What this tool actually does,
and where each piece earns its keep.
Eleven feature blocks below. Each one has a sentence on what it does, a paragraph on how it works, and a concrete use case so you know when to reach for it.
CVE Analysis
Hit the search bar with something like CVE-2021-44228 and we go fetch NVD, MITRE, GitHub Security Advisories and the actual GitHub patch commit in parallel. Claude Sonnet 4.5 then turns all of it into a plain-English root-cause walkthrough, attack flow steps, a sanitized pseudo-exploit, defensive recommendations, and an exploit-difficulty score.
Triaging a Patch-Tuesday bulletin. Reading a CVE you saw on Twitter. Briefing a non-technical stakeholder.
Multi-Source Intelligence
Most analysts open four tabs to chase a CVE. We pull all four at once: NVD JSON 2.0 for CVSS + weaknesses, MITRE CNA container for the authoritative description, GitHub Security Advisories for ecosystem-aware ranges, and any commit/PR URLs referenced by NVD for the real patch diff.
Verifying a CVSS dispute. Finding the actual fix commit. Knowing if a private advisory has been published.
Sanitized Pseudo-Exploit
The AI produces a code sketch that shows the SHAPE of the attack with placeholders like <PAYLOAD_REDACTED> and <ATTACKER_HOST>. You learn what the attack looks like in logs and code-review without us shipping working weaponry. For sensitive CVEs the model can refuse this section entirely.
Code review. Detection engineering inspiration. Teaching juniors what an attack looks like at the keyboard.
Real-World Exploitability
A 0–10 score blending CVSS vector + AI reasoning over prerequisites (network access, auth, user interaction, vuln version, public PoC, weaponization). Verdict: Trivial / Easy / Moderate / Hard / Theoretical. Includes attacker-skill ceiling and a time-to-exploit estimate.
Defending a 'this CVE is critical' alert that's actually theoretical. Or the inverse - proving a 'medium' is trivially exploitable.
Patch Priority Score
Composite operational score from CVSS (severity) + EPSS percentile (real-world exploit likelihood) + CISA KEV catalog (known active exploitation, with ransomware-use flag). Outputs PATCH NOW / THIS SPRINT / BACKLOG / INFORMATIONAL with an SLA window and a list of drivers.
Daily vuln-management triage. Justifying a 2am pager call (or NOT calling).
GitHub Patch Diff Viewer
When NVD references a commit or PR, we fetch the actual file-level diff from GitHub and render it inline with green/red gutter, hunk headers, and a link back to the source. The AI also produces a 2-3 sentence patch summary.
Understanding the fix without leaving the page. Variant-hunting in your own codebase.
Detection Rules · 5 Formats
One click and Claude generates production-grade detection content for every major SIEM/EDR: Sigma (with proper logsource taxonomy), YARA (rule blocks with strings + condition), KQL (against Sentinel/Defender tables), Splunk SPL (with eval/stats), Suricata (signed sid 1000000+). Plus IoC pivots, telemetry requirements, MITRE ATT&CK technique chips, and tuning notes.
Detection engineering for a fresh CVE without writing Sigma at 11pm. Bootstrapping a content-as-code repo.
SBOM Scanner + VEX Export
Paste or upload a CycloneDX/SPDX SBOM, npm package.json, or pip requirements.txt. We match every component against OSV.dev, surface CVE-linked findings, let you mark each one with a VEX state (exploitable / not_affected / in_triage / false_positive / resolved) and a justification (code_not_reachable, requires_configuration, etc). One click downloads a CycloneDX 1.5 VEX JSON.
Pre-merge dep audit. Customer-facing 'are we affected?' question. EO 14028 / CRA compliance evidence.
Async Job Pattern
Detection regeneration runs as a background job: POST returns 202 + job_id, you poll /api/jobs/{id}, you can DELETE to cancel mid-flight. Race-safe, dedupe-by-target, 7-day TTL purge. Same primitive will be applied to /analyze and /sbom/scan next.
Hitting Regenerate. Calling our API from a SOAR playbook. Building bots on top of us.
Rate Limits That Make Sense
Per-IP: /analyze 8/min · 40/hr, /detections 5/min · 25/hr, /sbom/scan 5/min · 20/hr, /cve/recent + /cve/trending 30/min · 200/hr. Every response carries X-RateLimit-* headers and a Retry-After on 429. Job polling is intentionally unrestricted.
Stops crawlers from burning the LLM budget. You probably will not notice these limits while using the UI.
Community Activity
The 'Recently analyzed by the community' list is shared across every visitor: each CVE someone analyzes shows up with its KEV status and priority tier. 'Trending on NVD' surfaces the freshest published CVEs of the last 7 days regardless of whether anyone analyzed them yet.
Spot what your peer defenders are panicking about today. Pre-warm your reading for the next standup.
Will you ever produce a working exploit?
No - the underlying model refuses, and we'd be on the wrong side of several jurisdictions' laws if we tried. Our pseudo-exploits are intentionally non-functional and contain placeholder values like <PAYLOAD_REDACTED>.
Is my data shared?
Analyses are cached globally in our database (other users may see that CVE-XXXX was analyzed) but we don't store IP addresses, user-agents, or anything that could identify you. The sidebar showing 'Recently analyzed by the community' uses these shared cache entries.
How accurate is the priority score?
The CVSS + EPSS + KEV inputs are authoritative - they come straight from FIRST.org and CISA. The composite formula is a transparent blend (CVSS*0.5 + EPSS*5, floored to 8.5 when in KEV, 9.5 when ransomware-used). Detection rules and pseudo-exploits are AI-generated - verify before deploying to production.
Can I call this from my SOAR / Jira / Slack bot?
Yes - every UI feature is backed by a documented JSON endpoint at /api/* and respects rate limits per source IP. The async-job pattern means you can fire-and-poll. A dedicated SDK + API tokens are on the roadmap.
How is this free?
It runs on weekends and goodwill, plus the Support button up top. If this tool has saved you time, $10 keeps the LLM credit topped up for the next defender.
Free for everyone. Made by one human who likes the open web.
Every analysis here costs real LLM tokens, OSV/NVD bandwidth, and quiet weekends. If this tool saved you an hour - or a CVE Wednesday from going sideways - support this project so it stays free for the next defender after you.