secid

Resolve security identifiers to URLs using the SecID API.

SecID is a universal grammar for security knowledge — CVEs, CWEs, ATT&CK techniques, NIST controls, and more — maintained by the Cloud Security Alliance.

Zero dependencies. Python 3.9+ stdlib only.

Install

pip install csa-secid

CLI

# Resolve a CVE to its URL
secid "secid:advisory/mitre.org/cve#CVE-2021-44228"

# JSON output
secid --json "secid:advisory/mitre.org/cve#CVE-2021-44228"

# Cross-source search (find CVE across all advisory sources)
secid "secid:advisory/CVE-2021-44228"

Library

from secid_client import SecIDClient

client = SecIDClient()

# Get the best URL for a security identifier
url = client.best_url("secid:advisory/mitre.org/cve#CVE-2021-44228")
print(url)  # https://www.cve.org/CVERecord?id=CVE-2021-44228

# Full response with status, results, and guidance
response = client.resolve("secid:advisory/mitre.org/cve#CVE-2021-44228")
print(response.status)           # "found"
print(response.best_url)         # highest-weight URL
print(response.was_corrected)    # True if input was auto-corrected
print(response.resolution_results)  # all URL results, sorted by weight
print(response.registry_results)    # browsing/discovery data

# Cross-source search
response = client.lookup("advisory", "CVE-2021-44228")

# Capability lookup (product security features)
response = client.resolve("secid:capability/amazon.com/aws/s3#default-encryption")

# Disclosure lookup (who to report vulnerabilities to)
response = client.resolve("secid:disclosure/redhat.com/cna")

# Look up a scoring methodology
response = client.resolve("secid:methodology/first.org/cvss@4.0")

SecID Format

secid:type/namespace/name[@version]#subpath

API

One endpoint: GET /api/v1/resolve?secid={encoded_secid}

The # character must be encoded as %23 — the client handles this automatically.

Resolution results may include optional format metadata fields: content_type, parsability, schema, parsing_instructions, and auth. These describe the data format at the resolved URL and are present only when the registry has documented them.

Links

• SecID Registry & Spec
• SecID API + MCP Server
• Cloud Security Alliance

License

Apache 2.0