US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar (MCP Server + n8n Ready + REST API)

Audits IT vendors and software stacks against the official U.S. CISA Known Exploited Vulnerabilities (KEV) Catalog (Zero-Key). Flags active ransomware campaigns, BOD 22-01/26-04 patch deadlines, CWEs, and Threat Severity Scores (0-100).

Engineered by @b2b-quant-apis for scheduled Machine-to-Machine (n8n / Make.com) pipelines, Autonomous AI Agents (Claude Desktop, Cursor IDE, LangChain, CrewAI), and Enterprise Compliance & RevOps stacks.

---

Why Choose b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor?

1. Zero-Proxy & Zero-External-Key Architecture: Connects directly to official primary registries and public regulatory endpoints with deterministic input sanitization and automatic retry/backoff.
2. Quantitative Risk & Opportunity Scoring (0–100): Every output record includes a normalized quantitative score and an executive Markdown Dossier ready for RAG vector databases, Slack/Teams alerts, or CRM enrichment.
3. Native Model Context Protocol (MCP) Server: Connect directly to Claude Desktop, Cursor, Windsurf, or any MCP client in 1 click without deploying local infrastructure.
4. Predictable Pay-Per-Event Pricing: You only pay $0.02 USD per successfully processed record (cve-vulnerability-audited). Zero monthly subscription fees.

---

Transparent Pay-Per-Event (PPE) Pricing

Billing Event Name	Event Title	Price per Event (USD)	Categories
cve-vulnerability-audited	CISA KEV Exploited CVE & Ransomware Audited	$0.02 USD	AI, DEVELOPER_TOOLS, AUTOMATION

Negative Profit Protection: Failed queries, empty responses, or invalid inputs return cleanly without triggering event charges.

---

Input Parameters

Parameter	Type	Required	Default	Description
vendorKeyword	string	Yes	"Microsoft"	Vendor or software product keyword (e.g., 'Microsoft', 'Cisco', 'Fortinet', 'Linux', 'VMware', or leave empty for latest KEV additions).
onlyRansomware	boolean	Optional	false	If true, filters strictly for CVEs with confirmed ransomware campaign exploitation ('Known').
maxResults	integer	Optional	15	Maximum number of exploited CVE records to extract and score (1 to 100).

Example Input JSON

{
  "vendorKeyword": "Microsoft",
  "onlyRansomware": false,
  "maxResults": 10
}

---

Output Dataset Schema

Each run pushes structured JSON items to the default Apify Dataset with the following fields:

Field Name	Type	Description
cveId	string	CVE Identifier — Official CVE vulnerability ID.
vendorProject	string	Vendor / Project — Hardware or software vendor.
product	string	Affected Product — Specific product or appliance.
vulnerabilityName	string	Vulnerability Title — Official CISA vulnerability title.
dateAdded	string	Date Added to CISA KEV — Date added to the Known Exploited Vulnerabilities catalog.
dueDate	string	Federal Patch Deadline — Mandatory remediation deadline under CISA BOD directives.
knownRansomwareCampaignUse	string	Ransomware Campaign Use — Known or Unknown active ransomware exploitation.
cwes	string	CWE Weakness Classes — Associated Common Weakness Enumeration codes.
threatSeverityScore	integer	Threat Severity Score (0-100) — Quantitative urgency score combining active exploitation, ransomware use, and RCE/SQLi class (0-100).
requiredAction	string	Mandatory Remediation Action — CISA-mandated mitigation or patching directive.
markdownThreatBrief	string	Markdown DevSecOps & SOC2 Threat Brief — Executive Markdown advisory for MSSPs, CISOs, and automated patch pipelines.

Example Output JSON

[
  {
    "cveId": "Sample CVE Identifier",
    "vendorProject": "Sample Vendor / Project",
    "product": "Sample Affected Product",
    "vulnerabilityName": "Sample Vulnerability Title",
    "dateAdded": "Sample Date Added to CISA KEV",
    "dueDate": "Sample Federal Patch Deadline",
    "knownRansomwareCampaignUse": "Sample Ransomware Campaign Use",
    "cwes": "Sample CWE Weakness Classes",
    "threatSeverityScore": 92,
    "requiredAction": "Sample Mandatory Remediation Action",
    "markdownThreatBrief": "Sample Markdown DevSecOps & SOC2 Threat Brief"
  }
]

---

1-Click MCP Server Integration (Claude Desktop & Cursor IDE)

Add b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor as an AI Agent tool in Claude Desktop (claude_desktop_config.json) or Cursor IDE (.cursor/mcp.json):

{
  "mcpServers": {
    "cisa-kev-ransomware-vulnerability-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@apify/actors-mcp-server",
        "--actors",
        "b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor"
      ],
      "env": {
        "APIFY_TOKEN": "<YOUR_APIFY_API_TOKEN>"
      }
    }
  }
}

• Hosted Streamable HTTP MCP URL: https://mcp.apify.com/?actors=b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor

---

Automated Daily n8n Workflow Template

Download the pre-built, sanitized n8n workflow template with a daily Schedule Trigger (07:00 AM), HTTP Request node, and CRM/Slack Webhook Router:

• Direct Download (.n8n.json): cisa-kev-ransomware-vulnerability-auditor.n8n.json
• Enterprise Multi-Actor Super-Pipelines: GitHub Repository jesleytassili-glitch/b2b-quant-mcp-n8n-suite

---

Direct Stateless REST API Call (cURL Synchronous JSON)

Call this Actor synchronously as a standard HTTP POST micro-API and receive the JSON dataset array directly in the HTTP response:

curl -X POST "https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items" \
  -H "Authorization: Bearer <YOUR_APIFY_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"vendorKeyword": "Microsoft", "onlyRansomware": false, "maxResults": 10}'

---

Frequently Asked Questions (FAQ)

1. Do I need to configure residential proxies or third-party API keys?

No. b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor runs out-of-the-box with zero external API keys and zero paid proxy requirements.

2. Can I chain this Actor with other B2B compliance and lead enrichment tools?

Yes. Explore the full 25-Actor B2B Quant & Regulatory Suite at apify.com/b2b-quant-apis or import our 5 Multi-Actor Waterfall Pipelines from GitHub (jesleytassili-glitch/b2b-quant-mcp-n8n-suite).