# Kevscope API by CyberMax

> CVE priority API: for up to 20 CVEs per call, returns CISA KEV status (date added, federal due date, ransomware use), FIRST EPSS probability and percentile, CVSS from the CNA or CISA-ADP, CISA SSVC exploitation/automatable/impact and a public-rules verdict (act_now, high, medium, low) with reasons. Also recent KEV additions and a pre-KEV EPSS watchlist. REST + MCP server.

Send up to 20 CVE IDs and get a patch-priority verdict for each, with the evidence behind it: CISA KEV status and due date, ransomware use, FIRST EPSS, CVSS and CISA's SSVC exploitation call. For security teams, MSPs, scanners and AI agents. Free tier, no key; plans from $19/month.

## API (free tier without a key; paid API keys for more)
- [/api/priority](https://kevscope-api.cybermax-tools.workers.dev/api/priority?cve=CVE-2024-3400,CVE-2024-6387,CVE-2019-0001): Patch-priority verdict for up to 20 CVEs, with evidence
- [/api/kev/recent](https://kevscope-api.cybermax-tools.workers.dev/api/kev/recent?days=14): CVEs added to CISA KEV in the last N days, with EPSS
- [/api/watchlist](https://kevscope-api.cybermax-tools.workers.dev/api/watchlist?limit=10): Early warning: highest-EPSS CVEs that are not in CISA KEV yet
- GET for simple calls, POST a JSON body for lists. Same field names as the bulk version's dataset records.
- OpenAPI 3.1: https://kevscope-api.cybermax-tools.workers.dev/openapi.json

## MCP (remote, streamable HTTP, no auth)
- Endpoint: https://kevscope-api.cybermax-tools.workers.dev/mcp
- `cve_priority`: Patch-priority verdict for 1-20 CVE IDs with evidence: CISA KEV status (date added, due date, ransomware use), FIRST EPSS probability, CVSS (CNA or CISA-ADP), CISA SSVC exploitation/automatable/impact, vendor, product and links. Sorted most urgent first.
- `kev_recent`: CVEs added to the CISA Known Exploited Vulnerabilities catalog in the last N days, newest first, with due date, ransomware use and EPSS. Optional vendor/product text filter.
- `epss_watchlist`: The highest-EPSS CVEs (most likely to be exploited in 30 days) that are not in CISA KEV yet. Defaults to this year's CVE IDs.

## Limits
- Up to 20 CVEs per call; 10 calls a minute per IP on the free tier.
- Free tier: 200 calls a day per IP, no key. Paid keys from $19/month (see Get an API key).
- Sources are asked live and cached up to 1 hour: CVE Program records (incl. CISA-ADP), FIRST EPSS (updated daily) and the CISA KEV catalog.
- The verdict is a transparent rule set on public data, not a guarantee; your own exposure and compensating controls still decide.

## More
- Health: https://kevscope-api.cybermax-tools.workers.dev/health
- All CyberMax tools: https://cybermax-tools-cybermax.static.hf.space/
- Loop over longer lists 20 CVEs at a time: a key covers thousands of calls a month. For a Monday summary instead of an API, the Exploited Vulnerabilities Brief (weekly edition) is on the CyberMax hub.

## Pricing
- Free: 200 calls a day per IP, 10/min, no key.
- Analyst: $19/month, 10,000 calls a month, 30/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/analyst?s=llms
- Team: $49/month, 50,000 calls a month, 60/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/team?s=llms
- SOC: $99/month, 150,000 calls a month, 120/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/soc?s=llms
- Pay as you go: $5, 2,000 calls (one-time pack, no expiry), 30/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/payg?s=llms
- Analyst yearly: $190/year, 10,000 calls a month, 30/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/analyst-yearly?s=llms
- Team yearly: $490/year, 50,000 calls a month, 60/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/team-yearly?s=llms
- SOC yearly: $990/year, 150,000 calls a month, 120/min. Buy: https://kevscope-api.cybermax-tools.workers.dev/buy/soc-yearly?s=llms
- Using several CyberMax APIs? CyberMax API All-Access: one key for all 9 APIs (this one included, 10,000 calls a month here) for $119/month. https://api-all-access.cybermax-tools.workers.dev/
- Use the key as `x-api-key: KEY` or `Authorization: Bearer KEY` (MCP too). Usage: https://kevscope-api.cybermax-tools.workers.dev/key. Machine-readable: https://kevscope-api.cybermax-tools.workers.dev/pricing.json