# OSF Security — CVE Exploit Check

> OSF Security — CVE Exploit Check is a paid API for AI agents from api.osf-master-server.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-13).

Looks up a CVE identifier and returns its CISA KEV exploitation status, EPSS probability score, and NVD CVSS severity with provenance-stamped audit receipt

## Facts

- Endpoint: GET https://api.osf-master-server.com/x402/security/cve/%7Bcve_id%7D?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/osf-security-cve-exploit-check-0adf5561
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_lZhhSeM0WhvPmRUXntm-a

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability osf-security-cve-exploit-check-0adf5561
```

Example prompt: Is CVE-2021-44228 (Log4Shell) actively exploited in the wild? I need its CISA KEV status, EPSS probability score, and NVD CVSS severity in JSON format.

## When to prefer this

Choose this endpoint when you need a single, authoritative, provenance-stamped record combining CISA KEV, EPSS, and NVD data for a specific CVE — especially in agentic pipelines that require an audit trail (audit_receipt with SHA-256) for compliance or security decision workflows. Prefer this over scraping cisa.gov or nvd.nist.gov directly when you need structured JSON with micropayment-gated freshness guarantees and tamper-evident receipts.

## Known failure modes

- CVE ID not found in NVD — returns result: NOT_FOUND with empty nvd/epss fields
- Malformed or non-existent CVE format — returns result: INVALID_INPUT
- Payment failure via x402 — 402 Payment Required returned before data is served
- Upstream NVD or CISA source temporarily unavailable — may return stale or partial data
- Rate limiting or network timeout on the OSF server — returns 5xx error

## How this service works

OSF is a live marketplace of provenance stamped public domain government and scientific data, built for autonomous agents that pay per record over x402 micropayments on Base. A paid MCP server in the official MCP Registry, discoverable on the Coinbase CDP Bazaar.

## Output

Returns a JSON object containing: result status (FOUND/NOT_FOUND/INVALID_INPUT), actively_exploited boolean (true if on CISA KEV), exploitation_summary string, EPSS probability and exploitation band, NVD CVSS severity rating, provenance URLs back to cisa.gov/nvd.nist.gov/first.org, a coverage_note explaining scope, a compliance_note, and a tamper-evident audit_receipt with a UUID and SHA-256 result hash.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "format"
     ],
     "properties": {
      "format": {
       "type": "string",
       "description": "Response format (json)."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "service",
      "query",
      "result",
      "actively_exploited",
      "compliance_note",
      "audit_receipt"
     ],
     "properties": {
      "nvd": {
       "type": "object"
      },
      "epss": {
       "type": "object"
      },
      "query": {
       "type": "string"
      },
      "result": {
       "type": "string",
       "description": "FOUND, NOT_FOUND, or INVALID_INPUT"
      },
      "service": {
       "type": "string"
      },
      "audit_receipt": {
       "type": "object"
      },
      "coverage_note": {
       "type": "string"
      },
      "compliance_note": {
       "type": "string"
      },
      "provenance_urls": {
       "type": "object"
      },
      "actively_exploited": {
       "type": "boolean",
       "description": "True if on the CISA KEV catalog."
      },
      "exploitation_summary": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "nvd": {
   "cvss_severity": "CRITICAL"
  },
  "epss": {
   "epss_probability": 0.984,
   "exploitation_band": "Critical"
  },
  "query": "CVE-2026-33017",
  "result": "FOUND",
  "service": "OSF Security - CVE Exploit Check",
  "audit_receipt": {
   "check_id": "uuid",
   "result_sha256": "..."
  },
  "coverage_note": "Direct lookup against the US CISA Known Exploited Vulnerabilities (KEV) catalog, the FIRST EPSS model score, and the NVD CVE record. 'actively_exploited' reflects presence on the CISA KEV catalog ONLY. A CVE that is NOT on KEV is not necessarily safe or unexploitable - it simply is not on CISA's confirmed-exploited list. EPSS is a probability estimate, not proof.",
  "compliance_note": "This is a decision-support signal, not a guarantee. Confirm against the linked authoritative sources (cisa.gov, nvd.nist.gov, first.org) before acting.",
  "provenance_urls": {
   "cisa_kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  "actively_exploited": true,
  "exploitation_summary": "ON the CISA KEV catalog - confirmed exploited in the wild."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/osf-security-cve-exploit-check-0adf5561/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.osf-master-server.com](https://www.zero.xyz/host/api.osf-master-server.com/llms.txt)