# AgentPay Threat Intelligence – CVE Lookup

> AgentPay Threat Intelligence – CVE Lookup is a paid API for AI agents from agentpay.help, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Looks up CVE vulnerability details and threat intelligence by CVE ID or keyword, returning severity, KEV status, and description.

## Facts

- Endpoint: POST https://agentpay.help/v1/threat-intel
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentpay-threat-intelligence-cve-lookup-f5e4b4b7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TLcPJXDCXjAcqnDD1caBZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentpay-threat-intelligence-cve-lookup-f5e4b4b7 -d '<json body>'
```

Example prompt: Can you pull threat intel on CVE-2024-3094 — I need to know its severity, whether it's on the CISA Known Exploited Vulnerabilities list, and a brief description of what the flaw actually is?

## When to prefer this

Use this endpoint when you need quick, pay-per-call CVE threat intelligence without setting up an account or API key — ideal for agents that need on-demand vulnerability lookups, KEV status checks, or keyword-based CVE search as part of a security workflow. Prefer this over full NVD API integrations when you need lightweight, single-query threat intel with no authentication overhead.

## Known failure modes

- Unknown CVE ID returns empty or not-found response
- Keyword too generic returns no matches or ambiguous results
- Payment failure via x402 if wallet has insufficient USDC balance
- Newly published CVEs may not yet be indexed in the threat intel database
- Malformed CVE ID format may return validation error

## How this service works

Pay-per-call AI services via the 402 Payment Required protocol. No accounts, no API keys — just USDC on Base.

## Output

Returns a JSON object containing the CVE ID, severity level (e.g. critical, high, medium, low), a boolean indicating if the CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and a plain-language description of the vulnerability.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cve_id": {
   "type": "string",
   "description": "CVE identifier"
  },
  "keyword": {
   "type": "string",
   "description": "Keyword search instead of a CVE id, optional"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "cve_id": "CVE-2026-1234",
  "severity": "high",
  "kev_listed": false,
  "description": "Improper input validation in a widely used HTTP parser."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentpay-threat-intelligence-cve-lookup-f5e4b4b7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentpay.help](https://www.zero.xyz/host/agentpay.help/llms.txt)