`top_exploited`

Pack: epss · Connect: https://pipeworx.io/mcp (see Connect below for a single-pack URL)

No MCP client? Call it directly: GET https://gateway.pipeworx.io/v1/tools/top_exploited for the schema, then POST the same URL with its arguments for the data.

List the CVEs most likely to be exploited, ranked by EPSS score descending. Answers “which vulnerabilities are most likely to be exploited right now” so you can prioritize patching. EPSS is the probability (0-1) a CVE will be exploited in the wild in the next 30 days; this complements CVSS severity rather than replacing it.

Parameters

Name	Type	Required	Description
`min_score`	number	no	EPSS threshold 0-1; only CVEs with a score greater than this are returned. Default 0.9.
`limit`	number	no	Max CVEs to return (default 30, max 100).

Example call

Arguments

{
  "min_score": 0.9,
  "limit": 30
}

curl

curl -X POST https://gateway.pipeworx.io/epss/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"top_exploited","arguments":{"min_score":0.9,"limit":30}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('top_exploited', {
  "min_score": 0.9,
  "limit": 30
});

More examples

{
  "min_score": 0.75,
  "limit": 50
}

Connect

Add this to your MCP client config — every tool in the catalog, including this one — or use one-click install buttons:

{
  "mcpServers": {
    "pipeworx": {
      "url": "https://pipeworx.io/mcp"
    }
  }
}

Connect to just the epss pack

{
  "mcpServers": {
    "epss": {
      "url": "https://gateway.pipeworx.io/epss/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

top_exploited