# CISA KEV on looot

CISA KEV gives your agent one job through looot: list vulnerabilities known to be exploited. 1 endpoint runs today, some of them free.

## At a glance

- Category: Security
- Access: No key needed: these endpoints are open, looot calls them for you
- Price: some free

## Choose it when

- You need to list vulnerabilities known to be exploited: CISA KEV is the only provider on looot that runs this job today.
- You want to start without any key: some of its endpoints are open and looot calls them for you.

## Endpoints and jobs

| Endpoint | Job | Price | Runs (30 days) | Benchmark |
|---|---|---|---|---|
| [List known exploited vulnerabilities (KEV catalog)](/public-catalog/cisa-kev-catalog) | `vuln.exploited.list` | free | 100% of 25 runs without an error, median 122 ms | no benchmark yet |

## How the numbers are measured

Run numbers are looot's own runs of each endpoint over the last 30 days: the share that completed without an error, and the median time to answer. An endpoint with fewer than 10 runs in that window shows "not enough runs to rank" and is never ranked. Prices are what looot charges per call or per result, fee included, read from the live catalog; you prepay credit and each call is charged when it runs.

Read 2026-11-10 23:22 UTC.

## For agents

The minimal request for List known exploited vulnerabilities (KEV catalog) (`cisa-kev-catalog`). Replace each <placeholder> with your value and send a new idempotency key per run.

### MCP

```json
{
  "endpointId": "cisa-kev-catalog",
  "input": {},
  "idempotencyKey": "<a new id per run>"
}
```

### REST

```bash
curl -X POST https://api.looot.ai/v1/runs \
  -H "Authorization: Bearer $LOOOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"endpointId":"cisa-kev-catalog","input":{},"idempotencyKey":"<a new id per run>"}'
```

### CLI

```bash
looot run cisa-kev-catalog --input '{}'
```