# Datakoot EPSS Score Lookup

> Datakoot EPSS Score Lookup is a paid API for AI agents from x402.datakoot.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Returns FIRST.org EPSS exploit-probability scores and percentile rankings for one or more CVE identifiers

## Facts

- Endpoint: POST https://x402.datakoot.com/api/epss_score?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/datakoot-epss-score-lookup-0583233a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Qa98XEXllrVKjUecLqNSS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability datakoot-epss-score-lookup-0583233a -d '<json body>'
```

Example prompt: What are the EPSS exploit-probability scores and percentile rankings for CVE-2021-44228 and CVE-2024-3094? I want to know how likely each is to be exploited in the next 30 days.

## When to prefer this

Choose this endpoint when you need FIRST.org EPSS exploit-probability data specifically — particularly for prioritizing CVE remediation by real-world exploitation likelihood rather than CVSS severity alone. It supports batch lookups of multiple CVEs in a single call, making it ideal for pipeline enrichment of vulnerability scan results. Prefer it over CVSS-only lookups when you want a probabilistic, evidence-based risk signal about active exploitation.

## Known failure modes

- Invalid or malformed CVE ID format returns an error or empty scored array
- Unknown CVE IDs not yet in the EPSS dataset return no score entry
- Network or upstream FIRST.org data unavailability causes 5xx errors
- Providing neither cve_id nor cve_ids results in a validation error
- Very newly published CVEs may not yet have an EPSS score assigned

## How this service works

48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.

## Output

A JSON object containing the EPSS model version, scoring date, source attribution (FIRST.org), the number of CVEs scored, and an array of per-CVE results each with the CVE ID, an EPSS probability score (0–1 representing likelihood of exploitation within 30 days), and a percentile ranking among all EPSS-scored CVEs.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cve_id": {
   "type": "string",
   "description": "A single CVE id."
  },
  "cve_ids": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Multiple CVE ids (or pass a comma-separated string)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "note": "EPSS = probability (0–1) the CVE is exploited in the next 30 days; percentile ranks it among all scored CVEs.",
  "as_of": "2026-10-02",
  "model": "EPSS (FIRST.org)",
  "scored": 2,
  "scores": [
   {
    "epss": 0.85974,
    "cve_id": "CVE-2024-3094",
    "percentile": 0.99724
   },
   {
    "epss": 0.99999,
    "cve_id": "CVE-2021-44228",
    "percentile": 1
   }
  ],
  "source": "FIRST.org EPSS"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/datakoot-epss-score-lookup-0583233a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.datakoot.com](https://www.zero.xyz/host/x402.datakoot.com/llms.txt)