# SignalDesk AI – CISA KEV Search

> SignalDesk AI – CISA KEV Search is a paid API for AI agents from x402-agent.kariguetoazul.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-13).

Searches the CISA Known Exploited Vulnerabilities (KEV) catalog by keyword, returning matching CVE records with vendor, product, due date, and remediation actions

## Facts

- Endpoint: GET https://x402-agent.kariguetoazul.workers.dev/api/security/kev-search?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/signaldesk-ai-cisa-kev-search-146138c7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ThMI0BfC6e_-bIlpgg87G

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability signaldesk-ai-cisa-kev-search-146138c7
```

Example prompt: Search the CISA Known Exploited Vulnerabilities catalog for any CVEs affecting Microsoft SharePoint and show me up to 10 results including their patch deadlines and recommended actions.

## When to prefer this

Choose this endpoint when you need to search the authoritative CISA Known Exploited Vulnerabilities catalog by keyword — especially for compliance workflows (CISA BOD), patch prioritization, or threat intelligence enrichment. It provides pre-transformed, structured KEV data with source provenance and expiry metadata, making it ideal for automated security pipelines without needing to parse CISA's raw JSON feed directly.

## Known failure modes

- Missing or empty 'q' query parameter returns a validation error
- Query exceeding 200 characters is rejected
- Limit value outside 1–20 range is rejected
- CISA upstream data unavailable may cause stale or failed responses
- No matching results returns an empty results array with total:0
- Payment of 0.003 USDC not provided or rejected results in HTTP 402

## How this service works

Evidence-backed autonomous AI jobs and paid data tools. Queue/D1/cron run outside the chat; free quotas and bounded execution apply.

## Output

Returns a JSON object with a total count of matching records, source metadata (CISA provider info, license, fetch/expiry timestamps, source URL), and an array of results each containing the CVE identifier, affected vendor, affected product, date added to the KEV catalog, patch due date, and CISA-recommended remediation action text.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "q"
     ],
     "properties": {
      "q": {
       "type": "string",
       "maxLength": 200,
       "minLength": 1,
       "description": "Search query."
      },
      "limit": {
       "type": "integer",
       "maximum": 20,
       "minimum": 1,
       "description": "Results, default 5."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "total": 389,
  "source": {
   "license": "US government public data",
   "provider": "CISA",
   "expires_at": "2026-10-02T10:44:48.006Z",
   "fetched_at": "2026-10-02T09:44:48.006Z",
   "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
   "transformed": true
  },
  "results": [
   {
    "cve": "CVE-2026-65660",
    "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "vendor": "Microsoft",
    "product": "SharePoint",
    "due_date": "2026-09-28",
    "date_added": "2026-09-25"
   },
   {
    "cve": "CVE-2026-81963",
    "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "vendor": "Microsoft",
    "product": "Windows",
    "due_date": "2026-09-22",
    "date_added": "2026-09-08"
   },
   {
    "cve": "CVE-2026-85880",
    "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "vendor": "Microsoft",
    "product": "Windows",
    "due_date": "2026-09-22",
    "date_added": "2026-09-08"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/signaldesk-ai-cisa-kev-search-146138c7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-agent.kariguetoazul.workers.dev](https://www.zero.xyz/host/x402-agent.kariguetoazul.workers.dev/llms.txt)