Integrate Volerion CVE Intelligence

[michael-bey]

MR: Integrate Volerion CVE Intelligence

Adds three Model Context Protocol (MCP) tools backing the Volerion vulnerability intelligence API: get_volerion_intel, get_volerion_scores, and lookup_volerion_product.

These tools are optional and degrade gracefully when VOLERION_API_KEY is not set.

---

Why Volerion?

Volerion provides proprietary, commercial CVE intelligence. We are adding it to complement static database aggregates (NVD, EPSS, CISA KEV) with:

• Qualitative analysis: AI-written CVE context, remediation, and reproducer guidance.
• Attack trajectories: Structured attack flows and variation chains.
• Multi-dimensional scoring: 8-dimension risk ratings (spread, impact, threat, urgency, etc.).
• Visual mapping: Link to Volerion's interactive graph explorer.

---

Technical Summary

• Endpoints: Integrates /v1/cve/intel, /v1/cve/intel/scores, and /v1/products via src/cve_mcp/api/volerion_client.py.
• Bug Fix (Products Schema): Corrected VolerionProduct Pydantic model and output formatting in server.py to properly map the actual API keys (title, state, versions) instead of discarding them.
• Limiting: Dedicated TokenBucketRateLimiter (default: 2 req/s, burst 5), decoupled from NVD.
• Caching (SQLite):
  • volerion:intel (12h TTL)
  • volerion:score (1h TTL, unfiltered only)
  • volerion:products (24h TTL)
• Validation: 11 Pydantic models with extra="ignore" to maintain resiliency against schema additions.

---

Quick Start & Verification

1. Run Offline Tests

uv run pytest tests/test_tools.py -k "volerion"

2. Configure Environment

Set the pre-encoded Base64 user:pass string in .env:

VOLERION_API_KEY="your_base64_auth_key"

3. Run Server

uv run cve-mcp

---

Tool Examples & Outputs

1. get_volerion_scores

Arguments:

{
  "cve_ids": "CVE-2026-44902",
  "profile": "risk"
}

Output:

Volerion Risk Scores (profile: risk)

CVE-2026-44902 4.8/10 [█████████ ] medium spread=0.0 impact=2.5 exploit=8.7 remediation=0.0 threat=6.4 urgency=2.9 incentive=4.2 score=4.8

2. get_volerion_intel

Arguments:

{
  "cve_ids": "CVE-2026-44902"
}

Output:

=== Volerion Intel: CVE-2026-44902 ===

  Graph:       https://graph.volerion.com/view?id=CVE-2026-44902
  Published:   2026-05-27
  Updated:     2026-05-27
  CVSSv4:      7.7
  CVSSv3:      7.5

ANALYSIS:
AI

TITLE: OpenTelemetry JS Prometheus Exporter Denial-of-Service Vulnerability

DESCRIPTION:
A denial-of-service vulnerability has been identified in the OpenTelemetry JavaScript Client, specifically in versions prior to 0.217.0 of the Prometheus exporter. The issue arises because the metrics endpoint, which listens on 0.0.0.0:9464 by default, lacks proper error handling for URL parsing. As a result, a single malformed HTTP request can cause an uncaught TypeError that crashes any Node.js process using this exporter. This vulnerability is particularly concerning because the metrics endpoint is unauthenticated and accessible by any network client that can reach the metrics port.

IMPACT:
Exploitation of this vulnerability leads to a process crash, causing a denial-of-service condition for the application.

REMEDIATION:
Users can update the OpenTelemetry Prometheus exporter and Node.js SDK to version 0.217.0 or later. Additionally, for those using the OpenTelemetry auto-instrumentations for Node.js, version 0.75.0 or later should be installed. If an immediate update is not possible, access to the metrics endpoint should be restricted from untrusted or unauthenticated network clients.

REPRODUCTION:
To reproduce this vulnerability, start a Node.js application with the OpenTelemetry Prometheus exporter enabled, using version 0.217.0 or earlier. The exporter should be configured to listen on the default metrics port, 9464. Once the application is running, send a malformed HTTP request, such as one that includes an invalid URL, to the metrics endpoint. The Node.js process will crash immediately, displaying an uncaught TypeError indicating an invalid URL.

ATTACK VARIATIONS:
  [Denial of Service via Malformed Request to OpenTelemetry Prometheus Endpoint] When an application is configured with the vulnerable OpenTelemetry JavaScript Prometheus exporter, its publicly exposed...

ATTACK FLOW: vulnerability() → condition() → action(delivery) → action(exploitation)

AFFECTED PRODUCTS (4):
  OpenTelemetry JavaScript Client (< 0.217.0)
  OpenTelemetry Auto Instrumentations Node (< 0.75.0)
  OpenTelemetry Exporter Prometheus (< 0.217.0)
  OpenTelemetry SDK Node (< 0.217.0)

REFERENCES (1):
  https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3  [Advisory, Exploit, Remedy, Vendor]

3. lookup_volerion_product

Arguments:

{
  "vendor": "apache",
  "product": "log4j",
  "limit": 1
}

Output:

Volerion Product Catalog  (1 results)

  [Application]  apache / log4j  (target_sw: java)
    Apache Log4j 2