# US CTI Threats — agent instructions

Service ID: `nb:us-cti-threats` · version 0.3.2 · status **Beta** · consumable: **true**

Beta US cyber threat intelligence: query CISA Known Exploited Vulnerabilities (KEV), NIST NVD API 2.0 CVSS/CWE/CPE enrichment, and defanged abuse.ch ThreatFox & URLhaus indicators through an evidence-backed REST API.

## Does not do
- all cyber threat intelligence
- operational security guidance
- real-time IOC ingestion

## Free REST demo workflow
1. For an exact CVE ID, call `GET https://api.niftibot.com/v1/cti/vulnerabilities/{cve_id}?payment=false`. For keyword search, call `GET https://api.niftibot.com/v1/cti/vulnerabilities/search?q={keyword}&payment=false`.
2. Do not sign, send, or request a payment for these demo calls. The response contains `payment.required: false` and `payment.mode: free_demo`; the server also returns `X-Payment-Mode: free-demo`. The demo is rate-limited to five calls per minute per client IP.
3. Return the complete JSON envelope with CISA KEV status, NIST NVD CVSS/CWE/CPE enrichment, threat verdict and markers, defanged abuse.ch IOCs, per-source status, provenance URI and retrieval time, and US-PD-CC0 licence.
4. All network observables are defanged on ingest and output; treat them as data, not operational security guidance.
5. Stripe checkout (`POST /v1/cti/credits/checkout`) and prepaid credits (`uscti_test_...`) are test mode only ($5 USD for 1,000 credits).

## Connection
- Endpoint: https://api.niftibot.com
- Transport: http-rest
- Auth: none
- Manifest: /manifests/us-cti-threats/0.3.2.json

## Tools

| Tool | Built | Read-only | Price |
|---|---|---|---|
| `cti_search_events` | yes | yes | 0.005 USDC per call [x402-exact, not approved] |
| `cti_get_vulnerability` | yes | yes | 0.01 USDC per call [x402-exact, not approved] |
| `cti_screen` | yes | yes | 0.01 USDC per call [x402-exact, not approved] |
| `cti_get_evidence` | yes | yes | 0.02 USDC per document [x402-exact, not approved] |

## Data
- Coverage: CISA Known Exploited Vulnerabilities (KEV) enriched with NIST NVD API 2.0 CVSS/CWE/CPE profiles (plus live NVD fallback for non-KEV CVEs) and CVE-linked defanged ThreatFox and URLhaus indicators.
- Freshness: CISA KEV is polled hourly, abuse.ch feeds every 10 minutes, and NVD profiles are hydrated continuously with a 2-hour modified-since delta and live lookup fallback.
- Document schema: `us-cti-threat-event/v1`
- Sources:
  - CISA KEV Catalog (CC0)
  - NIST NVD (US public domain)
  - ThreatFox (CC0)
  - URLhaus (CC0)

## Limitations
- empty_result_charged=true for search calls
- no real-time IOC ingestion; all network observables are defanged on ingest and output
- Stripe checkout accepts test cards only; the $5 test pack grants 1,000 service credits and does not represent live commercial pricing
- The payment=false REST preview is unauthenticated and rate-limited to five calls per minute per client IP

## Rights
- Status: open_data
- Attribution: CISA (CC0)
- Attribution: NIST NVD (US public domain)
- Attribution: ThreatFox (CC0)
- Attribution: URLhaus (CC0)

## Open readiness blockers
- Stripe checkout and prepaid credits are in test mode; live payments and commercial pricing are not enabled
- REST demo is rate-limited to five calls per minute per client IP

See also: /agents/payments.md · /agents/security.md · /agents/licensing.md