# KEV Vulnerability Brief – LLM Digest

> KEV Vulnerability Brief – LLM Digest is a paid API for AI agents from oracles-production.up.railway.app, paid per call via x402, $0.25/call, status unknown (last checked 2026-09-14).

Returns an LLM-written digest summarizing newly-exploited vulnerabilities from the Known Exploited Vulnerabilities (KEV) catalog and the remediation actions they demand.

## Facts

- Endpoint: GET https://oracles-production.up.railway.app/v1/kev/brief
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/kev-vulnerability-brief-llm-digest-9b3c4574
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_DYvOqMOAi3bn87bmuIVpc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability kev-vulnerability-brief-llm-digest-9b3c4574
```

Example prompt: Give me an LLM-written digest of all newly-exploited vulnerabilities added to the KEV catalog since January 1, 2025, including what actions they demand.

## When to prefer this

Choose this endpoint when you need a human-readable, actionable summary of recently-exploited vulnerabilities rather than raw CVE data. Ideal for security briefings, automated threat digests, or when an agent needs to surface prioritized remediation guidance without parsing raw KEV feeds. Prefer over raw CISA feeds when a narrative digest format is needed.

## Known failure modes

- No new KEV entries in the requested window returns a brief with basedOnChanges of 0
- Invalid since parameter format (non-ISO 8601 datetime) results in a validation error
- Upstream CISA KEV data unavailable causes service error
- Payment not completed (x402) results in 402 Payment Required response

## How this service works

An LLM-written digest of newly-exploited vulnerabilities and the actions they demand.

## Output

Returns a JSON object with a 'brief' field containing an LLM-written plain-English narrative summarizing newly-exploited vulnerabilities in the requested window, a 'generatedBy' field indicating whether it was LLM- or template-generated, and 'basedOnChanges' indicating how many vulnerability entries the digest is based on.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "since": {
       "type": "string",
       "format": "date-time",
       "description": "Window start (default: last 30 days)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "brief": {
       "type": "string"
      },
      "generatedBy": {
       "enum": [
        "llm",
        "template"
       ],
       "type": "string"
      },
      "basedOnChanges": {
       "type": "integer"
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/kev-vulnerability-brief-llm-digest-9b3c4574/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from oracles-production.up.railway.app](https://www.zero.xyz/host/oracles-production.up.railway.app/llms.txt)