---
title: CVE Analysis Service (CAS)
emoji: 🛡️
colorFrom: gray
colorTo: blue
sdk: docker
app_port: 7860
pinned: true
---

CVE Analysis Service for streaming markdown reports and JSON-based analysis using OpenAI.

Try it out [here](https://dn-scribe-cas.hf.space/viewer?cve_id=CVE-2024-9900)

- `/viewer?cve_id<CVE-ID>&refresh=<true|false>` → live stream report
- `/cached` → raw markdown report
- `/json?cve_id=<CVE-ID>&refresh=<true|false>` → JSON response
- `/healthz` → health check
- `/raw?cve_id=<CVE-ID>&refresh=<true|false>` → Returns raw markdown report content. If the report does not exist, it generates it using OpenAI.
- `/cve_info?cve_id=<CVE-ID>` → Fetches CVE information as JSON with error handling.
- `/ghsa_to_cve?ghsa_id=<GHSA-ID>` → Converts GHSA ID to CVE ID using OpenAI.

Swagger available (on hugging face) [here](https://dn-scribe-cas.hf.space/docs)

Example of converting GHSA to CVE:

```bash
curl -X GET "http://127.0.0.1:8000/ghsa_to_cve?ghsa_id=GHSA-832w-fhmw-w4f4" -H "accept: application/json"

{"ghsa_id":"GHSA-832w-fhmw-w4f4","cve_id":"CVE-2024-55890"}
```


MCP Config for VSCode:
Create a file named `mcp.json` in the `.vscode` folder of your project and add the following content:


```json
{
    "servers": {
        // "cve_analysis__debug": {
        //     "type": "sse",
        //     "url": "http://localhost:8000/mcp"
        // },
        "cve_analysis_hf": {
            "type": "sse",
            "url": "https://dn-scribe-cas.hf.space/mcp"
        }
    }
}
```

Function to convert from GHSA to CVE-ID:

A function based on OpenAI gpt-4o-mini-search-preview with costs as follows:

- 25$ per 1k API calls
- 0.15$ per 1M input tokens
- 0.60$ per 1M output tokens

Since the whole transaction is about 40 tokens, the real cost is the per-api-call cost.