything else.

crowbar os --platform windows --impact RCE --since 2025-01-01
crowbar os --platform ios
crowbar os --platform macos --limit 100

The impact label is one of RCE, EoP, DoS, InfoDisclosure, Spoofing, Bypass or Tampering.

Find proof of concept

Search exploit code by CVE, by description or by a snippet of code. Crowbar downloads the source for inspection; it never runs it.

crowbar exploit "log4j jndi" --json
crowbar exploit 50592
crowbar code "jndi lookup ldap"
crowbar nuclei "cve-2021-44228" --json
crowbar msf ms17 --json

Public repository metadata lives in its own table: crowbar poc --cve CVE-2021-44228 lists repositories that mention the CVE, with stars and language.

Query it from your tooling

The MCP server exposes the same lookups as tools. A tool call returns the smallest sufficient answer and reports the total row count when it caps the list.

You   We run nginx 1.18.0 in prod. Anything exploitable we should patch now?
crowbar  › cb_product(name="nginx", version="1.18.0")
      2 real hits (version-matched): CVE-2021-23017 (HIGH 7.7, epss 0.53)
      is the one to patch, upgrade to >=1.20.1. Grounded, offline, ~80 ms.

The same call from the CLI is crowbar product nginx --version 1.18.0. The skill teaches the agent which path answers which question, so it stops reaching for search when it needs applicability. Once the index is built, any tool in your codebase can query it directly.

The SQL escape hatch

When no command fits, read the index directly. The session runs with PRAGMA query_only enabled, so it cannot write.

crowbar sql "select cve, vendor, product, name, date_added
  from kev where date_added >= date('now','-90 day')
  order by date_added desc" --json

Read-only: no writes, no schema changes. It is the same database the commands use, so the answer cannot disagree with the CLI.