# Synergy CVE Risk Brief

> Synergy CVE Risk Brief is a paid API for AI agents from api.exo-trust.com, paid per call via x402, $1/call, status unknown (last checked 2026-09-15).

Fetches a full NVD 2.0 CVE record (CVSS metrics, CWE weaknesses, CPE surface, references) enriched with CISA KEV catalog status and FIRST EPSS exploit probability score, then synthesizes a machine-formatted risk brief.

## Facts

- Endpoint: POST https://api.exo-trust.com/execute/cve_brief
- Price: $1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synergy-cve-risk-brief-aa4d468e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_BGwp58imsh7iwO5Rsq2a5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synergy-cve-risk-brief-aa4d468e -d '<json body>'
```

Example prompt: Pull the full risk brief for CVE-2021-44228 — I need the CVSS scores, CWE weaknesses, whether it's in the CISA KEV catalog, and the EPSS exploit probability.

## When to prefer this

Choose this endpoint when you need a single, consolidated vulnerability risk brief that combines NVD authoritative data, CISA active exploitation status, and EPSS statistical exploit likelihood in one call. It is ideal for security triage workflows, compliance reporting, and agent-driven patch prioritization where you need attestable, multi-source enrichment rather than raw NVD data alone.

## Known failure modes

- CVE ID not found in NVD — returns empty or not-found response
- Malformed CVE ID format — input validation error
- Product name search returns no matches — empty results
- NVD/CISA/FIRST upstream APIs unavailable — service error
- Payment not confirmed — 402 Payment Required before processing

## How this service works

Vulnerability risk brief: exact CVE id (or product-name search over the NVD keyword index). Attested NVD 2.0 record (description, CVSS v2/v3.x/v4.0 metrics, CWE weaknesses, vulnerable CPE surface, references) + CISA KEV catalog status + FIRST EPSS score/percentile, then a machine-formatted risk brief from those attested facts only. Keyless public sources (NVD/CISA/FIRST); $1.00 (moat product #4).

## Output

Returns the attested NVD 2.0 record (description, CVSS v2/v3.x/v4.0 base scores and vectors, CWE weakness identifiers, vulnerable CPE configurations, and reference links), the CISA KEV catalog membership status, the FIRST EPSS probability score and percentile, and a machine-formatted risk brief synthesized from those sources only.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cve": {
   "type": "string",
   "description": "CVE id, e.g. CVE-2021-44228 (CVE-YYYY-NNNN)."
  },
  "product": {
   "type": "string",
   "description": "Vendor/product name search over the NVD keyword index, e.g. log4j — surfaces the most recently published matches; use 'cve' for the full risk brief."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synergy-cve-risk-brief-aa4d468e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.exo-trust.com](https://www.zero.xyz/host/api.exo-trust.com/llms.txt)