---
name: research-vulnerability
description: Research a specific CVE or CWE against CloudPeek's indexed corpus and explain it with sourced detail. Use when asked what a vulnerability or weakness is, how severe it is, how it works, or how to fix it.
---

# Research a vulnerability

The corpus holds Open Knowledge Format (OKF) documents for CVEs and CWEs. Every
claim in them is grounded in the vendor or MITRE source that was collected; the
search is deterministic full-text and relationship expansion, not embeddings.
Your job is to reach the right document and report what it actually says.

## Workflow

1. Route an exact CVE, CWE, or known alias straight to `get_vulnerability`. It
   returns the **complete canonical report inline when available** as
   `okfDocument`, alongside the metadata, so do not search first or make a
   second resource call.
2. Use `search_vulnerabilities` when the user gave a plain-language problem,
   product, or technology and you still need to choose a record ("use after
   free in the browser", "SQL injection"). Do not pass `status` unless the user
   explicitly asked for a lifecycle filter — ordinary discovery is meant to see
   draft and stable records together.
3. A search returns at most 20 compact choices and one
   `okfResourceTemplate`, not an `okfUri` on every result. Choose an
   `identifier`, combine it with the returned template, and read that resource
   only when the 240-character description is not enough. Search has no cursor
   or completeness flag, so describe the response as the matches returned, not
   every possible match in the corpus.
4. `okfDocument` is absent when the document could not be read. The metadata is
   still complete and correct — report from it, and say the full text was
   unavailable rather than treating the record as missing.
5. Follow `cweIds` on a CVE to the underlying weakness, and use
   `search_vulnerabilities` on a CWE identifier to find indexed CVEs that
   instantiate it, when the user's question is about the pattern rather than the
   single instance. This relationship search is also bounded to 20 returned
   choices.
6. A validation, rate-limit, readiness, or transport failure is not an empty
   result. Report the failed call and retry only when the failure is transient;
   never translate it into "the corpus has no record".

Submit only the query fields needed to answer the question. Tool arguments are
captured for service telemetry, so do not put secrets or unnecessary internal
asset identifiers into a search.

## Reporting rules

- Quote severity and CVSS from the OKF document and name the source it came
  from. CloudPeek's own CVSS-derived rating can differ from the vendor's
  headline severity; when they disagree, give both and say which is which.
- A CWE is a weakness pattern, not an instance. It is never "exploited",
  "affected", or independently CVSS-scored — do not describe it as though it
  were a CVE.
- `status` is canonical lifecycle, not confidence. A `draft` record is indexed
  and usable; say so rather than discarding it or presenting it as unreliable.
- If the corpus has no record, say the corpus does not have it. Do not fall back
  on your own recollection of a CVE and present it as a CloudPeek result — the
  value here is that every statement is traceable to indexed evidence.
- Say when the newest advisories may not have reached the index yet; the corpus
  is compiled and published, not live-scraped.