The tools in cveasy-forge are for testing systems you own or are explicitly authorized to test — your own MCP servers, agents, chatbots, and vulnerability data. Use them only against:

• Software and services you operate
• Targets you have written authorization to assess
• Intentionally-vulnerable demo targets and CTF environments (this repo ships some)

Do not point them at production systems you do not control, third-party services outside an authorized engagement, or anything where probing would constitute unauthorized access in your jurisdiction.

The --active modes actually invoke tools on the target. They are deliberately conservative (read-only allowlist, no destructive calls, per-run budgets), but you are still responsible for ensuring the run is authorized.

If you find a bug that could mislead a user — a check that misses a class it claims to catch, or one that produces false confidence — email security@cveasyai.com. Please do not open a public issue.

We aim to acknowledge within 72 hours and ship a fix within 30 days for confirmed issues.

If a tool here helped you find a flaw in a third-party product, follow that vendor's responsible-disclosure process. Don't publish a working exploit against a production system without coordination. If you can't find a contact, email security@cveasyai.com and we'll help broker disclosure.

Everything here is provided AS-IS, without warranty. The authors and CVEasy AI / BlueTeamAutomation are not liable for any consequences of use. You are responsible for ensuring your use is authorized and legal.