# RocketCore Intel — CISA KEV Prioritization

> RocketCore Intel — CISA KEV Prioritization is a paid API for AI agents from intel.rocket-core.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-12).

Returns prioritized, AI-ready entries from the CISA Known Exploited Vulnerabilities catalog, filterable by CVE ID, vendor, product, due date, and ransomware linkage

## Facts

- Endpoint: GET https://intel.rocket-core.com/v1/cyber/cisa-kev-prioritization?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/rocketcore-intel-cisa-kev-prioritization-7cf43c9f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tTPbiLJJY0hjDeaJINJAT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability rocketcore-intel-cisa-kev-prioritization-7cf43c9f
```

Example prompt: Pull the CISA KEV prioritization data for all Apache products — show me up to 100 results, flag any tied to ransomware campaigns, and explain why each is urgent.

## When to prefer this

Choose this endpoint when you need structured, AI-ready CISA KEV data with urgency prioritization, ransomware linkage flags, and remediation summaries — especially useful for agents doing automated patch triage, compliance checks, or security briefings. Prefer this over raw CISA catalog scraping when you need sanitized, aggregated output with built-in prioritization logic and pay-per-use access without API key management.

## Known failure modes

- Malformed CVE ID format returns a rejection error
- Valid but unknown CVE ID returns 0 results with no error
- Filters that match no records return an empty results array
- Exceeding max limit of 200 returns a validation error
- Network or payment authorization failure returns HTTP 402
- Stale catalog data if CISA upstream has not been refreshed recently

## How this service works

x402 pay-per-request AI-commerce API on Base mainnet (USDC). Serves sanitized, aggregated intelligence products. Discovery via /catalog and /.well-known/x402.

## Output

A JSON object containing matched KEV entries with fields including CVE ID, vendor, product, urgency rating, ransomware linkage flag, CWEs, remediation action summary, prioritization explanation, vendor-product groupings, total result count, catalog version, retrieval timestamp, source URL, and data limitations. Also includes the query parameters echoed back for auditability.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "cve": {
       "type": "string",
       "description": "A CVE id (e.g. 'CVE-2021-44228') or a comma-separated list. Malformed ids are rejected; an unknown-but-valid id returns 0 results."
      },
      "ref": {
       "enum": [
        "x402scan",
        "agentic-market",
        "pay-sh",
        "ampersend",
        "x402-list",
        "signal402",
        "x402-slack",
        "x402-discord",
        "gitlab",
        "mcp",
        "x",
        "linkedin",
        "hackernews",
        "dev",
        "reddit",
        "poncho",
        "agentcash",
        "base-discord"
       ],
       "type": "string",
       "description": "Optional allowlisted referral source (attribution only)."
      },
      "limit": {
       "type": "integer",
       "default": 50,
       "maximum": 200,
       "minimum": 1,
       "description": "Max records to return."
      },
      "vendor": {
       "type": "string",
       "description": "Case-insensitive vendor/project substring filter."
      },
      "product": {
       "type": "string",
       "description": "Case-insensitive product substring filter."
      },
      "due_before": {
       "type": "string",
       "description": "Keep records whose CISA due date is before this YYYY-MM-DD."
      },
      "ransomware_only": {
       "type": "boolean",
       "default": false,
       "description": "Only records CISA links to known ransomware campaigns."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "product",
      "query",
      "result_count",
      "results",
      "vendor_product_groups",
      "remediation_action_summary",
      "prioritization_explanation",
      "catalog_version",
      "retrieved_at",
      "sou
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "source": "CISA KEV catalog (cisa.gov) — US-Government public domain",
  "product": "cisa-kev-prioritization",
  "freshness": "see response"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/rocketcore-intel-cisa-kev-prioritization-7cf43c9f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rocket-core.com](https://www.zero.xyz/host/intel.rocket-core.com/llms.txt)