Security

CVEs, KEV, EPSS, IOC reputation, headers, exposure. 16 pay-per-call security endpoints for AI agents — keyless, USDC via x402.

WATCHERS Don't poll — get woken up

Arm a paid watcher on security and we push a signed callback the moment it happens — no polling loop. All watchers →

Ioc reputation $0.05get a signed callback when an indicator of compromise (IP or domain) changes malicious status across threat feeds. Http headers $0.05get a signed callback when a website's HTTP security-headers grade changes (e.g.
security.attack$0.0010
Authoritative MITRE ATT&CK (Enterprise) technique lookup.
GET /api/security/attack
security.capec$0.0010
Authoritative MITRE CAPEC (Common Attack Pattern Enumeration) lookup.
GET /api/security/capec
security.cve$0.0018
Look up a CVE by id (e.g.
GET /api/security/cve
security.cve-changes$0.0022
CVE change feed — the CVE records MODIFIED within a time window, so an agent can incrementally maintain a vulnerability view instead of re-scanning.
GET /api/security/cve-changes
security.cve-search$0.0022
Find vulnerabilities affecting a product by searching the NIST National Vulnerability Database.
GET /api/security/cve-search
security.cwe$0.0010
Authoritative MITRE CWE (Common Weakness Enumeration) lookup.
GET /api/security/cwe
security.exploit-availability$0.0010
Does public exploit code exist for a CVE, and where? Pass cve (e.g.
GET /api/security/exploit-availability
security.http-headers$0.0018
Fetch a URL and grade its HTTP security headers.
GET /api/security/http-headers
security.ics-advisories$0.0048
CISA Industrial Control Systems (ICS) advisories — vulnerabilities in operational-technology gear (SCADA, PLCs, building automation, energy/manufacturing/transp
GET /api/security/ics-advisories
security.ioc-reputation$0.0022
Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detect
GET /api/security/ioc-reputation
security.ip-abuse$0.0022
AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into.
GET /api/security/ip-abuse
security.ip-blacklist$0.0024
AbuseIPDB bulk blacklist — the most-reported abusive IPs above a confidence threshold, the canonical fail2ban / firewall block-feed.
GET /api/security/ip-blacklist
security.ip-block$0.0024
AbuseIPDB subnet (CIDR) check — which IPs inside a network block have been reported for abuse.
GET /api/security/ip-block
security.ip-reputation$0.0036
Multi-source IP reputation with one combined authority score (0-100).
GET /api/security/ip-reputation
security.package$0.0022
Security and provenance for an open-source package, composed live from three authoritative sources in one call.
GET /api/security/package
security.password-exposure$0.0010
Check whether a password has appeared in known data breaches, using Have I Been Pwned's Pwned Passwords k-anonymity model — only the first 5 characters of the p
POST /api/security/password-exposure

Discovery