Browse AI & Agents
← All products

The MITRE chain, self-updating, in your cluster

CodeRoot Vulnerability Intelligence

D3FEND to ATT&CK to CAPEC to CWE to CVE, with the CISA KEV catalog, EPSS scores, the NVD CPE dictionary and both tiers of GitHub Security Advisories. It comes up empty, populates itself and stays current with no operator intervention.

Bring your own modelAir-gap capableRead-only MCP

The shape of it

One graph, joined up

There is no dashboard to show you. The product is the graph and the endpoint your model asks, so here is the graph.

The MITRE chain held as one graphD3FEND leads to ATT&CK, then CAPEC, then CWE, which resolves to a CVE record. Four feeds attach to that record: the CISA KEV catalog of known exploited vulnerabilities, EPSS exploitation probability, GitHub Security Advisories carrying packages and version ranges, and the NVD CPE dictionary for product matching.resolves toenriched byD3FENDdefensive techniquesATT&CKadversary techniquesCAPECattack patternsCWEweakness classesCVEthe vulnerability recordCISA KEVknown exploitedEPSSexploitation probabilityGHSApackages, version rangesNVD CPEproduct matching
One traversable graph, not nine downloads joined by hand. Ask what defends against a technique, or which of your products a known-exploited vulnerability actually touches, and the path is already there.

One chain, joined up

Defensive techniques through adversary techniques, attack patterns, weakness classes and specific vulnerabilities, held as one traversable graph rather than as separate downloads you join by hand. Exploitation signal comes from the KEV catalog and EPSS, and product matching from the CPE dictionary.

Built for your model, not ours

It ships a read-only MCP server so an agent can ask questions and get answers with citations. There is no bundled LLM client and no model credentials: you point your own model at it. Queries run against a fixed surface rather than free-form SQL, so an agent cannot wander outside what it is allowed to read.

Nine sources, one fixed order

The pipeline order is not incidental. Taxonomy first, then the product dictionary, then the known-exploited catalogue, then CVE records, then the operational enrichment that hangs off them, then a data-quality report. KEV deliberately loads before CVE: it keys on a CVE id as text with no foreign key into the CVE table, so a CVE outage still fails loudly while KEV, EPSS and the rest survive it.

  • Phase 1 (MITRE taxonomy): cwe, capec, attack, d3fend
  • Phase 2 (product dictionary): nvd_cpe, roughly 1.3 million entries
  • Phase 3 (known-exploited catalogue): kev
  • Phase 4 (CVE records): cve
  • Phase 5 (operational enrichment): epss, ghsa
  • Phase 6: data-quality report

Unattended by design

The database is empty on first start, populates itself from its sources, and keeps itself current on its own schedule. There is no curation step for an operator to forget, which is what makes it viable in environments where nobody is watching it day to day.

Deployment

Where it runs

Runs
Deployable in your cluster, reachable only from inside it
Install
Helm chart, or Compose for a local run
Egress
None required; bring your own model
Offline
Suitable for secure and air-gapped environments