com.acidpeak/acidpeak

What it mainly works on, as our AI model read its tool descriptions: nothing outside itself: it only answers questions.

None of its 10 tools are described as changing anything.

• lookup_cveon 2 other serversreads or searches

  “Look up one CVE identifier in AcidPeak's tracked data.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • idstringrequired“CVE identifier, for example CVE-2024-3400.”
  • fieldsarray“Only these optional fields of each entry, for a smaller answer; identifying fields, severity, found, coverage, safety notes and trust labels of kept fields alw…”
• recent_threatson 1 other serverreads or searches

  “List the newest entries AcidPeak tracks, newest publication date first: vulnerability records, flaws with exploitation evidence and security reporting.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  7 inputs

  • categorystring“all: everything below.”
  • min_severitystring“Lowest severity to include.”
  • sincestring“Only entries published on or after this day (UTC): a date as YYYY-MM-DD, or a number of days back such as 7d (at most 365d).”
  • updated_sincestring“Only entries that changed in any way at or after this time, for keeping a copy in sync: a time as YYYY-MM-DDTHH:MM:SSZ or with a UTC offset such as 2026-09-24T…”
  • limitinteger“Entries per page, 1 to 50.”
  • cursorstring“Pass next_cursor from the previous response to get the next page.”
  • fieldsarray“Only these optional fields of each entry, for a smaller answer; identifying fields, severity, found, coverage, safety notes and trust labels of kept fields alw…”
• lookup_cveson 1 other serverreads or searches

  “Look up to 20 CVE identifiers in one call.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • idsarrayrequired“CVE identifiers, 1 to 20, for example CVE-2024-3400.”
  • fieldsarray“Only these optional fields of each entry, for a smaller answer; identifying fields, severity, found, coverage, safety notes and trust labels of kept fields alw…”
• find_productson 14 other serversreads or searches

  “Find the product and vendor names AcidPeak tracks, with how many entries name each one.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  1 input, 1 required

  • querystringrequired“Product or vendor name, or the start of one, at least 2 characters, for example nginx, fortios or windows server.”
• vulnerabilities_for_productsreads or searches

  “Find vulnerability records that name any of the given products, newest first, with how each product was matched.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  8 inputs, 1 required

  • productsarrayrequired“Product or vendor names or keys, 1 to 20.”
  • exploited_onlyboolean“Only entries with exploitation evidence (CISA KEV, SSVC active, or a named source reporting exploitation in the wild).”
  • min_severitystring“Lowest severity to include.”
  • sincestring“Only entries published on or after this day (UTC): a date as YYYY-MM-DD, or a number of days back such as 7d (at most 365d).”
  • include_reportsboolean“Also include security reporting that mentions the products.”
  • limitinteger“Entries per page, 1 to 50.”
  • cursorstring“Pass next_cursor from the previous response to get the next page.”
  • fieldsarray“Only these optional fields of each entry, for a smaller answer; identifying fields, severity, found, coverage, safety notes and trust labels of kept fields alw…”
• searchon 763 other serversreads or searches

  “Full-text search across vulnerabilities, reporting and live incidents by CVE id, vendor, product, group or keyword.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  4 inputs, 1 required

  • querystringrequired“Search words, for example citrix bleed or qilin.”
  • kindstring“Restrict results to one kind.”
  • limitinteger“Entries per page, 1 to 50.”
  • cursorstring“Pass next_cursor from the previous response to get the next page.”
• breach_noticesreads or searches

  “List data breach notices that organizations filed with US states and with HHS, newest filing first, one entry per breach with every filing, the people affected as the organization reported and the no…”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  8 inputs

  • statestring“Only notices filed with this state, as a lowercase two-letter code such as ca, or us for HHS.”
  • organizationstring“Organization name or part of one.”
  • sincestring“Only breaches with a filing on or after this day (UTC): a date as YYYY-MM-DD, or a number of days back such as 7d (at most 365d).”
  • min_people_affectedinteger“Only breaches where the organization reported at least this many people affected.”
  • local_governmentboolean“Only cities, counties, schools and similar public bodies, picked from the organization name.”
  • orderstring“newest: latest filing first.”
  • limitinteger“Entries per page, 1 to 50.”
  • cursorstring“Pass next_cursor from the previous response to get the next page.”
• check_packageson 3 other serversreads or searches

  “Check installed Linux package versions against the distribution's own security statements: RHEL, Rocky Linux and AlmaLinux (rpm), Debian, Ubuntu and Proxmox VE (dpkg).”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  7 inputs, 3 required

  • distrostringrequired“Distribution: rhel, rocky, almalinux, debian, ubuntu or proxmox (Proxmox VE).”
  • releasestringrequired“Release: the major version for rpm distributions and Proxmox VE (9; 8.2 reads as 8), the version or codename for Debian (12 or bookworm) and Ubuntu (24.04 or n…”
  • streamstring“Red Hat only: base or the host's extended support stream, such as eus:9.2 or els:7 (eus alone takes the release minor).”
  • originstring“Proxmox VE only: debian judges packages from the Debian archive by Debian's statements; default proxmox.”
  • packagesarrayrequired“Installed packages, 1 to 20.”
  • modulesarray“rpm module streams enabled on the host, such as postgresql:12 (dnf module list --enabled).”
  • cvesarray“CVE identifiers to check, up to 20.”
• changes_sinceon 11 other serversreads or searches

  “What changed in AcidPeak's CVE records since your last successful check, as an append-only list of typed events in id order.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  5 inputs

  • afterinteger“Return events with an id greater than this: next_after from your previous call.”
  • kindsarray“Only these kinds of event.”
  • productsarray“Only events for CVE records that named any of these products before or after the change, resolved as in vulnerabilities_for_products (a key from find_products …”
  • include_non_materialboolean“Also return events marked material false, such as a product name reworded by the source or a detection template added.”
  • limitinteger“Events per call, 1 to 500.”
• data_statuson 9 other serversreads or searches

  “How current AcidPeak's data is: when each collection pipeline last delivered and whether it is on time.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  Takes no inputs.

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.