# OneShot Agent API – CVE Vulnerability Lookup

> OneShot Agent API – CVE Vulnerability Lookup is a paid API for AI agents from win.oneshotagent.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-28).

Look up detailed CVE vulnerability records from the NVD, including severity scores, CVSS vectors, weaknesses, references, and known-exploited status.

## Facts

- Endpoint: POST https://win.oneshotagent.com/v1/tools/lookup/record-vulnerability?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/oneshot-agent-api-cve-vulnerability-lookup-f3404654
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qNC_meYq8EXqFgOaRfSjl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability oneshot-agent-api-cve-vulnerability-lookup-f3404654 -d '<json body>'
```

Example prompt: Can you pull up the full NVD vulnerability record for CVE-2021-44228, including its CVSS severity score, weaknesses, and whether it's listed as a known-exploited vulnerability?

## When to prefer this

Choose this endpoint when you need structured, authoritative CVE data from NVD including CVSS scores, CWE mappings, and CISA known-exploited status, without managing an NVD API key. It's ideal for AI agents doing vulnerability triage, security enrichment pipelines, or advisory generation that require a pay-per-call model with USDC on Base via x402. Prefer this over direct NVD API calls when you need zero-setup, per-query billing without rate-limit management.

## Known failure modes

- Unknown or malformed CVE ID returns empty vulnerabilities array with total 0
- CVE ID with typos or invalid format may return no results
- Very recently published CVEs may not yet be indexed in NVD and return empty
- Payment failure (x402) results in 402 response before lookup is attempted
- Network timeouts or NVD upstream unavailability may cause errors

## How this service works

Look up the published record of a software vulnerability by its CVE identifier.

## Output

Returns a JSON object with total count and an array of vulnerability records. Each record includes the CVE ID, NVD URL, analysis status, CVSS severity score and rating, CVSS vector and version, list of CWE weaknesses, description, publication and last-modified timestamps, reference URLs with tags, total reference count, and if applicable a known-exploited block with the vuln name, date added to CISA KEV, action due date, and required remediation action.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cve_id": {
   "type": "string",
   "description": "The CVE identifier, for example CVE-2021-44228. Lower case is accepted. A CVE identifier is CVE-, a four-digit year, a dash and four or more digits."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "total": 1,
  "vulnerabilities": [
   {
    "id": "CVE-2021-44228",
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
    "status": "Analyzed",
    "severity": {
     "score": 10,
     "rating": "CRITICAL",
     "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
     "version": "3.1"
    },
    "references": [
     {
      "url": "https://example.com/advisory",
      "tags": [
       "Vendor Advisory"
      ]
     }
    ],
    "weaknesses": [
     "CWE-20",
     "CWE-400",
     "CWE-502",
     "CWE-917"
    ],
    "description": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.",
    "published_at": "2021-12-10T10:15:09.143Z",
    "known_exploited": {
     "name": "Apache Log4j2 Remote Code Execution Vulnerability",
     "added_on": "2021-12-10",
     "action_due": "2021-12-24",
     "required_action": "Apply updates, or remove affected assets from agency networks."
    },
    "last_modified_at": "2026-08-11T19:33:44.513Z",
    "references_total": 103
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/oneshot-agent-api-cve-vulnerability-lookup-f3404654/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from win.oneshotagent.com](https://www.zero.xyz/host/win.oneshotagent.com/llms.txt)