# SignalDesk AI – CISA KEV Lookup

> SignalDesk AI – CISA KEV Lookup is a paid API for AI agents from x402-agent.kariguetoazul.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-10).

Checks whether a given CVE identifier is listed in CISA's Known Exploited Vulnerabilities catalog and returns detailed vulnerability metadata

## Facts

- Endpoint: GET https://x402-agent.kariguetoazul.workers.dev/api/security/kev?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/signaldesk-ai-cisa-kev-lookup-958f0b7e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ipAYbu1rghM6QCBAoh7Cs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability signaldesk-ai-cisa-kev-lookup-958f0b7e
```

Example prompt: Can you check if CVE-2021-44228 is in the CISA Known Exploited Vulnerabilities catalog and tell me the remediation action, due date, and whether it's linked to ransomware?

## When to prefer this

Choose this endpoint when you need authoritative CISA KEV data for a specific CVE — particularly for federal compliance (CISA BOD 22-01 obligations), SOC triage, or patch prioritization workflows. Prefer this over generic NVD or CVE database lookups when the specific question is 'is this actively exploited and federally mandated for patching?' rather than general CVSS scoring or technical vulnerability details.

## Known failure modes

- Invalid CVE format (must match ^CVE-[0-9]{4}-[0-9]{4,7}$) returns a validation error
- CVE not found in KEV catalog returns listed_in_kev: false with no vulnerability details
- CISA upstream data source unavailable may return stale or error response
- Missing required 'cve' query parameter causes request failure
- Payment not settled (x402) results in 402 response before any data is returned

## How this service works

Evidence-backed autonomous AI jobs and paid data tools. Queue/D1/cron run outside the chat; free quotas and bounded execution apply.

## Output

Returns a JSON object indicating whether the CVE is listed in CISA's KEV catalog (listed_in_kev boolean), along with full vulnerability details (name, vendor, product, date added, patch due date, ransomware use status, and remediation action), plus source metadata including the CISA data provider, license, fetch timestamp, and current catalog version.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "cve"
     ],
     "properties": {
      "cve": {
       "type": "string",
       "pattern": "^CVE-[0-9]{4}-[0-9]{4,7}$",
       "maxLength": 22,
       "description": "CVE identifier."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "cve": "CVE-2021-44228",
  "source": {
   "license": "US government public data",
   "provider": "CISA",
   "expires_at": "2026-10-02T10:44:48.006Z",
   "fetched_at": "2026-10-02T09:44:48.006Z",
   "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
   "transformed": true
  },
  "listed_in_kev": true,
  "vulnerability": {
   "name": "Apache Log4j2 Remote Code Execution Vulnerability",
   "action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",
   "vendor": "Apache",
   "product": "Log4j2",
   "due_date": "2021-12-24",
   "date_added": "2021-12-10",
   "ransomware_use": "Known"
  },
  "catalog_version": "2026.10.01"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/signaldesk-ai-cisa-kev-lookup-958f0b7e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-agent.kariguetoazul.workers.dev](https://www.zero.xyz/host/x402-agent.kariguetoazul.workers.dev/llms.txt)