# ToolMint CISA KEV

> CISA Known Exploited Vulnerabilities catalog for agents — lookup by CVE, search by vendor/product/date, batch-check up to 50 CVEs. Returns due dates and ransomware-use flags. Public domain US government data.

- Status: Coming soon
- Price: $0.01 / call (x402 exact, USDC on Base eip155:8453, payTo 0xfbF7413bcB3a604936775C96FDbe0b0C9c9E37F5)
- Planned URL: https://toolmint-cisa-kev-json.toolmint.workers.dev
- OpenAPI: https://toolmint.toolmint.workers.dev/tools/cisa-kev-json/openapi.json

## Routes

- `GET /lookup` $0.01: Look up one CVE
- `GET /cve/{cve}` $0.01: Look up CVE by path
- `GET /search` $0.01: Search by vendor/product/dateAdded/ransomwareKnown
- `GET /check` $0.01: Batch check ≤50 CVEs (cves= comma-separated)
- `POST /check` $0.01: Batch check ≤50 CVEs (JSON body)

## When to use it

- Triage: check one CVE or a list of up to 50 against KEV.
- Find KEV entries for a vendor or product, or added on a date, or flagged as used in ransomware campaigns.

Not for: a general severity score (no CVSS here), vulnerabilities that are exploited but not yet in KEV, or proof that you are patched. "Not in KEV" means CISA has not listed it; it does not mean it is safe. A "not in KEV" answer is a normal 200 and **is charged**, because that is the answer you asked for.

## Example

```bash
curl -i "https://toolmint-cisa-kev-json.toolmint.workers.dev/lookup?cve=CVE-2021-44228"
```

That hostname is the planned Worker name. The tool is **not deployed yet**.

Trimmed response (values illustrative):

```json
{
  "tool": "cisa-kev-json",
  "version": "0.1.0",
  "mode": "lookup",
  "cveId": "CVE-2021-44228",
  "inKev": true,
  "vulnerability": {
    "cveId": "CVE-2021-44228",
    "vendor": "...", "product": "...", "name": "...",
    "dateAdded": "2021-12-10", "dueDate": "2021-12-24",
    "overdue": true, "daysUntilDue": -1771,
    "ransomwareUse": "Known", "ransomwareKnown": true,
    "shortDescription": "...", "requiredAction": "...",
    "cwes": ["CWE-..."], "forensicTriage": null
  },
  "catalogVersion": "...",
  "catalogDateReleased": "...",
  "summary": { "text": "1 KEV entry; 1 ransomware-known; 1 overdue", "ransomwareKnownCount": 1, "overdueCount": 1, "vendorCount": 1 },
  "provenance": {
    "source": "CISA Known Exploited Vulnerabilities (KEV) catalog",
    "sourceUrl": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
    "fetched_at": "2026-10-31T11:30:00.000Z",
    "catalogVersion": "...", "catalogDateReleased": "...",
    "license": "US Government work - public domain (CISA KEV catalog)"
  },
  "cached": false
}
```

`overdue` and `daysUntilDue` are computed from CISA's due date against today (UTC); the due date applies to US federal agencies. A batch response has `requested`, `inKevCount`, `notInKevCount`, `ransomwareKnownCount`, `overdueCount` and a `results` array.

## Data source and licence

CISA Known Exploited Vulnerabilities catalog. US Government work, public domain. No API key.

## Freshness and caching

The catalog is downloaded and kept in memory for up to 1 hour. `provenance.fetched_at` is when the catalog was actually downloaded (not the time of your call), and `catalogDateReleased` is CISA's release date. A CVE added to KEV in the last hour may not appear yet.

## Limits

- KEV only. No CVSS, no EPSS, no exploit details.
- `vendor` and `product` are substring matches on CISA's names, so spelling must match CISA's.
- Search returns at most 100 entries (`truncated` and `matchCount` tell you if there were more).