jev-cvss
Scripts where Jev selects CVSS metric values from a vulnerability description and code computes v3.0, v3.1 or v4.0 scores.
Overview
Jev CVSS Scoring Scripts turn a vulnerability description into a CVSS score. Jev reads the description and picks a value for each CVSS metric through one Choice question per metric (plus Noul questions for v4.0 safety metrics), all in one API request. The numeric scores are computed in deterministic Python following the official FIRST specifications, including their quirks, and the v4.0 MacroVector algorithm is ported from FIRST's reference calculator.
It suits security teams who need fast first-pass CVSS vectors from advisories. Each script prints scores with severity rating, the vector string, and every metric value with its top-two probability spread so close calls are visible; a raw mode dumps unedited answers. Separate scripts cover v3.0 (base and temporal), v3.1 (base, temporal and environmental) and v4.0 (base plus safety and exploit maturity).
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Which value applies for each CVSS metric (AV, AC, PR, UI, S, C, I, A and others)? | — |
| Yes / no | Are the v4.0 safety conditions met? | — |
How it works
- Pass a description as an argument, file or stdin
- One Jev request with one Choice question per metric
- Compute scores in code per the FIRST specification
- Print scores, vector, per-metric choices and top-two probability spread
Strengths
- Arithmetic stays in code, verified against reference implementations
- Probability spread exposes uncertain metrics
- Single request per description
Caveats
- Metric selection accuracy is not reported in the excerpt
- Requires TYPESAFE_API_KEY
Getting started
`export TYPESAFE_API_KEY=...` then `python3 cvss31_jev.py "description text..."` (or -f advisory.txt).At a glance
- Type
- Project
- Status
- beta
- Language
- Python
- Runtime
- CLI scripts
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Scripts that use Jev to select CVSS metrics from vulnerability descriptions, then compute v3.0, v3.1 or v4.0 scores in Python.
logicrw/awesome-jev-projectsFast CVSS scoring from vulnerability descriptions using Typesafe Jev.
hellogumbo/awesome-jev
Frequently asked questions
What does Jev decide?
The value of each CVSS metric from the vulnerability description.
Does Jev compute the score?
No. Scores are computed in Python exactly per the FIRST specifications.
Which CVSS versions are supported?
v3.0, v3.1 and v4.0, each in its own script.
Related projects
Semantic grep that asks Jev a yes/no about every function for questions no regex can express, with cost reporting.
ProjectbetaRust CLI that classifies Git commit diffs with Jev into bug fixes, security fixes with CWEs, and change types.
CLIbetaRustJSON-in/JSON-out CLI that reranks, filters or compresses search results with independent Jev Noul checks, keeping metadata intact.
CLIbetaRustSite audit for SEO and AI-search visibility: a deterministic crawl, narrow Jev Choice, Score and Noul questions, and a live dashboard.
AppbetaTypeScriptCLI that has Jev judge a video's subtitles segment by segment, then cuts a highlight reel and a filler-free full version.
ProjectbetaPythonGrep by meaning: a zero-dependency Node CLI where Jev scores each line against a described meaning, combinable with AND/OR/NOT.
ProjectbetaJavaScript