first-epss
backlog row · status deferred · domain SEC (Security and vulnerabilities) · lane B · refresh daily · tags GLOBAL · ADVISORIES · VULNERABILITIES · SECURITY
What an agent uses it for
an agent prioritising remediation queries this for a CVE's EPSS score and percentile to rank patch order
curl -fsSLO https://raw.githubusercontent.com/xerj-org/xerj/corpus-hub/tools/xerj-code/hub/first-epss.jsonxerj corpus add --from ./first-epss.jsonxerj corpus index first-epss then xerj code first-epss "your question"Needs the xerj CLI and a local node running; the copy prompt covers both, checks each step, and shows how to stop only the node you started. No shell: the MCP tool xerj_code_search with corpus: "first-epss", once the corpus is indexed on the node.
Sources and pins
| source | pin | licence | size | review note |
|---|---|---|---|---|
| https://www.first.org/epss/data-stats | recipe | ? | curated pack | DEFERRED 2026-10-04 on TWO measured/verified blockers, not vibes: (1) LICENCE NOT VERIFIED: FIRST publishes scores "free of charge" with attribution requested, but no licence statement could be found on first.org/epss pages, the site footer asserts copyright, and the official archive repo (empiricalsec/epss_scores) has license:null; do not ship an unverified licence. (2) THROUGHPUT: 382,621 files |
0 B across 0 files. Added n/a.
People behind this corpus
Curated by
The hub maintainers maintain this registry entry; its sources are not GitHub repositories with an owner to credit, so the original publishers are the ones listed under Sources and pins.
Rights
?. See per-source review blocks. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.
Sign in with GitHub or Hugging Face to see more: this corpus's pack build and pin history, full source pins and review records, and how its packs are signed.
Retrieval spot-check (G7)
Not yet spot-checked. Queries are pre-registered in the registry before grading.
Agent score
From structured reviews that AI agents send after they use this corpus: through
xerj hub pull, MCP queries, or the xerj_corpus_feedback tool. Each review
rates usefulness 1–5, whether the answer was found, and freshness. This is
not the human hub star count shown above. The two are never mixed.
Loading agent reviews…
Score = Bayesian mean of usefulness (prior 3.0 with weight 5), so a few reviews cannot swing it. One voice per installation per corpus per week; abnormal-volume reviewers are dropped. Coverage gaps appear only once 3 or more agents report the same one. How it works.
Traffic
Traffic stats load from /api/hub-traffic when this page runs JavaScript.
last 14 days, UTCtotalunique
Views
Pulls
Searches
Agents
| user-agent family | requests |
|---|
Referring sites
| site | views |
|---|
Views: visits to this page (search-engine crawlers excluded). Unique: distinct visitors per
day, by a hash salted with the day, so the 14-day unique figure adds up daily uniques. Pulls: growth of the
GitHub release download count of this corpus’s pack (xerj hub pull downloads from
there; includes our own pack-verification downloads). Searches: hosted-hub queries for this corpus.
Referring sites appear after 3 views. What is collected.
Agent usage
Usage stats load from /api/hub-usage when this page runs JavaScript.
by user-agent family:
Top topics
Top query templates
| template | requests |
|---|
Counted: requests agents send to the hosted hub API (hub.xerj.org/api/v1/code, /def) for this corpus. Queries on your own node (xerj code, xerj ask with a local pack, the MCP tools) never leave your machine and are not counted. Templates replace identifiers, versions, paths, numbers and quoted text with placeholders; one is shown only once it has been seen 3 times in 30 days, and any word asked fewer than 3 times shows as <term>. Raw queries are never published. What is collected.