{"artifacts":{"agent_instructions":"/agents/services/us-cti-threats.md"},"connection":{"auth":"none","endpoint":"https://api.niftibot.com","openapi":"https://api.niftibot.com/v1/cti/openapi.json","transport":"http-rest"},"data":{"coverage":"CISA Known Exploited Vulnerabilities (KEV) enriched with NIST NVD API 2.0 CVSS/CWE/CPE profiles (plus live NVD fallback for non-KEV CVEs) and CVE-linked defanged ThreatFox and URLhaus indicators.","document_schema":"us-cti-threat-event/v1","freshness":"CISA KEV is polled hourly, abuse.ch feeds every 10 minutes, and NVD profiles are hydrated continuously with a 2-hour modified-since delta and live lookup fallback.","limitations":["empty_result_charged=true for search calls","no real-time IOC ingestion; all network observables are defanged on ingest and output","Stripe checkout accepts test cards only; the $5 test pack grants 1,000 service credits and does not represent live commercial pricing","The payment=false REST preview is unauthenticated and rate-limited to five calls per minute per client IP"],"sources":[{"licence":"CC0","name":"CISA KEV Catalog"},{"licence":"US public domain","name":"NIST NVD"},{"licence":"CC0","name":"ThreatFox"},{"licence":"CC0","name":"URLhaus"}]},"identity":{"categories":["cyber-threat-intel"],"excludes":["all cyber threat intelligence","operational security guidance","real-time IOC ingestion"],"publisher":"Niftibot","service_id":"nb:us-cti-threats","service_version":"0.3.2","slug":"us-cti-threats","summary":"Beta US cyber threat intelligence: query CISA Known Exploited Vulnerabilities (KEV), NIST NVD API 2.0 CVSS/CWE/CPE enrichment, and defanged abuse.ch ThreatFox & URLhaus indicators through an evidence-backed REST API.","title":"US CTI Threats"},"lifecycle":{"blockers":["Stripe checkout and prepaid credits are in test mode; live payments and commercial pricing are not enabled","REST demo is rate-limited to five calls per minute per client IP"],"consumable":true,"effective_from":"2026-11-03","status":"beta"},"manifest_version":"niftibot-service-manifest/v1","payments":{"prices":{"changes":{"amount":"0.005","approved":false,"profile":"x402-base","unit":"call"},"evidence":{"amount":"0.02","approved":false,"profile":"x402-base","unit":"document"},"search":{"amount":"0.005","approved":false,"profile":"x402-base","unit":"call"},"vulnerability":{"amount":"0.01","approved":false,"profile":"x402-base","unit":"call"}},"profiles":[{"environment":"sandbox","id":"stripe-test-credits","rail":"ground-truth-prepaid"},{"asset":"USDC","environment":"testnet","facilitator":"Coinbase CDP","id":"x402-base","network":"eip155:84532","rail":"x402-exact"},{"environment":"none","id":"free-preview","rail":"free"}]},"rights":{"attribution":["CISA (CC0)","NIST NVD (US public domain)","ThreatFox (CC0)","URLhaus (CC0)"],"status":"open_data"},"tools":[{"description":"Search CISA KEV + NVD vulnerabilities by keyword, vendor, product, severity band, or remediation state (GET /v1/cti/vulnerabilities/search).","implemented":true,"name":"cti_search_events","price_ref":"search","readonly":true},{"description":"Retrieve one CVE profile with CISA KEV status, NIST NVD CVSS/CWE/CPE enrichment (with live NVD fallback for non-KEV CVEs), threat verdict, events, and defanged IOCs (GET /v1/cti/vulnerabilities/{cve_id}).","implemented":true,"name":"cti_get_vulnerability","price_ref":"vulnerability","readonly":true},{"description":"Resolve a CVE ID or unique vendor/product keyword to a CVE profile, threat verdict, and defanged IOCs (GET /v1/cti/screen). Ambiguous keywords require an explicit 1-based candidate pick.","implemented":true,"name":"cti_screen","price_ref":"vulnerability","readonly":true},{"description":"Retrieve provenance-bearing us-cti-threat-event/v1 evidence documents with source URIs and SHA-256 hashes (GET /v1/cti/vulnerabilities/{cve_id}/evidence).","implemented":true,"name":"cti_get_evidence","price_ref":"evidence","readonly":true}]}