openai · RipperMercs · May 9, 2026 · May 9, 2026 · May 9, 2026 · May 17, 2026
diff --git a/authors.yaml b/authors.yaml
@@ -591,4 +591,8 @@ sophiaqin-openai:
 PASFIELD-OAI:
   name: "Wesley Pasfield"
   website: "https://github.com/PASFIELD-OAI"
-  avatar: "https://avatars.githubusercontent.com/u/276116382?v=4"  
+  avatar: "https://avatars.githubusercontent.com/u/276116382?v=4"
+ripper:
+  name: Ripper
+  website: https://tensorfeed.ai
+
diff --git a/examples/mcp/tensorfeed_cve_verification.ipynb b/examples/mcp/tensorfeed_cve_verification.ipynb
@@ -0,0 +1,192 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "# Cross-Database CVE Verification with TensorFeed (Hosted MCP)\n",
+    "\n",
+    "**The actual production failure mode for security agents is not hallucination. It's acting on a single source.**\n",
+    "\n",
+    "When a finance agent reads a fabricated headline and trades on it, the model didn't hallucinate; it read the source faithfully and the source was wrong. The same shape applies to security: a triage agent that judges a CVE off one database can be wrong without ever fabricating anything. The fix is corroboration across independent sources.\n",
+    "\n",
+    "This notebook builds a small agent that uses [TensorFeed.ai](https://tensorfeed.ai)'s hosted MCP server with the **OpenAI Responses API's native MCP tool integration** to compose three independent vulnerability databases (MITRE CVE List, CISA Known Exploited Vulnerabilities, FIRST.org EPSS) for any CVE, in a single Responses call.\n",
+    "\n",
+    "**Why TensorFeed?** TF is a free hosted MCP server (`https://tensorfeed.ai/api/mcp`) that exposes 17 tools spanning AI news, model pricing, AI service status, security advisories, SEC EDGAR filings, FDA regulatory data, and US energy indicators. No auth required for the tools used here. License: most underlying data is US Government public domain or CC0; commercial redistribution permitted; attribution preserved on every response. TF is also published as a hosted server in the official Model Context Protocol Registry as `ai.tensorfeed/mcp-server`.\n",
+    "\n",
+    "**Why OpenAI's Responses API for this?** The Responses API supports MCP tools natively (`tools[].type = \"mcp\"`). The model autonomously fans out tool calls, parses results, and composes a final answer in one Responses call. No manual loop required.\n",
+    "\n",
+    "**What you'll see by the end:**\n",
+    "- A single Responses call that verifies one CVE across three security databases via the TF MCP server\n",
+    "- The `confirmed_by` corroboration pattern surfaced from the model's natural reasoning\n",
+    "- A second example doing parallel triage of three CVEs ranked by composite risk\n"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## Prerequisites\n",
+    "\n",
+    "- Python 3.11+\n",
+    "- An OpenAI API key in the `OPENAI_API_KEY` environment variable\n",
+    "- The `openai` package (>= the version that supports Responses API MCP tools)\n",
+    "\n",
+    "```bash\n",
+    "pip install --upgrade openai\n",
+    "```\n",
+    "\n",
+    "No TensorFeed account or API key needed. The three tools used in this notebook are part of TensorFeed's free tier.\n"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "import os\n",
+    "from openai import OpenAI\n",
+    "\n",
+    "api_key = os.environ.get(\"OPENAI_API_KEY\")\n",
+    "if not api_key:\n",
+    "    raise RuntimeError(\"Set OPENAI_API_KEY in your environment first.\")\n",
+    "\n",
+    "client = OpenAI(api_key=api_key)\n",
+    "MODEL = \"gpt-5.1\"  # any current chat-completions/responses-capable model\n"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## Connect the TensorFeed MCP server as a tool\n",
+    "\n",
+    "The Responses API takes the MCP server URL directly. The model decides which tools to call based on the user input + the descriptions the MCP server returns from `tools/list`. We constrain the allowed tools to the three security ones for this demo (the TF server exposes 17 in total; restricting keeps the agent focused on the verification task).\n"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "TF_MCP_TOOL = {\n",
+    "    \"type\": \"mcp\",\n",
+    "    \"server_label\": \"tensorfeed\",\n",
+    "    \"server_url\": \"https://tensorfeed.ai/api/mcp\",\n",
+    "    # Restrict to the three security tools for this demo.\n",
+    "    # Omit allowed_tools to expose all 17 TF tools to the model.\n",
+    "    \"allowed_tools\": [\n",
+    "        \"get_cve_record\",\n",
+    "        \"get_kev_catalog\",\n",
+    "        \"get_epss_score\",\n",
+    "    ],\n",
+    "    \"require_approval\": \"never\",\n",
+    "}\n"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## Demo 1: Verify a single CVE\n",
+    "\n",
+    "CVE-2024-3094 (the XZ backdoor, March 2024) is a useful test case: it has a complete MITRE record and EPSS data; KEV presence varies by snapshot. The model should consult all three sources and report whichever subset has data.\n"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "response = client.responses.create(\n",
+    "    model=MODEL,\n",
+    "    tools=[TF_MCP_TOOL],\n",
+    "    input=(\n",
+    "        \"Verify CVE-2024-3094 across multiple databases. Call MITRE for the canonical record, \"\n",
+    "        \"check the CISA KEV catalog for active exploitation, and pull the FIRST.org EPSS score. \"\n",
+    "        \"Then summarize: severity_band, exploited_in_wild boolean (true if KEV has the CVE), \"\n",
+    "        \"epss_probability, a confirmed_by list of the databases that returned data, and a \"\n",
+    "        \"one-sentence triage recommendation.\"\n",
+    "    ),\n",
+    ")\n",
+    "\n",
+    "print(response.output_text)\n"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## Demo 2: Triage three CVEs by composite risk\n",
+    "\n",
+    "A more realistic agent task: given a list of CVEs that landed in your security feed today, decide which to patch first. The model fans out across all three sources for each CVE and returns a ranked list with reasoning.\n"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "triage = client.responses.create(\n",
+    "    model=MODEL,\n",
+    "    tools=[TF_MCP_TOOL],\n",
+    "    input=\"\"\"I have three CVEs to triage. For each, look up MITRE/KEV/EPSS via tensorfeed\n",
+    "and rank them by patch priority. Brief reasoning per CVE plus an ordered list at the end.\n",
+    "\n",
+    "CVEs to triage:\n",
+    "- CVE-2024-3094\n",
+    "- CVE-2023-44487\n",
+    "- CVE-2024-21626\"\"\",\n",
+    ")\n",
+    "\n",
+    "print(triage.output_text)\n"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## What just happened\n",
+    "\n",
+    "The Responses API took our MCP server URL plus a natural-language instruction and:\n",
+    "\n",
+    "1. Recognized \"verify\" implies cross-source corroboration\n",
+    "2. Sequenced the calls (MITRE first to confirm existence, KEV for exploitation, EPSS for likelihood)\n",
+    "3. Surfaced the `confirmed_by` list so the user can audit which databases backed the answer\n",
+    "\n",
+    "For the triage task, the model fanned out across three CVEs (~9 tool calls total) and produced a ranked list. No hallucinated CVE ids, no made-up severity scores; everything is sourced. The whole thing is a single `responses.create` call from the developer's perspective.\n",
+    "\n",
+    "## Going further: TensorFeed's premium one-call composition\n",
+    "\n",
+    "TensorFeed also exposes a single premium endpoint that does this composition server-side: `/api/premium/security/verified/{cve_id}`. It joins MITRE + KEV + EPSS + OSV.dev + CISA Vulnrichment into one fact card with `confirmed_by` and `corroboration_count` fields, returning ~6,000 saved tokens per call vs the multi-tool approach. The premium endpoint requires a bearer token purchased via x402 V2 on Base mainnet ($0.02/credit) at https://tensorfeed.ai/developers/agent-payments.\n",
+    "\n",
+    "For most agent workloads the free three-tool composition shown above is fine; reach for the premium endpoint when verifying CVEs at scale (large vuln scan output, continuous monitoring, RAG indexing).\n",
+    "\n",
+    "## Resources\n",
+    "\n",
+    "- TensorFeed.ai: https://tensorfeed.ai\n",
+    "- Endpoint catalog: https://tensorfeed.ai/api/meta\n",
+    "- Agent-friendly entry doc: https://tensorfeed.ai/llms.txt\n",
+    "- TF in the official MCP Registry: https://registry.modelcontextprotocol.io/ (`ai.tensorfeed/mcp-server`)\n",
+    "- Source code (public): https://github.com/RipperMercs/tensorfeed\n"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "name": "python",
+   "version": "3.11"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 4
+}
diff --git a/registry.yaml b/registry.yaml
@@ -3232,3 +3232,15 @@
     - agents
     - memory
     - compaction
+- title: Cross-Database CVE Verification with TensorFeed (Hosted MCP)
+  path: examples/mcp/tensorfeed_cve_verification.ipynb
+  slug: tensorfeed-cve-verification
+  description: Compose three independent vulnerability databases (MITRE / CISA KEV / FIRST.org EPSS) via TensorFeed.ai's hosted MCP server using the Responses API's native MCP tool. Anti-hallucination corroboration pattern for security agents in a single Responses call.
+  date: 2026-05-09
+  authors:
+    - ripper
+  tags:
+    - mcp
+    - agents
+    - security
+