Dataset · cisa-kev

CISA KEV catalog for AI agents

CISA Known Exploited Vulnerabilities catalog entries synced for prioritization alongside NVD data.

This product uses the NVD API but is not endorsed or certified by the NVD.

What it is

CISA KEV records synced from Cybersecurity and Infrastructure Security Agency into the Open District event store for MCP and read-only SQL.

Freshness

Source	Health	Last sync (UTC)	Cadence	Lag
`cisa-kev`	ok	2026-10-17 06:45:28+00:00	45 6 * * *	21076s

Live status: GET /sources/health

License and attribution

US federal public domain; CISA KEV catalog terms apply to upstream use. License reference

Connect

Canonical MCP endpoint https://api.opendistrict.org/mcp (legacy https://mcp.opendistrict.org/mcp). A free API key is required — Authorization: Bearer $OD_API_KEY. Mint a key after signup. See MCP quickstart, pricing, and openapi.yaml.

{
  "mcpServers": {
    "opendistrict": {
      "url": "https://api.opendistrict.org/mcp",
      "headers": {
        "Authorization": "Bearer $OD_API_KEY"
      }
    }
  }
}

Sample requests

MCP `tools/call` (run_sql)

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "run_sql",
    "arguments": {
      "sql": "SELECT event_type, created_at, source_id FROM events WHERE event_type = 'security.kev' LIMIT 20"
    }
  }
}

SQL

SELECT event_type, created_at, source_id FROM events WHERE event_type = 'security.kev' LIMIT 20

Example agent prompts

Which KEV entries were added this week?
Cross-check KEV CVEs against your asset inventory.

Related joins

/joins/nvd-kev-epss

FAQ

Is this the official CISA list?

Rows are synced from CISA's Known Exploited Vulnerabilities catalog with citations.