Security x402 offerings

Vulnerability intelligence for a single CVE id. Fuses NVD (CVSS base score and vector, CWE, patch links), CISA KEV known-exploited status, EPSS exploitation probability and OSV.dev affected and fixed versions into one cited JSON with a deterministic patch-priority score. Risk indicators, not advice.

Vulnerability scan for a software package by ecosystem, name and version, or by package-URL (purl). Queries OSV.dev for known advisories, collects their CVE ids and enriches them with NVD CVSS, CISA KEV and EPSS, then returns a prioritized list of advisories with exact fixed versions. Risk indicators, not advice.

Ransomware-group threat brief and tracking — victim patterns, TTPs, ransom economics, and defensive playbooks across LockBit, ALPHV, Cl0p, RansomHub, BlackBasta, Akira, and 50+ active groups, plus CISA KEV ransomware-linked CVEs. Global, for threat-intel and incident-response agents.

Threat-intelligence brief for any industry and region — active threat-actor campaigns, TTPs, nation-state APTs, eCrime/ransomware operators, and MITRE ATT&CK mapping, with recent CISA KEV and GDELT-scored news coverage. Worldwide sector-specific context, for threat-intel and SOC agents.

CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachable" — never a false not-found.

CISA Known Exploited Vulnerabilities (KEV) lookup and patch prioritization. Filter the KEV catalog by vendor, product, or time range; returns ransomware-linked flags, CISA federal due dates, CVSS, and patch priority. Updated daily, for vuln-management and security agents.

Dark-web monitoring for any brand or domain — paste-site mentions, credential-dump signals, forum chatter, ransomware leak-site activity, brand impersonation, and initial-access-broker listings, for threat-intel and brand-protection agents. Ethical OSINT only.

External attack-surface assessment (EASM) for any company and domain — internet-exposed assets, tech-stack fingerprinting, email-security posture, supply-chain and identity exposure, and a prioritized remediation roadmap, for security and red-team-context agents. Authorized defensive use only.

Data-breach lookup and credential-exposure check for any domain. Surfaces known data breaches, credential dumps, dark-web signals, and regulatory notification duties (GDPR, CCPA, PDPA, LGPD, POPIA), for security and compliance agents. Authorized security use only.

CVE lookup and severity brief for any CVE ID — CVSS score, exploit / CISA KEV / active-exploitation / PoC status, affected products, patch urgency, and remediation steps. Authoritative NVD + CISA data plus threat-intel context, for security and vuln-management agents.

OSINT lookup for any domain or IP — open ports and known CVEs (Shodan InternetDB), DNS and email posture (SPF/DMARC/DKIM), SSL grade, threat-feed status, and geolocation, for security and defensive agents. Authorized defensive use only.

Cyre Lookalike — before your agent sends funds, check whether the destination looks like one of your known contacts (prefix/suffix traps, near-edits, confusable chars). Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Settlement Caution — before you settle, get a pattern brief + withhold-style band for payTo/amount/URL. Not insurance. Not custody. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Intent Lockbox — seal your intentHash before you pay so any party can later prove the hash was locked pre-settle. Bearer holds the token. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre address profile — explainable on-chain risk signals. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Session Ticket — require a fresh Passport or Decision Receipt before your agent proceeds. Checks signature, expiry, max age, optional address + risk ceiling. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Passport — signed, expiring attestation of an address's measured risk profile. Present it to any counterparty; verify free at /api/passport/verify. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Decision Receipt — seal an intent hash, the signals you saw, and the action you took into a signed audit receipt. Verify free at /api/receipt/verify. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Pay-route Oracle — before your agent pays any external x402 resource, grade payTo + amount/URL + facilitator/offer pin hygiene in one call. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Policy Check — test a proposed pay (amount, host, network, risk) against a sealed spend-policy token. Returns ok + reasons. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Lockbox Match — check a proposed pay against a sealed pre-pay lockbox (intentHash + optional pins). Catch bait-and-switch. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Gate — before your agent pays ANY other x402 service, grade the payTo counterparty + spend shape in one cheap call. Patterns, not verdicts. Agent guide: use before non-Cyre awal x402 pay. Agent guide: https://cyre.dev/SKILL.md

Cyre Intent Seal — hash your intent locally, seal it before you pay or sign, then match it on /api/receipt. Stops bait-and-switch. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Cyre Pulse Stream — seal up to 10 counterparty watches into a signed subscription token. Pull events via /api/stream/events; fingerprints travel in the token (serverless-safe). Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md