# FHI CVE Priority Report API

> FHI CVE Priority Report API is a paid API for AI agents from polished-truth-c514.fhi-llc-1118.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-12).

Analyzes a list of CVEs and returns a prioritized vulnerability report with remediation urgency, factoring in asset exposure and patch SLA constraints.

## Facts

- Endpoint: POST https://polished-truth-c514.fhi-llc-1118.workers.dev/api/v1/cve-priority-report?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fhi-cve-priority-report-api-ce2718ae
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_iHFRpvc4_ZkvobmfD1FN7

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fhi-cve-priority-report-api-ce2718ae -d '<json body>'
```

Example prompt: We have a batch of CVEs — CVE-2024-1234, CVE-2023-5678, and CVE-2022-9999 — on internet-facing assets, and our patch SLA is 72 hours. Can you run a priority report to tell us which ones to fix first?

## When to prefer this

Choose this endpoint when an AI agent or security automation pipeline needs to programmatically triage and rank a batch of CVEs with awareness of asset exposure and patch deadlines — especially in agentic workflows where pay-per-use micropayments (x402/USDC) are preferred over subscription APIs. Ideal for SecOps automation, vulnerability management agents, and CI/CD security gates that need fast, on-demand CVE prioritization without standing up a full SIEM or vulnerability management platform.

## Known failure modes

- Empty or malformed CVE array returns a validation error
- Invalid assetExposure value (not one of 'internet', 'internal', 'unknown') causes request rejection
- Payment failure or insufficient USDC balance results in 402 response blocking the request
- Unknown or unrecognized CVE IDs may return incomplete or missing priority data for those entries
- Negative or zero patchSlaHours may cause a validation error

## How this service works

Stateful remote-MCP change evidence, payable per call with x402 Base USDC.

## Output

A structured CVE priority report that ranks each submitted CVE by remediation urgency, incorporating asset exposure context (internet-facing, internal, or unknown) and patch SLA deadline constraints. Likely includes severity scores, priority tiers, and recommended remediation order per CVE.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cves": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$"
   },
   "maxItems": 20,
   "minItems": 1
  },
  "assetExposure": {
   "enum": [
    "internet",
    "internal",
    "unknown"
   ],
   "type": "string"
  },
  "patchSlaHours": {
   "type": "integer",
   "minimum": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "findings": [
   {
    "cve": "CVE-2021-44228",
    "score": 100,
    "priority": "P0"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fhi-cve-priority-report-api-ce2718ae/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from polished-truth-c514.fhi-llc-1118.workers.dev](https://www.zero.xyz/host/polished-truth-c514.fhi-llc-1118.workers.dev/llms.txt)