# RocketCore Intel — CISA KEV Enrichment

> RocketCore Intel — CISA KEV Enrichment is a paid API for AI agents from intel.rocket-core.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-13).

Returns enriched CISA Known Exploited Vulnerabilities (KEV) catalog records, filterable by CVE ID, vendor, product, ransomware association, and remediation due date, via pay-per-request on Base mainnet.

## Facts

- Endpoint: GET https://intel.rocket-core.com/v1/cyber/cisa-kev-enrichment?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/rocketcore-intel-cisa-kev-enrichment-aad65326
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_FdSU5RXgAE6FXvbaefxec

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability rocketcore-intel-cisa-kev-enrichment-aad65326
```

Example prompt: Is CVE-2021-44228 in the CISA Known Exploited Vulnerabilities catalog? If so, give me the remediation due date and tell me whether it's linked to any ransomware campaigns.

## When to prefer this

Choose this endpoint when you need authoritative, CISA-sourced exploitation status for specific CVEs or vendor/product combinations, especially when ransomware linkage or regulatory patch deadlines matter. Prefer it over generic vulnerability databases when CISA KEV membership is the compliance criterion (e.g. BOD 22-01). It is cost-effective at $0.005/call for per-CVE or filtered batch lookups and is optimized for autonomous agent workflows via x402 pay-per-request on Base mainnet.

## Known failure modes

- Malformed CVE ID (e.g. wrong format) — request rejected with validation error
- Valid but unknown CVE ID — returns 0 results with no error
- Vendor or product filter with no matches — returns empty results array
- Payment failure on Base mainnet — 402 response requiring USDC payment
- Catalog temporarily unavailable — upstream freshness degraded or service error
- Exceeding max limit of 200 — schema validation rejection

## How this service works

x402 pay-per-request AI-commerce API on Base mainnet (USDC). Serves sanitized, aggregated intelligence products. Discovery via /catalog and /.well-known/x402.

## Output

A JSON object containing the matched KEV records (CVE ID, vendor, product, date added, CISA due date, CWE list, ransomware linkage, source URL), plus query echo, result count, catalog version, retrieval timestamp, source attribution to cisa.gov, and any applicable limitations.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "cve": {
       "type": "string",
       "description": "A CVE id (e.g. 'CVE-2021-44228') or a comma-separated list. Malformed ids are rejected; an unknown-but-valid id returns 0 results."
      },
      "ref": {
       "enum": [
        "x402scan",
        "agentic-market",
        "pay-sh",
        "ampersend",
        "x402-list",
        "signal402",
        "x402-slack",
        "x402-discord",
        "gitlab",
        "mcp",
        "x",
        "linkedin",
        "hackernews",
        "dev",
        "reddit",
        "poncho",
        "agentcash",
        "base-discord"
       ],
       "type": "string",
       "description": "Optional allowlisted referral source (attribution only)."
      },
      "limit": {
       "type": "integer",
       "default": 50,
       "maximum": 200,
       "minimum": 1,
       "description": "Max records to return."
      },
      "vendor": {
       "type": "string",
       "description": "Case-insensitive vendor/project substring filter."
      },
      "product": {
       "type": "string",
       "description": "Case-insensitive product substring filter."
      },
      "due_before": {
       "type": "string",
       "description": "Keep records whose CISA due date is before this YYYY-MM-DD."
      },
      "ransomware_only": {
       "type": "boolean",
       "default": false,
       "description": "Only records CISA links to known ransomware campaigns."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "product",
      "query",
      "result_count",
      "results",
      "catalog_version",
      "retrieved_at",
      "source_url",
      "limitations"
     ],
     "properties": {
      "query": {
       "type": "object"
   
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "source": "CISA KEV catalog (cisa.gov) — US-Government public domain",
  "product": "cisa-kev-enrichment",
  "freshness": "see response"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/rocketcore-intel-cisa-kev-enrichment-aad65326/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rocket-core.com](https://www.zero.xyz/host/intel.rocket-core.com/llms.txt)