trust surface

About Vuln Signal Radar

Vuln Signal Radar is a read-only defensive vulnerability radar that aggregates and normalizes public vulnerability information for defender triage.

Purpose

The radar helps defenders judge CVE priority by showing source-published defensive context, freshness, and prioritization signals. AI agents can use the read-only JSON and WebMCP surfaces to inspect the same public-safe material without mutation, external execution, or remediation actions.

The page emphasizes source-published defensive context rather than raw fetch output.

Data Sources

Vuln Signal Radar combines public records and advisory references. Source coverage can be partial, delayed, or unavailable for individual CVEs.

NVDNational Vulnerability Database enrichment and CVE context.
CISA KEVKnown Exploited Vulnerabilities catalog signals.
EPSSExploit Prediction Scoring System probability context.
Vendor advisoriesVendor-published advisory links referenced through public CVE records.
OSVOpen source vulnerability records and package ecosystem context.
GitHub Security AdvisoryPublic GitHub Security Advisory records.
Public CVE recordsPublic CVE identifiers and disclosure records.

Safety Policy

Only public-safe defensive context is shown.
Procedure-level offensive material is excluded.
Target discovery guidance is excluded.
Automatic remediation is not performed.
The site is limited to read-only defensive triage.

Limitations

This site is not an authoritative advisory.
Patch status, affected versions, and exposure must be confirmed against the vendor advisory and your own environment.
KEV not listed does not mean not exploited.
EPSS and CVSS are prioritization inputs, not standalone conclusions.

Agent-readable Data

Vuln Signal Radar exposes three read-only surfaces for humans and AI agents: Knowledge Graph / JSON-LD for source provenance, Local-first Personal Data Vault for browser-only review context, and RirastaFab Trust Layer for hash-only proof metadata.

Knowledge Graph / JSON-LDUse /.well-known/signal-graph.jsonld and /data/v1/graph/latest.jsonld to inspect CVE signal nodes, source links, affected product references, and provenance without calling a runtime API.Local-first Personal Data VaultHuman-only browser state stored in localStorage. It supports import, export, clear, and shape validation, and never uploads data.RirastaFab Trust LayerUse /.well-known/rirastafab-trust.json and /data/v1/proof/latest.json for hash-only integrity metadata, canonical envelopes, and attestation-ready status.

AI agents should start with /agent.json, follow machine_readable_surface, validate schemas before use, and keep all actions read-only.

/agent.json /.well-known/signal-radar.json /.well-known/rirastafab-trust.json /.well-known/signal-graph.jsonld /data/v1/graph/latest.jsonld /data/v1/proof/latest.json /data/v1/proof/canonical-policy.json /data/v1/proof/canonical-envelope.json /data/v1/proof/canonical-envelope-index.json /data/v1/proof/signed-json-status.json /data/v1/proof/eas-preflight.json /data/v1/proof/eas-candidate.json /data/v1/proof/eas-schema-mapping.json /data/v1/proof/eas-typed-payload.json /data/v1/proof/public-key.json /data/v1/attestations/vuln-signal-ledger.json /data/v1/priority-queue.json /data/v1/diff/latest.json

WebMCP read-only toolsEnabledRuntime server endpointsNoneExternal executionDisabledAuto remediationDisabledSignature / EASKey-gated / EAS not submittedRemediation ProofNot enabled

Contact

Use the contact route for corrections, source issues, false positives, safety concerns, removal requests, and general feedback.

Email [email protected]

Do not send secrets, credentials, private vulnerability details, or private system details.

Privacy Note

Information sent through contact is used only to respond to the inquiry. Please avoid sending secrets, credentials, private system details, or confidential vulnerability information.