# CISA KEV Known Exploited Vulnerabilities Scraper (`scrapers_lat/cisa-kev-exploited-vulns-scraper`) Actor

Scrape the CISA Known Exploited Vulnerabilities catalog: CVEs actively exploited in the wild. Filter by vendor, product, CVE, CWE, ransomware use, date added and due date. Enrich each CVE with EPSS score, percentile and urgency. JSON, CSV, Excel.

- **URL**: https://apify.com/scrapers\_lat/cisa-kev-exploited-vulns-scraper.md
- **Developed by:** [Scrapers Lat](https://apify.com/scrapers_lat) (community)
- **Categories:** Developer tools, Automation, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![CISA KEV Known Exploited Vulnerabilities Scraper](https://scrapers.lat/banners/cisa-kev-exploited-vulns-scraper.png)](https://console.apify.com/actors/hskavgVPtrLleXxkm/input)

## CISA KEV Known Exploited Vulnerabilities Scraper

Here is one real result, with every field the actor returns:

```json
{
  "cveID": "CVE-2021-44228",
  "vendorProject": "Apache",
  "product": "Log4j2",
  "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "shortDescription": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.",
  "requiredAction": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",
  "dateAdded": "2021-12-10",
  "dueDate": "2021-12-24",
  "daysToDueDate": -1696,
  "isOverdue": true,
  "knownRansomwareCampaignUse": "Known",
  "isRansomware": true,
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "ageInDays": 1710,
  "catalogVersion": "2026.08.14",
  "epssScore": 0.99999,
  "epssPercentile": 1,
  "epssDate": "2026-08-15",
  "exploitationLikelihood": "Very High",
  "priority": "Critical",
  "nvdCvssBaseScore": 10,
  "nvdCvssSeverity": "CRITICAL",
  "nvdCvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "nvdCwes": ["CWE-917", "CWE-20", "CWE-400", "CWE-502"],
  "nvdCpes": ["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"],
  "aiRemediationGuidance": "CVE-2021-44228 (Log4Shell) is a critical remote code execution flaw in Apache Log4j2 where attacker-controlled JNDI lookups let an unauthenticated attacker run arbitrary code. It is urgent because it is actively exploited in ransomware campaigns, carries a CVSS 10.0 and an EPSS near 1.0, and its federal remediation deadline has passed. Remediate now: upgrade Log4j2 to 2.17.1 or later, or remove affected assets from the network; where patching is blocked, remove the JndiLookup class and disable message lookups, then hunt for exploitation in logs.",
  "observedAt": "2026-08-16T11:24:32.034Z",
  "error": null
}
```

The most complete CISA KEV scraper for known exploited vulnerabilities and actively-exploited CVE threat intelligence. It returns every field the CISA Known Exploited Vulnerabilities catalog exposes for each actively exploited CVE, enriches each CVE with its EPSS exploitation-probability score and percentile, adds derived urgency fields (`isOverdue`, `daysToDueDate`, `isRansomware`, `exploitationLikelihood`, `priority`), and gives you ten filters to target exactly the vulnerabilities you need. Two optional paid add-ons go further: NVD CVSS v3.1 scoring plus affected-product CPE enrichment, and AI-written plain-English remediation guidance for each CVE.

**📥 [Input](https://apify.com/scrapers_lat/cisa-kev-exploited-vulns-scraper/input-schema) · 📤 [Output](https://apify.com/scrapers_lat/cisa-kev-exploited-vulns-scraper/output-schema) · 💰 [Pricing](https://apify.com/scrapers_lat/cisa-kev-exploited-vulns-scraper/pricing) · ▶️ [Examples](https://apify.com/scrapers_lat/cisa-kev-exploited-vulns-scraper/examples)**

![Apify](https://img.shields.io/badge/Platform-Apify-1CE1CE?logo=apify\&logoColor=white)
![Coverage](https://img.shields.io/badge/Coverage-Global-blue)
![Output](https://img.shields.io/badge/Output-JSON%20%7C%20CSV%20%7C%20Excel-orange)
![Billing](https://img.shields.io/badge/Billing-Pay%20per%20result-brightgreen)

### Table of contents

- [What it does](#what-it-does)
- [Use cases](#use-cases)
- [Quickstart](#quickstart)
- [Input reference](#input-reference)
- [Output reference](#output-reference)
- [Example output record](#example-output-record)
- [Run via API and CLI](#run-via-api-and-cli)
- [Fetch results](#fetch-results)
- [Billing and limits](#billing-and-limits)
- [FAQ and troubleshooting](#faq-and-troubleshooting)

### What it does

The actor downloads the authoritative CISA Known Exploited Vulnerabilities (KEV) catalog, the official list of CVEs that are being actively exploited in the wild and that carry US federal remediation deadlines. It applies the filters you pass as input, then writes one normalized record per matching CVE to the run's dataset.

Each record keeps every native KEV field (`cveID`, `vendorProject`, `product`, `vulnerabilityName`, `shortDescription`, `requiredAction`, `dateAdded`, `dueDate`, `knownRansomwareCampaignUse`, `cwes`, `notes`) and adds derived fields so you can prioritize without extra parsing: `daysToDueDate` (negative when overdue), `isOverdue`, `isRansomware`, `ageInDays`, and a combined `priority` label (`Critical` / `High` / `Medium` / `Low`).

When `includeEpss` is on (the default), the actor enriches each CVE with its EPSS score from FIRST.org: `epssScore` (0 to 1 probability of exploitation in the next 30 days), `epssPercentile`, `epssDate`, and an `exploitationLikelihood` label (`Very High` / `High` / `Moderate` / `Low`).

This is the actively-exploited priority subset of all CVEs. For the full CVE database with CVSS scoring, see the [NVD CVE Scraper](https://apify.com/scrapers_lat/nvd-cve-scraper).

#### Optional paid add-ons

- **NVD CVSS + CPE enrichment** (`nvdEnrich`): for each KEV CVE the actor makes an extra call to the official NVD API and adds the full CVSS v3.1 base score, severity and vector string, the NVD CWE weakness list, and the affected-product CPE match criteria that the KEV feed itself does not include. Fields: `nvdCvssBaseScore`, `nvdCvssSeverity`, `nvdCvssVector`, `nvdCwes`, `nvdCpes`.
- **AI remediation guidance** (`aiSummary`): an AI model reads the CVE context (exploitation status, ransomware use, federal due date, CVSS and EPSS) and writes a concise, plain-English `aiRemediationGuidance` paragraph covering what the vulnerability is, why it is urgent, and concrete patch or mitigation steps.

Both add-ons are opt-in (default off), billed only when they genuinely produce data, and disabled for free Apify users.

### Use cases

- Build an actively-exploited vulnerability feed for a SIEM, SOAR or threat-intelligence platform.
- Prioritize patch management and remediation against the CISA KEV known exploited vulnerabilities list with federal due dates.
- Track ransomware-linked CVEs and BlueKeep, Log4Shell and ProxyShell style remote code execution threats.
- Enrich vulnerability tickets with CVSS v3.1 scores, severity and affected-product CPEs for risk scoring.
- Generate plain-English remediation guidance for security awareness reports and executive briefings.
- Monitor a specific vendor or product (Microsoft, Cisco, Apache, Fortinet, VMware) for newly exploited CVEs.
- Feed compliance and audit workflows that must evidence remediation of known exploited vulnerabilities.
- Alert on overdue federal remediation deadlines and upcoming due dates across your asset inventory.

### Quickstart

Open the actor, paste this into the input, and press Run. It returns the 10 newest KEV entries used in ransomware campaigns, enriched with EPSS.

```json
{
  "ransomwareOnly": true,
  "includeEpss": true,
  "sortBy": "priority",
  "maxResults": 10
}
```

Every input field is optional. With an empty input the actor returns the most recently added KEV entries (newest first), enriched with EPSS.

### Input reference

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `vendor` | string | no | (empty) | Filter by vendor or project, case-insensitive contains match on `vendorProject`, for example `Microsoft`, `Cisco`, `Apache`. |
| `product` | string | no | (empty) | Filter by product, case-insensitive contains match on `product`, for example `Windows`, `Exchange Server`, `Log4j`. |
| `cveId` | string\[] | no | (empty) | One or more exact CVE IDs, for example `["CVE-2021-44228"]`. Returns only these CVEs if present in the KEV catalog. |
| `cwe` | string | no | (empty) | Keep only CVEs whose weakness list contains this CWE, for example `CWE-502`. |
| `ransomwareOnly` | boolean | no | `false` | Only include CVEs known to be used in ransomware campaigns (`knownRansomwareCampaignUse` = `Known`). |
| `addedFrom` | string | no | (empty) | Include CVEs added to the catalog on or after this date (`YYYY-MM-DD`). |
| `addedTo` | string | no | (empty) | Include CVEs added to the catalog on or before this date (`YYYY-MM-DD`). |
| `dueBefore` | string | no | (empty) | Include CVEs with a federal remediation due date on or before this date (`YYYY-MM-DD`). Useful for overdue or upcoming deadlines. |
| `includeEpss` | boolean | no | `true` | Enrich each CVE with its EPSS score, percentile and likelihood label. |
| `nvdEnrich` | boolean | no | `false` | Paid add-on ($0.012/CVE). Extra NVD API call adding CVSS v3.1 base score, severity, vector, CWE list and affected-product CPEs. Charged only when NVD returns the CVE. Disabled for free users. |
| `aiSummary` | boolean | no | `false` | Paid AI add-on ($0.012/CVE). Writes a plain-English remediation guidance paragraph per CVE. Charged only on usable AI output. Disabled for free users. |
| `sortBy` | enum | no | `dateAdded` | Sort order: `dateAdded` (newest first), `dueDate` (soonest first), `epssScore` (highest first), or `priority` (highest first). |
| `maxResults` | integer | no | `50` | Maximum number of CVEs to collect. Free Apify plans are capped at 10 per run. |
| `proxyConfiguration` | object | no | (none) | Standard Apify proxy configuration. Not required; the sources are open and not bot protected. |

Filters combine with logical AND. With no filters, the actor returns the whole catalog sorted newest first (subject to `maxResults`).

### Output reference

One dataset item per CVE. Types: `string`, `number`, `boolean`, `string[]`, or `null` when the value is absent.

| Field | Type | Description |
|---|---|---|
| `cveID` | string | CVE identifier, for example `CVE-2021-44228`. |
| `vendorProject` | string | Vendor or project name. |
| `product` | string | Affected product. |
| `vulnerabilityName` | string | CISA's name for the vulnerability. |
| `shortDescription` | string | Short description of the vulnerability. |
| `requiredAction` | string | The remediation action CISA requires. |
| `dateAdded` | string | Date the CVE was added to the KEV catalog (`YYYY-MM-DD`). |
| `dueDate` | string | Federal remediation due date (`YYYY-MM-DD`), or `null`. |
| `daysToDueDate` | number | Days from today to the due date. Negative means overdue. |
| `isOverdue` | boolean | True when the due date is in the past. |
| `knownRansomwareCampaignUse` | string | Raw KEV value, `Known` or `Unknown`. |
| `isRansomware` | boolean | True when `knownRansomwareCampaignUse` is `Known`. |
| `cwes` | string\[] | CWE weakness identifiers associated with the CVE. |
| `notes` | string | Reference URLs or notes from CISA. |
| `ageInDays` | number | Days since the CVE was added to the catalog. |
| `catalogVersion` | string | Version of the KEV catalog this record came from. |
| `epssScore` | number | EPSS probability of exploitation (0 to 1). Present when `includeEpss` is on and EPSS has the CVE. |
| `epssPercentile` | number | EPSS percentile rank (0 to 1). |
| `epssDate` | string | Date the EPSS score was computed. |
| `exploitationLikelihood` | string | Label derived from `epssScore`: `Very High` (>= 0.9), `High` (>= 0.5), `Moderate` (>= 0.1), else `Low`. |
| `priority` | string | Combined urgency label from ransomware use, overdue status and EPSS: `Critical`, `High`, `Medium`, `Low`. |
| `nvdCvssBaseScore` | number | NVD add-on: CVSS v3.1 base score (0 to 10). Present when `nvdEnrich` is on and NVD scores the CVE. |
| `nvdCvssSeverity` | string | NVD add-on: CVSS v3.1 severity (`LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). |
| `nvdCvssVector` | string | NVD add-on: CVSS v3.1 vector string. |
| `nvdCwes` | string\[] | NVD add-on: CWE weakness identifiers from NVD. |
| `nvdCpes` | string\[] | NVD add-on: affected-product CPE match criteria. |
| `aiRemediationGuidance` | string | AI add-on: plain-English remediation guidance paragraph. Present when `aiSummary` is on and the model returns usable output. |
| `observedAt` | string | ISO timestamp when the record was produced. |
| `error` | string | Error message for the record, or `null`. |

### Example output record

```json
{
  "cveID": "CVE-2019-0708",
  "vendorProject": "Microsoft",
  "product": "Remote Desktop Services",
  "vulnerabilityName": "Microsoft Remote Desktop Services Remote Code Execution Vulnerability",
  "shortDescription": "Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.",
  "requiredAction": "Apply updates per vendor instructions.",
  "dateAdded": "2021-11-03",
  "dueDate": "2022-05-03",
  "daysToDueDate": -1566,
  "isOverdue": true,
  "knownRansomwareCampaignUse": "Known",
  "isRansomware": true,
  "cwes": ["CWE-416"],
  "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-0708",
  "ageInDays": 1747,
  "catalogVersion": "2026.08.14",
  "epssScore": 0.99999,
  "epssPercentile": 0.99999,
  "epssDate": "2026-08-15",
  "exploitationLikelihood": "Very High",
  "priority": "Critical",
  "observedAt": "2026-08-16T11:24:32.034Z",
  "error": null
}
```

### Run via API and CLI

Start a run with the Apify API:

```bash
curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~cisa-kev-exploited-vulns-scraper/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"vendor":"Microsoft","ransomwareOnly":true,"sortBy":"priority","maxResults":25}'
```

Run with the Apify CLI:

```bash
apify call scrapers_lat/cisa-kev-exploited-vulns-scraper \
  --input='{"cveId":["CVE-2021-44228"],"includeEpss":true}'
```

### Fetch results

Every run writes to its own dataset. Fetch the items as JSON:

```bash
curl "https://api.apify.com/v2/datasets/DATASET_ID/items?clean=true&format=json&token=YOUR_APIFY_TOKEN"
```

Swap `format=csv` or `format=xlsx` for spreadsheet output. The run response and the console both give you the dataset id.

### Billing and limits

- Billing is pay per result. You are charged for each CVE record written to the dataset, at the price shown on the actor's [pricing page](https://apify.com/scrapers_lat/cisa-kev-exploited-vulns-scraper/pricing).
- Optional NVD add-on (`nvd_enrich`, $0.012 per CVE): opt-in, off by default. Charged only when the extra NVD API call genuinely returns CVSS or CPE data for the CVE. Disabled for free users.
- Optional AI add-on (`ai_summary`, $0.012 per CVE): opt-in, off by default. Uses AI to write remediation guidance and is charged only when the model returns usable output. Disabled for free users.
- Free Apify plans are capped at 10 results per run, and both paid add-ons are disabled for free users. Upgrade for larger pulls and add-ons.
- No charge on failure. If the KEV download fails, no billable results are produced.
- EPSS enrichment is best effort and fails open: if the EPSS API is unavailable, you still get the full KEV records, just without the `epssScore`, `epssPercentile`, `epssDate` and `exploitationLikelihood` fields.
- A spend guard honors your `maxTotalChargeUsd` setting and stops emitting billable results once the limit is reached.

### FAQ and troubleshooting

**How is this different from a full CVE scraper?** The KEV catalog is the small, authoritative subset of CVEs that CISA has confirmed are being actively exploited in the wild, each with a federal remediation deadline. It is the priority-patch list, not the full CVE database.

**What is EPSS?** The Exploit Prediction Scoring System (from FIRST.org) estimates the probability that a CVE will be exploited in the next 30 days. `epssScore` is that probability (0 to 1); `epssPercentile` ranks it against all scored CVEs.

**How current is the data?** The catalog carries a `catalogVersion` and CISA updates it regularly. Each record includes the version it came from and an `observedAt` timestamp.

**Why is a CVE missing an EPSS score?** Either `includeEpss` was off, or EPSS has no score for that CVE yet. The KEV fields are still returned.

**Can I get only overdue vulnerabilities?** Set `dueBefore` to today's date; every returned record with a `dueDate` will be at or before it, and `isOverdue` will be `true` for past deadlines.

### More scrapers at scrapers.lat

- [NVD CVE Scraper](https://apify.com/scrapers_lat/nvd-cve-scraper) for the full CVE database with CVSS scoring.

# Actor input Schema

## `vendor` (type: `string`):

Filter by the vendor or project name, for example Microsoft, Cisco or Apache. Case-insensitive contains match against vendorProject.

## `product` (type: `string`):

Filter by product name, for example Windows, Exchange Server or Log4j. Case-insensitive contains match against product.

## `cveId` (type: `array`):

One or more exact CVE IDs, for example CVE-2021-44228. Returns only these CVEs if present in the KEV catalog.

## `cwe` (type: `string`):

Filter to CVEs whose weakness list contains this CWE, for example CWE-79 or CWE-502.

## `ransomwareOnly` (type: `boolean`):

Only include CVEs known to be used in ransomware campaigns (knownRansomwareCampaignUse = Known).

## `addedFrom` (type: `string`):

Only include CVEs added to the KEV catalog on or after this date (YYYY-MM-DD).

## `addedTo` (type: `string`):

Only include CVEs added to the KEV catalog on or before this date (YYYY-MM-DD).

## `dueBefore` (type: `string`):

Only include CVEs with a federal remediation due date on or before this date (YYYY-MM-DD). Useful for overdue or upcoming deadlines.

## `includeEpss` (type: `boolean`):

Enrich each CVE with its EPSS exploitation-probability score, percentile and a likelihood label. Adds a few network calls.

## `nvdEnrich` (type: `boolean`):

Opt-in paid add-on ($0.012 per CVE). For each KEV CVE, make an extra call to the NVD API to add the full CVSS v3.1 base score, vector and severity, the CWE weakness list and the affected-product CPE match list that the KEV feed itself does not include. Charged only when NVD returns the vulnerability. Disabled for free Apify users.

## `aiSummary` (type: `boolean`):

Opt-in AI paid add-on ($0.012 per CVE). Uses AI (OpenRouter gpt-4o-mini) to write a concise plain-English remediation guidance paragraph: what the vulnerability is, why it is urgent given active exploitation and the federal due date, and concrete patch or mitigation steps. Charged only when usable AI output is produced. Disabled for free Apify users.

## `sortBy` (type: `string`):

Sort order of the results.

## `maxResults` (type: `integer`):

Maximum number of CVEs to collect. Free Apify plans are capped at 10 per run.

## `proxyConfiguration` (type: `object`):

Optional. The KEV catalog and EPSS API are open and need no proxy, but you can route requests through an Apify proxy if you prefer.

## Actor input object example

```json
{
  "ransomwareOnly": false,
  "includeEpss": true,
  "nvdEnrich": false,
  "aiSummary": false,
  "sortBy": "dateAdded",
  "maxResults": 50,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxResults": 50
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapers_lat/cisa-kev-exploited-vulns-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxResults": 50 }

# Run the Actor and wait for it to finish
run = client.actor("scrapers_lat/cisa-kev-exploited-vulns-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxResults": 50
}' |
apify call scrapers_lat/cisa-kev-exploited-vulns-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapers_lat/cisa-kev-exploited-vulns-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/hskavgVPtrLleXxkm/builds/0dQyLXzqFusdBlhg2/openapi.json