# NVD (NIST) on looot

NVD (NIST) gives your agent 4 jobs through looot: search CVEs by keyword, product or date, get a CVE record by its id, get the change history of a CVE and 1 more job. 4 endpoints run today, some of them free.

## At a glance

- Category: Security
- Access: No key needed: these endpoints are open, looot calls them for you
- Price: some free

## Choose it when

- You need to search CVEs by keyword, product or date: NVD (NIST) is the only provider on looot that runs this job today.
- You need to get a CVE record by its id: NVD (NIST) is the only provider on looot that runs this job today.
- You need to get the change history of a CVE: NVD (NIST) is the only provider on looot that runs this job today.
- You need to check whether a CVE is known to be exploited: NVD (NIST) is the only provider on looot that runs this job today.
- You want to start without any key: some of its endpoints are open and looot calls them for you.

## Endpoints and jobs

| Endpoint | Job | Price | Runs (30 days) | Benchmark |
|---|---|---|---|---|
| [Search CVEs](/public-catalog/nvd-cve-search) | `vuln.cve.search` | free | 96.4% of 221 runs without an error, median 272 ms | no benchmark yet |
| [CVE Record](/public-catalog/nvd-cve-get) | `vuln.cve.get` | free | 91.8% of 49 runs without an error, median 359 ms | no benchmark yet |
| [CVE Change History](/public-catalog/nvd-cve-history) | `vuln.cve.history` | free | not enough runs to rank | no benchmark yet |
| [Known Exploited Check](/public-catalog/nvd-exploited-check) | `vuln.exploited.check` | free | not enough runs to rank | no benchmark yet |

## How the numbers are measured

Run numbers are looot's own runs of each endpoint over the last 30 days: the share that completed without an error, and the median time to answer. An endpoint with fewer than 10 runs in that window shows "not enough runs to rank" and is never ranked. Prices are what looot charges per call or per result, fee included, read from the live catalog; you prepay credit and each call is charged when it runs.

Read 2026-11-10 23:22 UTC.

## For agents

The minimal request for Search CVEs (`nvd-cve-search`). Replace each <placeholder> with your value and send a new idempotency key per run.

### MCP

```json
{
  "endpointId": "nvd-cve-search",
  "input": {},
  "idempotencyKey": "<a new id per run>"
}
```

### REST

```bash
curl -X POST https://api.looot.ai/v1/runs \
  -H "Authorization: Bearer $LOOOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"endpointId":"nvd-cve-search","input":{},"idempotencyKey":"<a new id per run>"}'
```

### CLI

```bash
looot run nvd-cve-search --input '{}'
```