Ubuntu Security CVE API — CVEs

naftiko: 1.0.0-alpha2
info:
  label: Ubuntu Security CVE API — CVEs
  description: 'Ubuntu Security CVE API — CVEs. 2 operations. Lead operation: List CVEs. Self-contained Naftiko capability
    covering one Ubuntu business surface.'
  tags:
  - Ubuntu
  - CVEs
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    UBUNTU_API_KEY: UBUNTU_API_KEY
capability:
  consumes:
  - type: http
    namespace: cve-cves
    baseUri: https://ubuntu.com/security
    description: Ubuntu Security CVE API — CVEs business capability. Self-contained, no shared references.
    resources:
    - name: cves.json
      path: /cves.json
      operations:
      - name: listcves
        method: GET
        description: List CVEs
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: q
          in: query
          type: string
          description: Search query for CVE IDs or descriptions.
        - name: package
          in: query
          type: string
          description: Filter CVEs by affected package name.
        - name: priority
          in: query
          type: string
          description: Filter by CVE priority level.
        - name: status
          in: query
          type: string
          description: Filter by fix status.
        - name: codename
          in: query
          type: string
          description: Filter by Ubuntu release codename (e.g., jammy, noble).
        - name: offset
          in: query
          type: integer
          description: Pagination offset.
        - name: limit
          in: query
          type: integer
          description: Number of CVEs to return per page.
    - name: cves-cve_id}.json
      path: /cves/{cve_id}.json
      operations:
      - name: getcve
        method: GET
        description: Get CVE
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: cve_id
          in: path
          type: string
          description: CVE identifier (e.g., CVE-2024-1234).
          required: true
  exposes:
  - type: rest
    namespace: cve-cves-rest
    port: 8080
    description: REST adapter for Ubuntu Security CVE API — CVEs. One Spectral-compliant resource per consumed operation,
      prefixed with /v1.
    resources:
    - path: /v1/cves-json
      name: cves-json
      description: REST surface for cves.json.
      operations:
      - method: GET
        name: listcves
        description: List CVEs
        call: cve-cves.listcves
        with:
          q: rest.q
          package: rest.package
          priority: rest.priority
          status: rest.status
          codename: rest.codename
          offset: rest.offset
          limit: rest.limit
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/cves/cve-id-json
      name: cves-cve-id-json
      description: REST surface for cves-cve_id}.json.
      operations:
      - method: GET
        name: getcve
        description: Get CVE
        call: cve-cves.getcve
        with:
          cve_id: rest.cve_id
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: cve-cves-mcp
    port: 9090
    transport: http
    description: MCP adapter for Ubuntu Security CVE API — CVEs. One tool per consumed operation, routed inline through this
      capability's consumes block.
    tools:
    - name: list-cves
      description: List CVEs
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: cve-cves.listcves
      with:
        q: tools.q
        package: tools.package
        priority: tools.priority
        status: tools.status
        codename: tools.codename
        offset: tools.offset
        limit: tools.limit
      outputParameters:
      - type: object
        mapping: $.
    - name: get-cve
      description: Get CVE
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: cve-cves.getcve
      with:
        cve_id: tools.cve_id
      outputParameters:
      - type: object
        mapping: $.