# CISA KEV CVE Batch Lookup (`datalantern/cisa-kev-lookup`) Actor

Compare supplied CVE identifiers with a dated CISA KEV catalog snapshot; export status and provenance.

- **URL**: https://apify.com/datalantern/cisa-kev-lookup.md
- **Developed by:** [Data Lantern](https://apify.com/datalantern) (community)
- **Categories:** Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 completed cve lookups

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA KEV CVE Batch Lookup

### What can this tool do?

Compare an existing list of CVE identifiers with a dated snapshot of CISA's Known Exploited Vulnerabilities catalog. Receive a traceable JSON/CSV row per unique input identifier.

### How to use it

```json
{"cves":["CVE-2021-44228","CVE-2017-0144"],"maxAgeDays":14,"maxResults":20,"maxRequests":1}
```

Accepts up to 100 syntactically valid CVE identifiers. Case differences and duplicate identifiers are normalized. A malformed identifier rejects the input before a source request.

The catalog is downloaded once per run from CISA's own official GitHub mirror. Each row contains matched or not_in_catalog status, available vendor/product/date and required-action text from the source, catalog version/date, check time, source URL, license and a SHA256 checksum. hashScope explicitly identifies the checksum as JSON.stringify of the parsed source object.

**not_in_catalog does not mean safe, not exploited or applicable to your assets.** It does not establish that the supplied CVE exists. This is a catalog lookup, not an asset scanner, security certification, severity score, remediation decision or exploit retrieval tool. No input CVE list is sent to the source; the run downloads the catalog and compares locally.

### Freshness and failure

The default maximum catalog age is 14 days, configurable from 1 to 30. A stale, future-dated, inconsistent or unavailable catalog stops the run rather than returning false absence. The official mirror can lag the canonical CISA catalog. This is not real-time monitoring. A resumed run can read a newer snapshot; omit CHECKPOINT to recheck all identifiers.

### Pricing

$1.00 per 1,000 completed CVE lookups ($0.001 each), plus $0.00005 when a run starts at the supported 256–512 MB memory range. Both matched and not_in_catalog are completed lookups and have the same fee. A source failure produces no lookup rows; the start fee can still apply. Set a spending limit before running.

### Is it legal?

Official mirror and its CC0 license: https://github.com/cisagov/kev-data

Linked third-party material has its own terms and is not fetched. This independent tool is not endorsed by CISA or DHS.

### What data does it return?

Results are written to the Apify dataset. OUTPUT reports whether the export completed and why it stopped. RESULTS_CSV contains the rows delivered in this run. CHECKPOINT can continue with the same source inputs; omit it for a fresh export.

Requests are sequential within a run, restricted to the documented source, and bounded by timeout, response size, request count and output count. There are no automatic retries, proxy rotations or redirect fallbacks. Source failures are reported separately from an empty or absent result.

Continuation is best effort. A crash between delivery and checkpoint persistence can repeat rows; the source can change between runs. This is not an immutable snapshot, exactly-once delivery or monitoring. CSV text that could be interpreted as a spreadsheet formula is prefixed with an apostrophe.

### FAQ

**Can I use the original source for free?** Yes. The Actor fee pays for the packaged batch workflow and Apify delivery, not exclusive access to the public source.

**Does a completed export prove the source is complete or correct?** No. Read the stated coverage, status, source dates and limitations before relying on a row.

### Feedback

Use the Actor's Issues tab for a reproducible problem. Include a small public example, OUTPUT and the expected result. Do not post tokens, confidential inventories or customer data in a public issue. Report upstream data errors to the original provider.

# Actor input Schema

## `cves` (type: `array`):

Up to100 supplied CVE identifiers, normalized and deduplicated before requesting the official catalog.

## `maxAgeDays` (type: `integer`):

Reject older catalog snapshots rather than treating their absent identifiers as current absence. The official mirror can lag.

## `maxResults` (type: `integer`):

Maximum completed lookup rows delivered in this run.

## `maxRequests` (type: `integer`):

This Actor reads the fixed catalog once per non-completed run.

## `checkpoint` (type: `object`):

Continue a partial export with the same input list. Omit it to recheck every identifier against the current snapshot.

## Actor input object example

```json
{
  "cves": [
    "CVE-2021-44228",
    "CVE-2017-0144"
  ],
  "maxAgeDays": 14,
  "maxResults": 20,
  "maxRequests": 1
}
```

# Actor output Schema

## `records` (type: `string`):

No description

## `csv` (type: `string`):

No description

## `summary` (type: `string`):

No description

## `checkpoint` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("datalantern/cisa-kev-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("datalantern/cisa-kev-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call datalantern/cisa-kev-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,datalantern/cisa-kev-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/CeYLvwrruks07Y0Z7/builds/SBxbGz5BKoze6yhsv/openapi.json