# ioswarm Security Feed

> ioswarm Security Feed is a paid API for AI agents from ioswarm.io, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11).

Returns a curated security intelligence feed combining CISA Known Exploited Vulnerabilities (last 14 days), newly published CVEs (last 24 hours), and security advisories — filterable by keyword, date, and section.

## Facts

- Endpoint: POST https://ioswarm.io/api/v1/feeds/security?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ioswarm-security-feed-d762e06f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XlgOSM_tegCBw9-SNaQdw

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ioswarm-security-feed-d762e06f -d '<json body>'
```

Example prompt: Pull today's security feed — give me up to 50 items from the CISA known exploited vulnerabilities section and flag anything related to ransomware.

## When to prefer this

Choose this endpoint when you need a single call to aggregate multiple security intelligence streams (CISA KEV, CVEs, advisories) in one response, especially for daily security briefings, compliance monitoring, or ransomware threat tracking. Prefer this over raw NVD or CISA APIs when you want pre-filtered, human-readable data with ransomware tagging and due dates included, and when you want to pay per call rather than manage API keys.

## Known failure modes

- Invalid date format returns a 400 error — must use RFC 3339 or YYYY-MM-DD
- Limit exceeds 200 returns a validation error
- Invalid section enum value returns a 400 error
- Payment failure via x402 protocol returns a 402 response
- Stale data if feed sources (CISA, NVD) are delayed upstream
- Empty result set if the text filter 'q' matches no entries in the selected date range

## How this service works

New vulnerabilities in one place: CISA Known Exploited Vulnerabilities from the last 14 days (due dates, ransomware use), CVEs published in the last 24 hours (CVSS, severity, CWE, vendor/product), and reviewed GitHub advisories (ecosystem, package, vulnerable and patched versions). Rebuilt every hour. $0.01 per call, no account. Free 24h-delayed sample: GET https://ioswarm.io/api/v1/feeds/security/sample.

## Output

Returns a structured feed divided into sections (kev, cves, advisories). Each KEV entry includes the vulnerability name, CVE ID, due date, and ransomware usage flag. CVE entries include CVE ID, description, CVSS score, and publication date. Advisory entries include source, title, affected products, and severity. Results are filterable by keyword, date, and section.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "q": {
   "type": "string",
   "maxLength": 80,
   "description": "Text filter."
  },
  "at": {
   "type": "string",
   "description": "Past edition: RFC 3339 or YYYY-MM-DD."
  },
  "date": {
   "type": "string",
   "description": "YYYY-MM-DD (UTC)."
  },
  "limit": {
   "type": "integer",
   "maximum": 200,
   "minimum": 1,
   "description": "Items per section."
  },
  "ticker": {
   "type": "string",
   "description": "Ticker/symbol filter."
  },
  "section": {
   "enum": [
    "kev",
    "cves",
    "advisories"
   ],
   "type": "string",
   "description": "One section (default: all)."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ioswarm-security-feed-d762e06f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ioswarm.io](https://www.zero.xyz/host/ioswarm.io/llms.txt)