# CVE & Exploit Intelligence Monitor: NVD + CISA KEV + EPSS (MCP) (`amygraphics/cve-exploit-intel-monitor`) Actor

Every NVD CVE enriched with CISA KEV (exploited in the wild, ransomware flag, patch deadline) and EPSS exploit probability. Keyword/CVE-ID search, or monitor your product stack - charged only for new CVEs and newly exploited ones. MCP-ready.

- **URL**: https://apify.com/amygraphics/cve-exploit-intel-monitor.md
- **Developed by:** [Zakaria el bouami](https://apify.com/amygraphics) (community)
- **Categories:** Lead generation, Automation, MCP servers
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE & Exploit Intelligence Monitor: NVD + CISA KEV + EPSS (MCP)

Vulnerability intelligence for humans and AI agents: **every NVD CVE, enriched with "is it actively exploited?" (CISA KEV) and "how likely to be exploited?" (EPSS)** — in one run, no key, no login, MCP-compatible.

### Why this is hard (and why agents need it)

- Three official feeds that **nobody joins for free**: NVD publishes ~150 new CVEs per day (30,000+ CRITICAL in total), CISA maintains the KEV catalog of CVEs **confirmed exploited in the wild**, and FIRST.org scores exploitation probability (EPSS). Each has a different API, rate limits, and format. This actor resolves all three into one row per CVE.
- NVD's API v2 pagination, 120-day window limits, and public rate-limit pacing are handled for you — rejected CVEs are filtered out automatically.
- An LLM answering "is CVE-2024-21762 exploited?" from memory is guessing. Here you get CISA's live answer: **exploited since 2024-03-01, due date, known ransomware use**, plus EPSS percentile.

### What you get per CVE

| field | meaning |
|---|---|
| `cveId`, `description` | CVE identifier + official English description (NVD) |
| `cvssScore`, `severity`, `cvssVector` | CVSS v3.1 (fallback v3.0/v2): base score, severity, full vector |
| `kevExploited` | **true when CISA lists the CVE as exploited in the wild** |
| `kevDateAdded`, `kevDueDate`, `kevRansomware` | when CISA cataloged it, the federal patch deadline, ransomware campaign flag |
| `kevVendor`, `kevProduct`, `kevName` | vendor / product / short name from CISA |
| `epssScore`, `epssPercentile` | exploitation probability (0–1) and percentile rank (FIRST.org EPSS) |
| `cwes`, `affectedCpEs`, `referencesCount` | weakness IDs, affected product CPE strings (up to 10), reference count |
| `publishedISO`, `lastModifiedISO`, `vulnStatus` | NVD timeline + status |

### Mode `search`

```json
{ "mode": "search", "query": "openssl", "minSeverity": "CRITICAL", "maxResults": 10 }
```

- Keyword/product search, exact `CVE-2024-21762` lookup, optional severity floor.
- Every row includes KEV + EPSS joins. Charged per CVE row: **$0.001**.

### Mode `monitor` — new-CVE & exploitation radar

```json
{ "mode": "monitor", "watchlist": ["openssl", "fortinet", "microsoft windows"], "minSeverity": "HIGH" }
```

- **Run 1 = free baseline** (info row only): saves a time cursor plus the full KEV snapshot.
- **Run 2+ = diff**: CVEs *published since the cursor* matching your watchlist (`changeKind: "new-cve"`, with `matchedTerm`) **plus CVEs newly added to CISA KEV** (`changeKind: "kev-added"`) — even older CVEs attackers just started exploiting.
- Schedule daily/weekly; a no-news run costs **$0.001 total**. Add a webhook to Slack / Teams / n8n for instant alerts.

### Three ready recipes

1. **SOC / AI security agent** — as an MCP tool, your agent answers "is this CVE exploited? how bad is it?" with CISA-confirmed exploitation status, patch deadline, EPSS percentile and CVSS vector, with source links.
2. **Stack watch** — watchlist = your deployed products (`["windows server 2019", "apache http server", "openvpn"]`), run daily, get only NEW CVEs and NEWLY EXPLOITED ones — the two things that actually demand action.
3. **Vendor risk shortlist** — severity `CRITICAL` + keyword search on a vendor/product → ranked enriched shortlist for risk assessments and RFP questionnaires.

### Data honesty & limits

- `kevExploited` means **CISA confirmed exploitation** — absence means "not in KEV", not "never exploited".
- `epssScore` is a statistical probability (FIRST.org model), not a guarantee; v1 feeds without EPSS coverage return empty strings.
- All fields come from the official feeds at run time; rejected/reserved CVEs are skipped (empty `vulnStatus` only appears for minimal KEV-lookup fallbacks).
- Public NVD rate limits apply; the actor paces requests (default 1 s).

### Sources (official, anonymous, no key)

- NVD — National Vulnerability Database API 2.0: <https://nvd.nist.gov>
- CISA — Known Exploited Vulnerabilities catalog: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog>
- FIRST.org — EPSS (Exploit Prediction Scoring System): <https://www.first.org/epss>

### Price

| event | price |
|---|---|
| Actor start | $0.001 |
| CVE intel row extracted (search match, new watchlist CVE, or KEV addition) | $0.001 / row |

Typical runs: enriched 10-row search ≈ **$0.011** · daily stack watch with 2 new CVEs + 1 KEV addition ≈ **$0.004**.

### MCP / AI-agent usage

Add the actor to your agent's tools, or call:

```
https://api.apify.com/v2/acts/YOUR_HANDLE~cve-exploit-intel-monitor/run-sync-get-dataset-items?token=YOUR_TOKEN
```

Input = the JSON examples above. Output = the dataset rows described in the table. Compatible with per-request agentic payments.

Questions / feedback: see the actor's **Issues** tab on Apify Store.

# Actor input Schema

## `mode` (type: `string`):

search = look up CVEs by keyword/product/CVE-ID. monitor = diff scan for your watchlist (first run = free baseline).

## `query` (type: `string`):

Product/keyword (e.g. 'openssl', 'fortinet'), or exact CVE ID (e.g. 'CVE-2024-21762').

## `minSeverity` (type: `string`):

Filter to CRITICAL, HIGH, MEDIUM or LOW (CVSS v3). Empty = all severities.

## `watchlist` (type: `array`):

Products/keywords (or exact CVE-IDs) to watch for NEW published CVEs. KEV additions (newly exploited) are always reported.

## `maxResults` (type: `integer`):

Maximum CVE rows returned/charged per run.

## `requestDelaySecs` (type: `number`):

Politeness pacing; NVD public API is rate-limited.

## `proxyConfiguration` (type: `object`):

Optional. The official NVD / CISA / FIRST endpoints do not require proxies.

## Actor input object example

```json
{
  "mode": "search",
  "query": "openssl",
  "minSeverity": "",
  "watchlist": [
    "openssl",
    "microsoft windows",
    "fortinet"
  ],
  "maxResults": 10,
  "requestDelaySecs": 1
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("amygraphics/cve-exploit-intel-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("amygraphics/cve-exploit-intel-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call amygraphics/cve-exploit-intel-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,amygraphics/cve-exploit-intel-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/IaDWYgtjYCEzsLd30/builds/vCF4rBMZazn6eBxC9/openapi.json