# Stack Facts CISA KEV Snapshot

> Stack Facts CISA KEV Snapshot is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-13).

Returns the latest signed snapshot of the CISA Known Exploited Vulnerabilities (KEV) catalog, including CVE details, vendor/product info, due dates, and ransomware flags

## Facts

- Endpoint: GET https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/snapshot?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-cisa-kev-snapshot-6bb38377
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_xxUmVyjDAqJQskn1qTwQs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-cisa-kev-snapshot-6bb38377
```

Example prompt: Pull the latest CISA Known Exploited Vulnerabilities snapshot for me — I need the full signed KEV catalog with CVE details, vendor names, due dates, and ransomware flags so I can check our exposure.

## When to prefer this

Choose this endpoint when you need a cryptographically signed, verifiable snapshot of the complete CISA KEV catalog with no account setup or API key, paying only per call in USDC. Prefer it over direct CISA API calls when you need tamper-evident signed data with provenance metadata, or when operating in an agent context that supports x402 micropayments. Best for compliance workflows, security audits, and pre-install checks where data integrity verification matters.

## Known failure modes

- Payment not received or invalid USDC payment — returns HTTP 402 Payment Required
- Upstream CISA source temporarily unavailable — snapshot may be stale (stale flag set to true in meta)
- Invalid or malformed request parameters — returns 400 Bad Request
- Service temporarily unavailable — returns 503

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

A signed JSON payload containing the full CISA KEV dataset snapshot, including: an array of CVE records (CVE ID, vulnerability name, vendor, product, date added, due date, required action, ransomware flag, notes URLs), a manifest with snapshot ID, SHA-256 hash, cryptographic signature, key ID, record count, upstream catalog version, fetch timestamp, and previous snapshot ID, plus licence metadata (CC0-1.0) and source attribution to CISA.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "verify": "sha256 of the canonical JSON (R…",
   "licence": {
    "spdx": "CC0-1.0",
    "text": "The KEV database is distributed…",
    "source": "https://www.cisa.gov/sites/defa…",
    "sources": [
     "CISA KEV"
    ],
    "attribution": "Source: CISA Known Exploited Vu…"
   },
   "manifest": {
    "key_id": "sf-test-1",
    "sha256": "f4586cc54bee30640f4364100eb70b7…",
    "dataset": "kev",
    "licence": "CC0-1.0",
    "version": 1,
    "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEd…",
    "fetched_at": "2026-10-09T06:00:00Z",
    "source_url": "https://www.cisa.gov/sites/defa…",
    "attribution": "Source: CISA Known Exploited Vu…",
    "snapshot_id": "kev-20261009T060000Z-f4586cc5",
    "record_count": 31,
    "upstream_etag": null,
    "upstream_meta": {},
    "prev_snapshot_id": "kev-20261009T050000Z-013e1b3f"
   },
   "snapshot": {
    "dataset": "kev",
    "records": [
     {}
    ],
    "version": 1
   }
  },
  "meta": {
   "as_of": "2026-10-09T06:00:00Z",
   "stale": false,
   "key_id": "sf-test-1",
   "notice": "Normalised (modified) from the …",
   "sha256": "f4586cc54bee30640f4364100eb70b7…",
   "source": "https://www.cisa.gov/sites/defa…",
   "dataset": "kev",
   "licence": "CC0-1.0",
   "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEd…",
   "attribution": "Source: CISA Known Exploited Vu…",
   "snapshot_id": "kev-20261009T060000Z-f4586cc5",
   "manifest_url": "/v1/kev/manifest",
   "retrieved_at": "2026-10-09T06:00:00.000Z"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-cisa-kev-snapshot-6bb38377/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)