CVSS 3.1 Calculator
Compute a CVSS 3.1 base score from its vector string using the exact FIRST specification (weights, scope handling, and the rounding function). Pairs with cve-lookup: paste any vector and get the score, severity band, and metric breakdown.
Worked examples
RCE-class (8.8)
GET /api/v1/security/cvss-calc?vector=CVSS%3A3.1%2FAV%3AN%2FAC%3AL%2FPR%3AL%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH
Result: 8.8 High (N/L/L/N/U)
Log4Shell (10.0)
GET /api/v1/security/cvss-calc?vector=CVSS%3A3.1%2FAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AC%2FC%3AH%2FI%3AH%2FA%3AH
Result: 10.0 Critical (N/L/N/N/C)
Low-severity local
GET /api/v1/security/cvss-calc?vector=CVSS%3A3.1%2FAV%3AL%2FAC%3AH%2FPR%3AH%2FUI%3AR%2FS%3AU%2FC%3AL%2FI%3AN%2FA%3AN
Result: 1.8 Low (L/H/H/R/U)
Machine API (x402)
$0.002 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/cvss-calc?vector=CVSS%3A3.1%2FAV%3AN%2FAC%3AL%2FPR%3AL%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/cvss-calc",
"input": {"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},
"result": { "value": 8.8, "answer": "8.8 High (N/L/L/N/U)" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Spec-exact CVSS 3.1 base scoring: FIRST's weights, the scope-changed formula path, and the official rounding function (so 8.849999 never becomes 8.9 by accident). Feed it any vector string from an advisory and get the authoritative score plus the metric-by-metric breakdown.
Frequently asked questions
Which CVSS version?
3.1 base metrics only (the current standard for advisories). Temporal and environmental metrics are not part of the base vector.
Why does my score differ by 0.1 from a website?
Almost certainly floating-point rounding. CVSS mandates a specific decimal-roundup; this implementation follows it bit-for-bit, which is exactly the determinism an agent needs.