SSVC Ore Miner - www.rapticore.com

Open-source vulnerability management orchestrator — aggregate, deduplicate, and prioritize findings from every scanner using CVSS, KEV, EPSS, SSVC, and exploit availability

Agent-native CVE + bug-bounty-mechanic intelligence as a hosted MCP: ~365k CVEs fused (NVD/KEV/EPSS/OSV/SSVC) ranked exploitation-first, a fact-checker for hallucinated CVEs, and attack-mechanic transfer from ~14k disclosed reports — a memory of real mechanics to borrow and run.

Perl extension for SSVC (Stakeholder-Specific Vulnerability Categorization)

Type-safe LLM vulnerability triage on Pydantic AI + MCP. Ten typed tools (NVD, OSV, KEV, EPSS, Exploit-DB, ATT&CK, SBOM, Nmap) ground a validated TriageReport with a deterministic SSVC verdict. Red-team battery (MITRE ATLAS), reproducible scorecard, OWASP LLM + ISO 42001 mapping. Next.js frontend.

Threat Intel Arbiter — org-context-aware threat prioritization. SSVC actions, ATT&CK tagging, MISP+KEV, single Go binary.

This master's thesis proposes a multidimensional vulnerability classification and remediation framework for the Software Composition Analysis (SCA) Tool at FAU, integrating CVSS, EPSS, and SSVC to prioritize vulnerabilities effectively.