# Tech Stack CVE Risk Checker (CISA KEV & EPSS)

> Tech Stack CVE Risk Checker (CISA KEV & EPSS) is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-16).

Checks a declared technology stack against actively-exploited CVEs from CISA's Known Exploited Vulnerabilities (KEV) catalog and high-EPSS-score vulnerabilities to surface critical security risks.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/tech-stack-cve
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tech-stack-cve-risk-checker-cisa-kev-epss-5cdd5495
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_NnWgcJBGf3CssVHGhvXWj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tech-stack-cve-risk-checker-cisa-kev-epss-5cdd5495 -d '<json body>'
```

Example prompt: Before we deploy this stack to production, check it for actively exploited CVEs and high-EPSS vulnerabilities — we're running nginx 1.24, WordPress 6.4, and PHP 8.2.

## When to prefer this

Choose this endpoint when you need to cross-reference a specific technology stack against actively-exploited CVEs — particularly the CISA KEV list and EPSS probability scores — rather than doing a broad CVE database dump. Ideal for pre-deployment gates, vendor risk assessments, or incident triage where you need to know if your components are being actively exploited in the wild right now, not just theoretically vulnerable.

## Known failure modes

- Unrecognized or misspelled technology names may return empty results rather than an error
- Very new CVEs may not yet appear in CISA KEV or EPSS data if feeds haven't refreshed
- Highly generic technology names without version numbers may produce overly broad or noisy results
- Rate limiting or payment authorization failure returns 402 or 429 error
- Internal server error (500) if the upstream CVE/EPSS data source is unavailable

## How this service works

Check a declared technology stack (e.g. nginx, WordPress, Cisco IOS) against actively-exploited CVEs (CISA KEV) and high-EPSS-score vulnerabilities. Call before deploying or continuing to run a given technology stack in production.

## Output

Returns a list of CVEs matching the declared technology stack, indicating which appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and providing EPSS scores that reflect the probability of active exploitation, along with severity details and remediation context.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Alternative: pull tech_stack from a stored user profile by domain"
  },
  "tech_stack": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Declared technology product names"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tech-stack-cve-risk-checker-cisa-kev-epss-5cdd5495/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)