User repository on GitHub
Fast CVSS scoring from vulnerability descriptions using Typesafe Jev
- Forks
- 1
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.
CommunityJev Tools & CLIs
Jev Cvss
Three Python scripts that have Jev pick CVSS metric values from a vulnerability description while the numeric scores are computed in code, following the FIRST v3.0, v3.1 and v4.0 specifications.
- Stars
- 2
- Language
- Python
- License
- MIT
- Published by
- Community
- Author
- Red5d
- Last verified
- Oct 2026
About this project
Score software vulnerability descriptions with CVSS using TypeSafe's Jev (jev-latest) via the System One API. Jev reads the description and selects the metric values; the numeric scores are computed in code, exactly per the official FIRST specifications and verified against reference implementations. All scripts read the TypeSafe API key from the TYPESAFEAPIKEY environment variable. The scripts fail with a clear error if it is not set. All scripts take the same input forms:
Quoted from the project's README. Read the full README.
Works forJev for Classification
Used inJev for Software & DevTools
- Languages
- Python
Highlights
- Jev only selects metrics, one choice question each in a single request per description; every score comes from the spec equations.
- v3.1 scoring was cross-checked against Red Hat's official cvss library on 300 randomized vectors including Environmental, with no mismatches.
- v4.0 ports FIRST's MacroVector algorithm with the 270-entry lookup table and matched the reference implementation across 154 cases.
- Each metric prints its top-2 probability spread, so a disagreement with an official score usually names the metric that diverged.
Watch out
Descriptions are scored as written, so missing impact details cannot be recovered and a vague description gives a vague score — the probability spread is where you see it. Environmental metrics are not elicited for v3.0 or v4.0, and on v4.0 only E and safety are asked for; v3.1 elicits CR, IR and AR while Modified metrics default to Base values. The question criteria are calibrated to NVD conventions: arbitrary code execution implies High impact, a common deployment still counts as Low attack complexity, browser components count as Network vector while victim interaction is the UI metric, and severity labels in the text are ignored. Scope is preferred as Unchanged when ambiguous. The first live run of each script may need parser hardening if the API response shape changes, and --raw shows the actual answers JSON. Copy reviewed against the repository README on 2026-10-04, not from running it.
Questions about this entry
Short answers drawn from the linked project or page.
Only the metric selection is the model's job. The numbers are deterministic code: the closed-form equations from the specification, including its quirks — PR weights of 0.68 and 0.50 when scope changed, the ModifiedImpact exponent 13 with the 0.9731 term and the 0.915 cap, and true ceiling rounding. For v4.0 the MacroVector algorithm is ported from FIRST's own reference calculator, which the specification designates as the source of those scores.
The per-metric probability table is the debugging tool — every metric prints its top-2 spread, so a close call is visible and a divergence usually points at one metric. The criteria encode NVD conventions that account for most gaps: severity words in the description are deliberately ignored in favour of technical facts, arbitrary code execution implies High impact metrics, and Scope is preferred as Unchanged where the text is ambiguous.
No. v3.0 covers Base and Temporal. v3.1 adds Environmental, eliciting CR, IR and AR, with Modified metrics defaulting to Base values. v4.0 elicits Base plus E and the safety Noul questions, and nothing else from the Temporal and Environmental groups.
The first live run of each script may need parser hardening, which is why --raw exists: it dumps the unedited Jev answers JSON so you can see what actually came back. Helper scripts are included too — parse_nvd.py pulls descriptions and official vectors out of NVD API JSON for regression testing, and verify_cvss_scripts.py imports all three modules and checks known vectors.
cvss3_jev.py scores CVSS v3.0 Base and Temporal, cvss31_jev.py scores v3.1 Base, Temporal and Environmental, and cvss4_jev.py scores v4.0 Base with safety and E, each eliciting its own metric set.
As a command-line argument, with -f pointing at a file, or piped on stdin, and add --raw to dump the unedited Jev answers JSON.
v3.0 and v3.1 match well-known NVD vectors, with v3.1 cross-checked against Red Hat's official cvss library on 300 randomized vectors including Environmental at zero mismatches, and v4.0 at zero mismatches across 154 cases against FIRST's reference.
More Jev resources like this
34GitHub stars
Pure-HTTP automation for the TypeSafe register, magic-link login, onboarding, and API-key creation flow, with pluggable temp-mail backends, concurrent batch runs, and key verification exports.
Jev Tools & CLIs#community#awesomejev#catalog-import
Community
2951461586/Jev-Register-ToolPython
2951461586/Jev-Register-ToolPython36GitHub stars
Python toolkit plus 0.8B multimodal model that takes a message, document, or image and returns calibrated choice, yes/no, and score answers in one forward pass for local decision workloads.
Jev Tools & CLIs#community#awesomejev#catalog-import
Community
PsiACE/dohnutsPython
PsiACE/dohnutsPython39GitHub stars
Video tool where Jev scores subtitle segments and code assembles a short highlights cut plus a de-watered full cut with timestamped summaries.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
cclank/jevclipPython
cclank/jevclipPython30GitHub stars
Forkable weekday radar that asks Jev one yes-or-no question per interest over each new arXiv announcement and publishes a page plus RSS feed.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
Eliot5566/JEV-Paper-RadarPython
Eliot5566/JEV-Paper-RadarPython38GitHub stars
Async supervisory layer for Hermes Agent that locks Definitions of Done, proves mechanical criteria locally, and calls Jev only for unresolved semantic checks under a token budget.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
keeltrace/hermes-nervePython
keeltrace/hermes-nervePython15GitHub stars
Two-tier decision engine pairing a 22.6M-parameter MiniLM encoder on the Apple Neural Engine with the on-device Apple Foundation Model as fallback for uncertain inputs.
Jev Tools & CLIs#community#awesomejev#catalog-import
Community
kerryrm/systemANEPython
kerryrm/systemANEPythonFrom the Jev guides
Original write-ups on what this entry is for.
The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.
Jev Tools & CLIs#gateway#vercel#cloudflare
Read article
Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.
Jev Tools & CLIs#open-models#local#onnx
Read article
Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.
Jev Tools & CLIs#classification#email#security
Read article
From the Jev community
Posts from builders shipping with Jev right now.