<!-- START doctoc generated TOC please keep comment here to allow auto update -->
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*

- [`tools/cve-org/`](#toolscve-org)
  - [Prerequisites](#prerequisites)
  - [Configuration](#configuration)

<!-- END doctoc generated TOC please keep comment here to allow auto update -->

<!-- SPDX-License-Identifier: Apache-2.0
     https://www.apache.org/licenses/LICENSE-2.0 -->

# `tools/cve-org/`

**Capability:** contract:cve-authority

**Kind:** implementation

**Vendor:** CVE.org

CVE.org publication client. Submits CVE records via the CVE.org REST API; consumed by `security-cve-allocate` once a CVE has been allocated via the ASF Vulnogram path. See [`tool.md`](tool.md) for the protocol detail and `cve.org` field mapping.

## Prerequisites

- **Runtime:** None of its own — this directory documents a read-only adapter; the publication-state check is a `curl` + `jq` one-liner (see `tool.md`).
- **CLIs:** `curl` and `jq`.
- **Credentials / auth:** None — cve.org is the public CVE registry and the CVE Services API has no auth.
- **Network:** `cveawg.mitre.org` (CVE Services API v2) and `www.cve.org` (the HTML record); optionally `nvd.nist.gov` for the alternative public registry.

## Configuration

Adopters select this backend with `<project-config>/project.md` →
`cve_authority.tool: cve-org-direct` when they operate directly against
CVE Services rather than an ASF Vulnogram tenant. The adopter-facing
field vocabulary is documented in
`projects/_template/cve-allocation-config.md` and
`projects/_template/security-intake-config.md`.
