Claude Code plugin
Triage CVEs and write dispositions from Claude Code
cveriskpilot-triage 0.1.1What is in the plugin
cve-triage skill
Walks CVE IDs, scanner output, or an SBOM through CISA's SSVC decision tree and returns Track, Track*, Attend, or Act per finding with the path taken, a deadline, and every assumed input flagged.
disposition-writeup skill
Turns a triage result into an assessor-ready record: VEX status with justification code, SSVC rationale, compensating controls, remediation plan, approval block, and a CMMC 2.0 Level 2 and SOC 2 control mapping with a paste-ready POA&M line item.
cveriskpilot MCP server
Connects Claude Code to your workspace so triage runs on real findings and asset context instead of pasted data, and so finished dispositions can be saved back for approval.
The skills work on pasted data without the connection. The connection adds exposure, environment, criticality, owner and existing-exception context, so fewer SSVC inputs have to be assumed.
Requirements
- Claude Code with plugin support.
- A workspace API key from Settings, API keys. Scope
readlets the plugin read findings and look up CVEs; addtriageto let it save dispositions. API access is included with Founders Beta, Pro and Enterprise.
Install
Set the API key in the shell before launching Claude Code, then load the plugin. The quickest way loads it straight from this site for the session; the download route lets you pin a copy.
export CVERISKPILOT_API_KEY="crp_..."claude --plugin-url https://cveriskpilot.com/downloads/cveriskpilot-triage-0.1.1.plugincurl -fsSL https://cveriskpilot.com/downloads/cveriskpilot-triage-0.1.1.plugin -o cveriskpilot-triage.plugin
claude --plugin-dir ./cveriskpilot-triage.pluginclaude mcp list # shows cveriskpilot and warns if CVERISKPILOT_API_KEY is unset
/mcp # inside a session: server status and its four tools--plugin-dir and --plugin-url load the plugin for that session. A marketplace listing for a persistent /plugin install is coming; the package is the same either way. The plugin's .mcp.json is already configured:
{
"mcpServers": {
"cveriskpilot": {
"type": "http",
"url": "https://cveriskpilot.com/api/mcp",
"headers": { "Authorization": "Bearer ${CVERISKPILOT_API_KEY}" }
}
}
}Any MCP client can use the same endpoint with the same header; the plugin is a convenience around it.
Use it
Typical flow: triage first, then write up any Attend or Act items. Prompts that trigger the skills:
- “Triage our open findings”
- “Run SSVC on CVE-2026-12345 for the customer portal”
- “Write up the disposition for the Next.js finding and save it”
- “Create a VEX statement for the OpenSSL finding: not affected, vulnerable code not in execute path”
- “Map this disposition to CMMC and SOC 2 and give me the POA&M line”
Every triage table shows the four SSVC values and the decision-table row, and lists any value that was assumed rather than confirmed. Confirm those before relying on a disposition; your assessor will ask.
MCP tools
| Tool | Key scope | What it does |
|---|---|---|
| list_findings | read | Open cases with CVE IDs, CVSS, EPSS, KEV, package and fix version, asset environment, criticality and exposure, client, verdict, due date. Filter by severity, CVE, asset or client; paginated. |
| get_finding | read | One case in depth: description, CWEs, vector, AI advisory summary, remediation notes, existing exceptions and their approval state, and the finding-level evidence triage needs. |
| lookup_cve | read | KEV listing and due date, EPSS score and percentile, CVSS, and a summary for any CVE, from the platform's enrichment data with a bounded live lookup as fallback. |
| write_disposition | triage or admin | Saves a VEX disposition and its writeup to a case. Creates a pending risk exception or moves the case along a permitted status transition. Never approves anything. |
All reads are scoped to the key's organization, and to its assigned clients for MSSP keys. Every write is recorded in the audit trail with the API key as the actor.
How a saved disposition lands
The writeup skill produces a VEX status and justification. Saving it maps onto the workspace's existing records, and nothing is approved by the plugin: exceptions are created pending, and status changes that your workflow gates behind approval are refused with a clear message.
| VEX status | Workspace record |
|---|---|
| not_affected + component_not_present | Pending NOT_APPLICABLE exception |
| not_affected + any other justification | Pending FALSE_POSITIVE exception |
| affected with an approver and no remediation plan | Pending ACCEPTED_RISK exception with expiry |
| affected with a remediation plan | Case moves to In remediation; plan appended to remediation notes |
| fixed | Case moves to Fixed, pending verification |
| under_investigation | Case moves to Triage |
The full writeup (SSVC path, compensating controls, remediation plan, approver, control mappings) is stored with the record as evidence, so the approver sees exactly what the assessor will see.
Standards the plugin follows
- CISA Stakeholder-Specific Vulnerability Categorization Guide, November 2022: decision points Exploitation, Automatable, Technical Impact and Mission & Well-Being; outcomes Track, Track*, Attend, Act (Table 9).
- VEX statuses and the five not-affected justification codes as defined by CISA and OpenVEX.
- CMMC 2.0 Level 2 practice IDs (NIST SP 800-171 Rev 2) and the 2017 Trust Services Criteria.
Framework references are starting points. Confirm them against your assessment scope and the framework revision your assessor uses before submitting evidence.
Troubleshooting
401 MISSING_API_KEY or INVALID_API_KEY
CVERISKPILOT_API_KEY is not set in the shell that launched Claude Code, or the key was revoked or expired. Keys start with crp_. Create a new one under Settings, API keys.
403 INSUFFICIENT_SCOPE
The key lacks the read scope. Every plugin interaction reads workspace data, so read is the minimum; add triage if you want to save dispositions.
write_disposition returns a tool error about scope
Reads work but the key cannot write. Create a key with read,triage or ask an owner for one with admin.
429 rate limited
The workspace tier's API rate limit applies to MCP calls the same way it applies to the REST API. Wait for the window shown in Retry-After.
Disposition saved but the case did not change status
That transition requires approval in the workspace. The record was created pending; an owner or security admin approves it under Cases or Risk exceptions.