EPSS (FIRST)
api.first.org
Exploit Prediction Scoring System: the modelled probability that a CVE will be exploited in the next 30 days, with its percentile.
GET /v1/data/epss/associates1Request
ISO 3166-1 alpha-2 code, case-insensitive. With only 6 records the whole list is usually easier than filtering.
Continent name as FIRST spells it.
curl "https://api.fastcrw.com/v1/data/epss/associates?scope=public&limit=100&offset=0&envelope=true" \ -H "Authorization: Bearer $FASTCRW_API_KEY"
2Response example
A sample shape. Press Run to see live data from EPSS (FIRST).
| id | team | team-full | host | establishment | address | country | website |
|---|---|---|---|---|---|---|---|
| cssa_e-v | CSSA e.V. | CSSA e.V. | Cyber Security Sharing & Analytics e.V. (CSSA) | November 3, 2014 | Pariser Platz 6 10117 Berlin | DE | ["https://www.cssa.de"] |
| dragos-adversary_hunt_operations | Dragos- Adversary Hunt Operations | Dragos- Adversary Hunt Operations | Dragos | December 30, 2016 | 1745 Dorsey Road, Suite R Hanover, MD 21076 | US | ["https://www.dragos.com/"] |
| e-isac | E-ISAC | E-ISAC | Electricity Information Sharing and Analysis Center | January 1, 1999 | 1401 H Street NW, Suite 410, Washington, DC 20005 | US | ["https://www.eisac.com/s/"] |
| internet_infrastructure_coalition | Internet Infrastructure Coalition | Internet Infrastructure Coalition | Internet Infrastructure Coalition | September 17, 2012 | 2920 W. Broad St. Suite 80 Richmond, VA 23230 | US | ["https://i2coalition.com/"] |
| st_engineering_info-security_cyber | ST Engineering Info-Security Cyber | ST Engineering Info-Security Cyber | ST Engineering Info-Security Pte Ltd | May 21, 1999 | 100 Jurong East St 21 Singapore 609602 | SG | ["https://www.stengg.com/en/cybersecurity"] |
| vmray | VMRay | VMRay | VMRay | November 7, 2013 | Suttner-Nobel-Allee 7 44803 Bochum Germany | DE | ["https://www.vmray.com"] |
10 more columns in JSON.
Attribution: Source: EPSS, FIRST.org
Licence: FIRST publishes EPSS scores freely via API with no registration required; attribution is requested when EPSS data is used in publications or products.
Ask with this source
A prompt for your agent that names this source and how to call it through the crw MCP.
FIRST associate member organisations
Use EPSS (FIRST) (epss) from fastCRW Pergamon, capability "FIRST associate member organisations" (associates). You need the small set of partner and sharing-community organisations affiliated with FIRST that are not full member CSIRTs, and you would otherwise miss them because they are absent from the teams listing. Example options: country=de, region=Europe, team=CSSA e.V.. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "epss" and capability "associates". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>
EPSS scores on a given date
Use EPSS (FIRST) (epss) from fastCRW Pergamon, capability "EPSS scores on a given date" (by-date). You are reconstructing what the exploit-probability landscape looked like at a point in the past, for incident post-mortems or for backtesting a prioritisation rule, rather than asking about today. Example options: date=2024-01-15, cve=CVE-2021-44228,CVE-2014-0160, q=CVE-2021-44. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "epss" and capability "by-date". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>
FIRST news channels
Use EPSS (FIRST) (epss) from fastCRW Pergamon, capability "FIRST news channels" (channels). You are about to filter the news capability and need the exact channel titles it accepts, or you want the RSS feed URL for a particular FIRST publication. Example options: title=Common Vulnerability Scoring System News, link=/newsroom/news/cvss, rss=/newsroom/news/cvss.xml. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "epss" and capability "channels". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>
Country and region lookup
Use EPSS (FIRST) (epss) from fastCRW Pergamon, capability "Country and region lookup" (countries). You need to turn a country code into a name, or find out which region string the teams and liaisons endpoints expect for a given country before filtering them. Example options: region=Europe, q=germany, scope=full. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "epss" and capability "countries". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>