How Can an AI Agent Report a Vulnerability to a Vendor Through CVD Portal?
AI agents report vulnerabilities through CVD Portal using open Model Context Protocol tools and published agent skills. The agent discovers the vendor portal, verifies statutory scope, files the finding, and subscribes to status change webhooks.
Key takeaways
- Public MCP tools allow AI agents to discover manufacturer disclosure portals and file coordinated findings anonymously.
- The published cvd-portal-disclosure agent skill provides structured instructions and schema validation for automated workflows.
- Real-time status push subscriptions notify an agent callback URL when a vendor acknowledges or resolves a report.
- Authority transmission remains strictly human-gated; CVD Portal never forwards vulnerability reports to ENISA or CSIRTs automatically.
The Four-Step Agent Reporting Workflow
When a researcher instructs an assistant to "report this finding to the manufacturer", the agent executes this sequence autonomously.
The agent calls the public MCP tool find_vendor_portal or reads the vendor's RFC 9116 /.well-known/security.txt file. This resolves the verified portal slug, security contact, and policy URL.
The agent checks whether the vulnerability involves active exploitation or critical severity triggering CRA Article 14 thresholds using the Reportability Checker.
With user confirmation, the agent calls submit_vulnerability_to_vendor. The payload is encrypted at rest and returns a unique reference number and capability tracking token.
Instead of polling, the agent registers a callback URL via subscribe_to_report. CVD Portal delivers signed HTTP POST webhooks when the vendor acknowledges or resolves the issue.
Public MCP Tools Reference
Accessible over streamable HTTP at https://cvdportal.com/api/mcp/public without an API key.
| Tool | Input | Output | Purpose |
|---|---|---|---|
| find_vendor_portal | query (slug or domain) | portalUrl, securityTxtUrl, contact | Locates a manufacturer's disclosure portal and RFC 9116 security.txt contact. |
| submit_vulnerability_to_vendor | slug, description, severity, impact | referenceNumber, trackingToken | Files an encrypted vulnerability report to the vendor's intake portal. |
| track_vulnerability_report | trackingToken | status, vendor, dates | Polls current report status without leaking sensitive report contents. |
| subscribe_to_report | trackingToken, callbackUrl | subscriptionId, secret | Registers an HTTPS callback for signed, real-time status push notifications. |
Status Push Webhook Contract
Status callbacks deliver minimal, non-sensitive progress data. The payload intentionally omits vulnerability descriptions, reproduction steps, researcher email addresses, and internal triage notes.
POST /your-agent-callback
Content-Type: application/json
User-Agent: CVDPORTAL-Subscription/1.0
X-CVD-Timestamp: 1773400000000
X-CVD-Signature-256: t=1773400000000,v1=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
{
"event": "submission.status_changed",
"referenceNumber": "CVD-2026-0042",
"status": "ACKNOWLEDGED",
"vendor": "Acme Hardware B.V.",
"productName": "Edge Gateway 5000",
"vulnerabilityType": "RCE",
"filedAt": "2026-09-11T09:30:00.000Z",
"lastUpdatedAt": "2026-09-11T11:15:00.000Z"
}Published Agent Skill
CVD Portal publishes Agent Skills conforming to the Agent Skills Discovery RFC v0.2.0. Install the skill directly into Claude Code, Cursor, or OpenCode:
Are You a Security Researcher or Product Manufacturer?
Learn more about safe harbor disclosures or explore free CRA compliance tools designed for EU manufacturers.