datakoot-com Security Intel API
The Security Intel API from datakoot-com — 5 operation(s) for security intel.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/datakoot-com:datakoot-com-security-intel-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Datakoot x402 data Security Intel API
version: 2.8.0
x-guidance: 'Call POST /api/<tool> with a JSON body of the tool''s arguments (GET with a query string also works). Without payment you get HTTP 402 with an x402 v2 challenge (PAYMENT-REQUIRED header and JSON body): pay $0.01 USDC on Base (eip155:8453) to the listed payTo using the exact scheme, then retry with the PAYMENT-SIGNATURE header. Datakoot verifies the payment, runs the tool, and settles only if the tool succeeds; a tool error returns 422 with charged:false. Successful responses are plain JSON matching each operation''s 200 schema, with the on-chain receipt in PAYMENT-RESPONSE. Start with cve_lookup, package_health, financials, country_profile or domain_report. MCP clients can use /mcp; every tool is also free for 100 calls/day at <server>.datakoot.com/mcp.'
description: 48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) plus 4 Koot briefing tools that combine many lookups into one answer, for AI agents. $0.01 USDC per call (every tool and every Koot brief) on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at .datakoot.com/mcp.
contact:
email: hello@datakoot.com
url: https://datakoot.com
servers:
- url: https://x402.datakoot.com
tags:
- name: Security Intel
paths:
/api/cve_lookup:
post:
operationId: cve_lookup
summary: CVE Lookup (Security Intel)
description: 'Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS. PAID: $0.01 USDC per call via x402 (charged only on success).'
tags:
- Security Intel
x-payment-info:
price:
currency: USD
mode: fixed
amount: '0.01'
protocols:
- x402:
scheme: exact
network: eip155:8453
asset: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
payTo: '0x3de7b2de531053340cf132d29b837e5a0e924177'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
cve_id:
type: string
description: CVE identifier, e.g. CVE-2021-44228 (case-insensitive; a bare 2021-44228 also works).
required:
- cve_id
example:
cve_id: CVE-2024-3094
responses:
'200':
description: Tool result (charged)
content:
application/json:
schema:
type: object
properties:
id: {}
status: {}
description: {}
cvss: {}
cwe: {}
published: {}
last_modified: {}
references: {}
known_exploited: {}
exploit_probability: {}
sources: {}
additionalProperties: true
'402':
description: 'Payment required: x402 challenge in the PAYMENT-REQUIRED header and body'
'422':
description: Tool error (not charged)
/api/known_exploited:
post:
operationId: known_exploited
summary: Known Exploited (Security Intel)
description: 'Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily. PAID: $0.01 USDC per call via x402 (charged only on success).'
tags:
- Security Intel
x-payment-info:
price:
currency: USD
mode: fixed
amount: '0.01'
protocols:
- x402:
scheme: exact
network: eip155:8453
asset: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
payTo: '0x3de7b2de531053340cf132d29b837e5a0e924177'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
cve_id:
type: string
description: Optional. Check a single CVE, e.g. CVE-2021-44228.
limit:
type: number
description: When listing, how many newest entries to return (default 20, max 100).
vendor:
type: string
description: Optional. Filter by vendor or product name substring.
ransomware_only:
type: boolean
description: Optional. Only vulns CISA links to known ransomware campaigns.
required: []
example:
limit: 5
responses:
'200':
description: Tool result (charged)
content:
application/json:
schema:
type: object
properties:
catalog_version: {}
catalog_count: {}
released: {}
returned: {}
filter: {}
vulnerabilities: {}
source: {}
cve_id: {}
listed: {}
vendor: {}
product: {}
name: {}
date_added: {}
due_date: {}
known_ransomware_use: {}
required_action: {}
additionalProperties: true
'402':
description: 'Payment required: x402 challenge in the PAYMENT-REQUIRED header and body'
'422':
description: Tool error (not charged)
/api/epss_score:
post:
operationId: epss_score
summary: EPSS Score (Security Intel)
description: 'Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS. PAID: $0.01 USDC per call via x402 (charged only on success).'
tags:
- Security Intel
x-payment-info:
price:
currency: USD
mode: fixed
amount: '0.01'
protocols:
- x402:
scheme: exact
network: eip155:8453
asset: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
payTo: '0x3de7b2de531053340cf132d29b837e5a0e924177'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
cve_id:
type: string
description: A single CVE id.
cve_ids:
type: array
items:
type: string
description: Multiple CVE ids (or pass a comma-separated string).
required: []
example:
cve_ids:
- CVE-2024-3094
- CVE-2021-44228
responses:
'200':
description: Tool result (charged)
content:
application/json:
schema:
type: object
properties:
model: {}
as_of: {}
scored: {}
scores: {}
note: {}
source: {}
additionalProperties: true
'402':
description: 'Payment required: x402 challenge in the PAYMENT-REQUIRED header and body'
'422':
description: Tool error (not charged)
/api/package_vulnerabilities:
post:
operationId: package_vulnerabilities
summary: Package Vulnerabilities (Security Intel)
description: 'List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex. PAID: $0.01 USDC per call via x402 (charged only on success).'
tags:
- Security Intel
x-payment-info:
price:
currency: USD
mode: fixed
amount: '0.01'
protocols:
- x402:
scheme: exact
network: eip155:8453
asset: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
payTo: '0x3de7b2de531053340cf132d29b837e5a0e924177'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
ecosystem:
type: string
description: 'Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.'
name:
type: string
description: Exact package name as published in that registry, e.g. lodash for npm, requests for pypi.
version:
type: string
description: Optional; if given, only vulns affecting that version are returned
required:
- ecosystem
- name
example:
ecosystem: npm
name: lodash
version: 4.17.15
responses:
'200':
description: Tool result (charged)
content:
application/json:
schema:
type: object
properties:
ecosystem: {}
name: {}
version: {}
vulnerability_count: {}
vulnerabilities: {}
source: {}
additionalProperties: true
'402':
description: 'Payment required: x402 challenge in the PAYMENT-REQUIRED header and body'
'422':
description: Tool error (not charged)
/api/audit_dependencies:
post:
operationId: audit_dependencies
summary: Audit Dependencies (Security Intel)
description: 'Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as ''manifest''), or pass a ''dependencies'' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm. PAID: $0.01 USDC per call via x402 (charged only on success).'
tags:
- Security Intel
x-payment-info:
price:
currency: USD
mode: fixed
amount: '0.01'
protocols:
- x402:
scheme: exact
network: eip155:8453
asset: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
payTo: '0x3de7b2de531053340cf132d29b837e5a0e924177'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
manifest:
type: string
description: Raw package.json contents
dependencies:
type: array
items:
type: object
description: '[{name, version}] entries'
ecosystem:
type: string
description: 'Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex.'
required: []
example:
manifest: '{"dependencies": {"lodash": "4.17.15", "express": "4.17.1"}}'
responses:
'200':
description: Tool result (charged)
content:
application/json:
schema:
type: object
properties:
ecosystem: {}
packages_audited: {}
packages_with_vulnerabilities: {}
total_vulnerabilities: {}
packages_not_found: {}
packages_unverified: {}
verdict: {}
findings: {}
source: {}
additionalProperties: true
'402':
description: 'Payment required: x402 challenge in the PAYMENT-REQUIRED header and body'
'422':
description: Tool error (not charged)