# Kevscope CVE Priority Watchlist API

> Kevscope CVE Priority Watchlist API is a paid API for AI agents from kevscope-api.cybermax-tools.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-12).

Returns a prioritized list of CVEs to patch first, combining KEV, EPSS, CVSS, and SSVC signals in a single call

## Facts

- Endpoint: GET https://kevscope-api.cybermax-tools.workers.dev/x402/api/watchlist?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/kevscope-cve-priority-watchlist-api-58cde4ae
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Adhuz_GV3lpMaI97Q6HNX

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability kevscope-cve-priority-watchlist-api-58cde4ae
```

Example prompt: Show me the top 20 CVEs I should patch first from 2024, but only include ones with an EPSS score of at least 0.3 — I want KEV, EPSS, CVSS, and SSVC all in one view.

## When to prefer this

Choose this endpoint when you need a single, opinionated call that combines multiple vulnerability scoring frameworks (KEV, EPSS, CVSS, SSVC) into one ranked watchlist — ideal for security teams automating patch prioritization workflows without having to query and join NIST NVD, CISA KEV, and FIRST EPSS separately. Prefer over raw NVD or EPSS APIs when you want pre-prioritized, actionable output rather than raw data.

## Known failure modes

- Invalid year value returns an error or empty result set
- EPSS threshold out of 0-1 range may return an error
- Limit value outside 1-50 range may be rejected or clamped
- Payment not processed (x402 flow failure) returns 402 Payment Required
- Upstream data source (KEV/EPSS/CVSS) unavailable causes partial or failed response

## How this service works

Which CVEs to patch first, in one call. CVE priority API + MCP: KEV, EPSS, CVSS and SSVC, 20 CVEs per call Try it free in one click, no sign-up.

## Output

A JSON list of up to 50 CVEs ranked by patch priority, each enriched with KEV (Known Exploited Vulnerability) status, EPSS exploitation probability score, CVSS severity score, and SSVC (Stakeholder-Specific Vulnerability Categorization) decision — giving a composite view for remediation triage in a single API call.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "year": {
       "type": "string",
       "description": "CVE ID year (e.g. 2026), or all"
      },
      "limit": {
       "type": "integer",
       "default": 25,
       "description": "Rows to return (1-50)"
      },
      "minEpss": {
       "type": "number",
       "default": 0,
       "description": "Only EPSS at or above this probability (0-1)"
      }
     }
    }
   }
  },
  "output": {
   "type": "object",
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {}
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/kevscope-cve-priority-watchlist-api-58cde4ae/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from kevscope-api.cybermax-tools.workers.dev](https://www.zero.xyz/host/kevscope-api.cybermax-tools.workers.dev/llms.txt)