# ToolOracle CVE Lookup & Vulnerability Intelligence

> ToolOracle CVE Lookup & Vulnerability Intelligence is a paid API for AI agents from tooloracle.io, paid per call via x402, $0.005000/call, status unknown (last checked 2026-09-15).

Searches NIST NVD and CISA KEV databases by CVE ID, keyword, vendor, or product to return CVSS scores, severity ratings, exploitability status, and MITRE ATT&CK mappings

## Facts

- Endpoint: POST https://tooloracle.io/v2/cve_lookup
- Price: $0.005000/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tooloracle-io-2d627cfe
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0ThQ6e2RNBUnD-Y8Ahhvl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tooloracle-io-2d627cfe -d '<json body>'
```

Example prompt: Look up CVE-2024-3400 and tell me its CVSS score, severity, whether it's on the CISA Known Exploited Vulnerabilities list, and what MITRE ATT&CK technique it maps to — I need this for a vendor risk assessment.

## When to prefer this

Choose this endpoint when you need structured, authoritative vulnerability data from NIST NVD and CISA KEV in a single call — especially for compliance use cases like EU DORA ICT risk, NIS2 vendor due diligence, SOC2 evidence gathering, or ISO 27001 gap analysis. Prefer this over raw NVD API access when you need CISA KEV cross-referencing and MITRE ATT&CK mapping bundled together without building that aggregation yourself.

## Known failure modes

- CVE ID not found in NVD — returns empty result or 404-style error
- Overly broad keyword search returns too many results or times out
- Product/vendor name mismatch due to spelling variation yields no results
- Payment failure (x402) blocks the call before reaching the CVE database
- NVD upstream data lag means very recent CVEs may not yet appear

## How this service works

AgentNOMOS CVE Vulnerability Intelligence Lookup: Keyword, vendor or product search against the NIST NVD database. Returns per CVE: cve_id, published date, CVSS base score and vector string, attack vector, CWE class, description excerpt, references and the NVD detail URL. Source is NIST NVD only — no CISA KEV and no MITRE ATT&CK integration. For automated security checks and agent workflows.

## Output

Returns CVSS score (numeric), severity rating (Critical/High/Medium/Low), exploitability metadata, CISA KEV flag indicating active exploitation, MITRE ATT&CK technique ID and name, vulnerability description, affected products/versions, and publish/update dates from NVD.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "properties": {}
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tooloracle-io-2d627cfe/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tooloracle.io](https://www.zero.xyz/host/tooloracle.io/llms.txt)