{"uid":"cap_lZhhSeM0WhvPmRUXntm-a","slug":"osf-security-cve-exploit-check-0adf5561","name":"OSF Security — CVE Exploit Check","description":"OSF is a live marketplace of provenance stamped public domain government and scientific data, built for autonomous agents that pay per record over x402 micropayments on Base. A paid MCP server in the official MCP Registry, discoverable on the Coinbase CDP Bazaar.","url":"https://api.osf-master-server.com/x402/security/cve/%7Bcve_id%7D?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"pathParams":{"type":"object"},"queryParams":{"type":"object","required":["format"],"properties":{"format":{"type":"string","description":"Response format (json)."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["service","query","result","actively_exploited","compliance_note","audit_receipt"],"properties":{"nvd":{"type":"object"},"epss":{"type":"object"},"query":{"type":"string"},"result":{"type":"string","description":"FOUND, NOT_FOUND, or INVALID_INPUT"},"service":{"type":"string"},"audit_receipt":{"type":"object"},"coverage_note":{"type":"string"},"compliance_note":{"type":"string"},"provenance_urls":{"type":"object"},"actively_exploited":{"type":"boolean","description":"True if on the CISA KEV catalog."},"exploitation_summary":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"nvd":{"cvss_severity":"CRITICAL"},"epss":{"epss_probability":0.984,"exploitation_band":"Critical"},"query":"CVE-2026-33017","result":"FOUND","service":"OSF Security - CVE Exploit Check","audit_receipt":{"check_id":"uuid","result_sha256":"..."},"coverage_note":"Direct lookup against the US CISA Known Exploited Vulnerabilities (KEV) catalog, the FIRST EPSS model score, and the NVD CVE record. 'actively_exploited' reflects presence on the CISA KEV catalog ONLY. A CVE that is NOT on KEV is not necessarily safe or unexploitable - it simply is not on CISA's confirmed-exploited list. EPSS is a probability estimate, not proof.","compliance_note":"This is a decision-support signal, not a guarantee. Confirm against the linked authoritative sources (cisa.gov, nvd.nist.gov, first.org) before acting.","provenance_urls":{"cisa_kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},"actively_exploited":true,"exploitation_summary":"ON the CISA KEV catalog - confirmed exploited in the wild."}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_DccNZ-RO7jTkSnysMgoQT","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up a CVE identifier and returns its CISA KEV exploitation status, EPSS probability score, and NVD CVSS severity with provenance-stamped audit receipt","exampleAgentPrompt":"Is CVE-2021-44228 (Log4Shell) actively exploited in the wild? I need its CISA KEV status, EPSS probability score, and NVD CVSS severity in JSON format.","exampleUseCases":[{"title":"Emergency patch triage for critical CVEs","prompt":"We just got an alert about CVE-2023-44487 — is it on the CISA known exploited vulnerabilities list and what's the EPSS score? I need to know if this requires an emergency patch before our deployment window tonight."},{"title":"Compliance audit trail for vulnerability review","prompt":"Pull the full exploitation record for CVE-2021-26084 including its CVSS severity, EPSS probability, and CISA KEV status — I need the provenance-stamped audit receipt with SHA-256 hash for our SOC 2 compliance documentation."},{"title":"Vendor risk assessment before software approval","prompt":"Before we approve this third-party library, I need to check CVE-2024-3400 — is it actively being exploited in the wild, how severe is it according to NVD, and what's the current EPSS exploitation probability?"}],"resultDescription":"Returns a JSON object containing: result status (FOUND/NOT_FOUND/INVALID_INPUT), actively_exploited boolean (true if on CISA KEV), exploitation_summary string, EPSS probability and exploitation band, NVD CVSS severity rating, provenance URLs back to cisa.gov/nvd.nist.gov/first.org, a coverage_note explaining scope, a compliance_note, and a tamper-evident audit_receipt with a UUID and SHA-256 result hash.","failureModes":["CVE ID not found in NVD — returns result: NOT_FOUND with empty nvd/epss fields","Malformed or non-existent CVE format — returns result: INVALID_INPUT","Payment failure via x402 — 402 Payment Required returned before data is served","Upstream NVD or CISA source temporarily unavailable — may return stale or partial data","Rate limiting or network timeout on the OSF server — returns 5xx error"],"whenToPreferThis":"Choose this endpoint when you need a single, authoritative, provenance-stamped record combining CISA KEV, EPSS, and NVD data for a specific CVE — especially in agentic pipelines that require an audit trail (audit_receipt with SHA-256) for compliance or security decision workflows. Prefer this over scraping cisa.gov or nvd.nist.gov directly when you need structured JSON with micropayment-gated freshness guarantees and tamper-evident receipts.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T00:30:03.220Z","isFirstParty":false,"canonicalSlug":"osf-security-cve-exploit-check-0adf5561"}