# Stack Facts KEV Changes Feed

> Stack Facts KEV Changes Feed is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-13).

Returns incremental changes (added, removed, modified entries) to the CISA Known Exploited Vulnerabilities (KEV) catalog since a given snapshot ID, with cryptographic signatures and pay-per-call USDC billing.

## Facts

- Endpoint: GET https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/changes?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-kev-changes-feed-bc6799d1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1uWP1Ui8Qk-vsOQIldaNw

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-kev-changes-feed-bc6799d1
```

Example prompt: What changed in the CISA Known Exploited Vulnerabilities catalog since snapshot kev-20261009T040000Z-7bd60fe8? Show me anything added, removed, or modified.

## When to prefer this

Use this endpoint when you need incremental, cryptographically verifiable updates to the CISA KEV catalog without maintaining a full subscription or API key. It is ideal for lightweight polling in security automation pipelines, compliance workflows, or AI agents that need to detect newly exploited CVEs since a known checkpoint. Prefer this over scraping the CISA website or using the full KEV snapshot endpoint when you already have a prior snapshot ID and only need the delta.

## Known failure modes

- Invalid 'since' snapshot ID format (must match pattern kev-YYYYMMDDTHHMMSSZ-8hexchars) returns 400 error
- Snapshot ID too old or not found returns 404 or empty diff
- Payment not included or insufficient USDC causes 402 Payment Required response
- Network timeout or server unavailability returns 5xx
- Stale data flag in meta indicates cached/outdated snapshot

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

A JSON object containing: a 'data' field with lists of added, removed, and modified KEV entries (each with CVE ID, vendor, product, due date, date added, ransomware association flag, required action, and notes URLs), change counts, and snapshot cursor IDs (since/to); plus a 'meta' field with source attribution, dataset info, CC0 licence, SHA-256 hash, cryptographic signature, key ID, staleness flag, and retrieval timestamp.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$defs": {
  "meta": {
   "type": "object",
   "required": [
    "dataset",
    "snapshot_id",
    "as_of",
    "retrieved_at",
    "source",
    "licence",
    "attribution",
    "sha256",
    "signature",
    "key_id",
    "manifest_url",
    "stale",
    "notice"
   ],
   "properties": {
    "as_of": {
     "type": "string"
    },
    "stale": {
     "type": "boolean"
    },
    "key_id": {
     "type": "string"
    },
    "notice": {
     "type": "string"
    },
    "sha256": {
     "type": "string"
    },
    "source": {
     "type": "string"
    },
    "dataset": {
     "type": "string"
    },
    "licence": {
     "type": "string"
    },
    "signature": {
     "type": "string"
    },
    "attribution": {
     "type": "string"
    },
    "snapshot_id": {
     "type": "string"
    },
    "manifest_url": {
     "type": "string"
    },
    "retrieved_at": {
     "type": "string"
    }
   }
  }
 },
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "type": "string",
     "const": "GET"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "since"
     ],
     "properties": {
      "since": {
       "type": "string",
       "pattern": "^kev-\\d{8}T\\d{6}Z-[0-9a-f]{8}$",
       "maxLength": 64
      }
     },
     "additionalProperties": false
    }
   }
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "required": [
      "data",
      "meta"
     ],
     "properties": {
      "data": {
       "type": "object"
      },
      "meta": {
       "$ref": "#/$defs/meta"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "to": "kev-20261009T060000Z-f4586cc5",
   "added": [],
   "since": "kev-20261009T040000Z-7bd60fe8",
   "counts": {
    "added": 2,
    "removed": 1,
    "modified": 3
   },
   "removed": [
    "CVE-2009-3459"
   ],
   "modified": [
    {
     "cve": "CVE-2023-34362",
     "name": "Progress MOVEit Transfer SQL In…",
     "in_kev": true,
     "vendor": "Progress",
     "product": "MOVEit Transfer",
     "due_date": "2023-06-30",
     "date_added": "2023-06-02",
     "notes_urls": [
      "https://www.cisa.gov/news-event…"
     ],
     "required_action": "Apply updates per vendor instru…",
     "known_ransomware": true
    }
   ],
   "snapshots_merged": 2
  },
  "meta": {
   "as_of": "2026-10-09T06:00:00Z",
   "stale": false,
   "key_id": "sf-test-1",
   "notice": "Normalised (modified) from the …",
   "sha256": "f4586cc54bee30640f4364100eb70b7…",
   "source": "https://www.cisa.gov/sites/defa…",
   "dataset": "kev",
   "licence": "CC0-1.0",
   "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEd…",
   "attribution": "Source: CISA Known Exploited Vu…",
   "snapshot_id": "kev-20261009T060000Z-f4586cc5",
   "manifest_url": "/v1/kev/manifest",
   "retrieved_at": "2026-10-09T06:00:00.000Z"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-kev-changes-feed-bc6799d1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)