Cybersecurity Intelligence API Documentation

Independent API for vulnerability and dependency security: CVE details, package checks, batch queries, risk assessments, dependency trees, project health, repository Scorecard, and lockfile auditing from OSV, CISA KEV, FIRST EPSS, NVD, Google deps.dev, and OpenSSF Scorecard. Payment is the exact USDC price on Base with x402.

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/vulnerability$0.02 USDC

Get vulnerability details

Retrieve details for a CVE or vulnerability ID from OSV, CISA KEV, FIRST EPSS, and NVD.

Body

Field	Required	Notes
`cveId`	Yes	string

Request exampleJSON

{
  "cveId": "CVE-2023-1234"
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "cveId": "CVE-2023-1234",
  "vulnerability": {
    "cveId": "CVE-2023-1234",
    "aliases": [
      "GHSA-abc-123"
    ],
    "summary": "A buffer overflow vulnerability allows remote code execution.",
    "affectedPackages": [
      {
        "ecosystem": "PyPI",
        "name": "example-package",
        "versions": [
          "1.0.0",
          "1.0.1"
        ],
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.0.2"
              }
            ]
          }
        ]
      }
    ],
    "cvssScore": 9.8,
    "cvssSeverity": "CRITICAL",
    "epssProbability": 0.95,
    "epssPercentile": 0.98,
    "epssDate": "2026-10-28",
    "kevStatus": "KNOWN_EXPLOITED",
    "kevProduct": "Example Product",
    "kevVendor": "Example Vendor",
    "kevRequiredAction": "Apply updates per vendor instructions.",
    "kevDueDate": "2026-11-15",
    "kevDateAdded": "2026-10-01",
    "ransomwareCampaignUse": true,
    "cweId": "CWE-119",
    "references": [
      {
        "type": "ADVISORY",
        "url": "https://example.com/advisory"
      }
    ],
    "timestamps": {
      "osvPublished": "2026-10-01T00:00:00.000Z",
      "osvModified": "2026-10-15T00:00:00.000Z",
      "nvdPublished": "2026-10-01T00:00:00.000Z",
      "nvdModified": "2026-10-15T00:00:00.000Z"
    }
  },
  "sources": {
    "osv": {
      "status": "OK",
      "url": "https://api.osv.dev/v1/query",
      "retrievedAt": "2026-10-29T12:00:00.000Z"
    },
    "cisa": {
      "status": "OK",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "retrievedAt": "2026-10-29T11:55:00.000Z"
    },
    "epss": {
      "status": "OK",
      "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-1234",
      "retrievedAt": "2026-10-29T12:00:00.000Z"
    },
    "nvd": {
      "status": "OK",
      "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-1234",
      "retrievedAt": "2026-10-29T12:00:00.000Z"
    }
  },
  "limitations": [
    "OSV data comes from the OSV.dev API and may not include all vulnerability databases.",
    "CISA KEV data is cached for 5 minutes to avoid repeated requests.",
    "EPSS scores are from FIRST and may not reflect the latest probability.",
    "NVD API is rate-limited to 5 requests per 30 seconds without an API key."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/vulnerability" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "cveId": "CVE-2023-1234"
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/package/check$0.03 USDC

Check package vulnerabilities

Check one package and version for vulnerabilities using OSV, enriched with CISA KEV, EPSS, and NVD data.

Body

Field	Required	Notes
`ecosystem`	Yes	string
`package`	Yes	string
`version`	Yes	string

Request exampleJSON

{
  "ecosystem": "PyPI",
  "package": "requests",
  "version": "2.28.0"
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "package": {
    "ecosystem": "PyPI",
    "name": "requests",
    "version": "2.28.0"
  },
  "vulnerabilities": [
    {
      "cveId": "CVE-2023-1234",
      "aliases": [
        "GHSA-abc-123"
      ],
      "summary": "A buffer overflow vulnerability allows remote code execution.",
      "affectedPackages": [
        {
          "ecosystem": "PyPI",
          "name": "requests",
          "versions": [
            "2.28.0"
          ],
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "2.28.0"
                },
                {
                  "fixed": "2.28.1"
                }
              ]
            }
          ]
        }
      ],
      "cvssScore": 9.8,
      "cvssSeverity": "CRITICAL",
      "epssProbability": 0.95,
      "epssPercentile": 0.98,
      "epssDate": "2026-10-28",
      "kevStatus": "KNOWN_EXPLOITED",
      "kevProduct": "requests",
      "kevVendor": "Python Software Foundation",
      "kevRequiredAction": "Apply updates per vendor instructions.",
      "kevDueDate": "2026-11-15",
      "kevDateAdded": "2026-10-01",
      "ransomwareCampaignUse": true,
      "cweId": "CWE-119",
      "references": [
        {
          "type": "ADVISORY",
          "url": "https://example.com/advisory"
        }
      ],
      "timestamps": {
        "osvPublished": "2026-10-01T00:00:00.000Z",
        "osvModified": "2026-10-15T00:00:00.000Z",
        "nvdPublished": "2026-10-01T00:00:00.000Z",
        "nvdModified": "2026-10-15T00:00:00.000Z"
      }
    }
  ],
  "source": {
    "url": "https://api.osv.dev/v1/query",
    "retrievedAt": "2026-10-29T12:00:00.000Z",
    "status": "OK"
  },
  "limitations": [
    "Results are limited to the first 50 vulnerabilities from OSV.",
    "EPSS and NVD data are fetched for each vulnerability and may be rate-limited.",
    "Not all vulnerabilities may have EPSS or NVD data available."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/package/check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "ecosystem": "PyPI",
  "package": "requests",
  "version": "2.28.0"
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/package/batch-check$0.10 USDC

Batch check package vulnerabilities

Check multiple packages and versions for vulnerabilities using OSV batch query, enriched with CISA KEV, EPSS, and NVD data.

Body

Field	Required	Notes
`packages`	Yes	array; Array

Request exampleJSON

{
  "packages": [
    {
      "ecosystem": "PyPI",
      "package": "requests",
      "version": "2.28.0"
    },
    {
      "ecosystem": "npm",
      "package": "express",
      "version": "4.18.0"
    }
  ]
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "results": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "requests",
        "version": "2.28.0"
      },
      "vulnerabilities": [
        {
          "cveId": "CVE-2023-1234",
          "aliases": [
            "GHSA-abc-123"
          ],
          "summary": "A buffer overflow vulnerability allows remote code execution.",
          "affectedPackages": [
            {
              "ecosystem": "PyPI",
              "name": "requests",
              "versions": [
                "2.28.0"
              ],
              "ranges": [
                {
                  "type": "SEMVER",
                  "events": [
                    {
                      "introduced": "2.28.0"
                    },
                    {
                      "fixed": "2.28.1"
                    }
                  ]
                }
              ]
            }
          ],
          "cvssScore": 9.8,
          "cvssSeverity": "CRITICAL",
          "epssProbability": 0.95,
          "epssPercentile": 0.98,
          "epssDate": "2026-10-28",
          "kevStatus": "KNOWN_EXPLOITED",
          "kevProduct": "requests",
          "kevVendor": "Python Software Foundation",
          "kevRequiredAction": "Apply updates per vendor instructions.",
          "kevDueDate": "2026-11-15",
          "kevDateAdded": "2026-10-01",
          "ransomwareCampaignUse": true,
          "cweId": "CWE-119",
          "references": [
            {
              "type": "ADVISORY",
              "url": "https://example.com/advisory"
            }
          ],
          "timestamps": {
            "osvPublished": "2026-10-01T00:00:00.000Z",
            "osvModified": "2026-10-15T00:00:00.000Z",
            "nvdPublished": "2026-10-01T00:00:00.000Z",
            "nvdModified": "2026-10-15T00:00:00.000Z"
          }
        }
      ],
      "source": {
        "status": "OK"
      }
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "express",
        "version": "4.18.0"
      },
      "vulnerabilities": [],
      "source": {
        "status": "OK"
      }
    }
  ],
  "source": {
    "url": "https://api.osv.dev/v1/querybatch",
    "retrievedAt": "2026-10-29T12:00:00.000Z",
    "status": "OK"
  },
  "limitations": [
    "Batch queries are limited to 20 packages per request.",
    "Each package is limited to the first 20 vulnerabilities from OSV.",
    "EPSS and NVD data are fetched for each vulnerability and may be rate-limited."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/package/batch-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "packages": [
    {
      "ecosystem": "PyPI",
      "package": "requests",
      "version": "2.28.0"
    },
    {
      "ecosystem": "npm",
      "package": "express",
      "version": "4.18.0"
    }
  ]
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/risk/assess$0.15 USDC

Assess vulnerability risk

Produce a consolidated vulnerability risk assessment for multiple packages, combining OSV, CISA KEV, EPSS, and NVD data.

Body

Field	Required	Notes
`packages`	Yes	array; Array

Request exampleJSON

{
  "packages": [
    {
      "ecosystem": "PyPI",
      "package": "requests",
      "version": "2.28.0"
    }
  ]
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "assessment": {
    "overallRisk": "CRITICAL",
    "totalVulnerabilities": 5,
    "criticalCount": 2,
    "highCount": 1,
    "mediumCount": 1,
    "lowCount": 1,
    "kevCount": 2,
    "highEpssCount": 3,
    "packages": [
      {
        "package": {
          "ecosystem": "PyPI",
          "name": "requests",
          "version": "2.28.0"
        },
        "risk": "CRITICAL",
        "vulnerabilities": [
          {
            "cveId": "CVE-2023-1234",
            "aliases": [
              "GHSA-abc-123"
            ],
            "summary": "A buffer overflow vulnerability allows remote code execution.",
            "affectedPackages": [
              {
                "ecosystem": "PyPI",
                "name": "requests",
                "versions": [
                  "2.28.0"
                ],
                "ranges": [
                  {
                    "type": "SEMVER",
                    "events": [
                      {
                        "introduced": "2.28.0"
                      },
                      {
                        "fixed": "2.28.1"
                      }
                    ]
                  }
                ]
              }
            ],
            "cvssScore": 9.8,
            "cvssSeverity": "CRITICAL",
            "epssProbability": 0.95,
            "epssPercentile": 0.98,
            "epssDate": "2026-10-28",
            "kevStatus": "KNOWN_EXPLOITED",
            "kevProduct": "requests",
            "kevVendor": "Python Software Foundation",
            "kevRequiredAction": "Apply updates per vendor instructions.",
            "kevDueDate": "2026-11-15",
            "kevDateAdded": "2026-10-01",
            "ransomwareCampaignUse": true,
            "cweId": "CWE-119",
            "references": [
              {
                "type": "ADVISORY",
                "url": "https://example.com/advisory"
              }
            ],
            "timestamps": {
              "osvPublished": "2026-10-01T00:00:00.000Z",
              "osvModified": "2026-10-15T00:00:00.000Z",
              "nvdPublished": "2026-10-01T00:00:00.000Z",
              "nvdModified": "2026-10-15T00:00:00.000Z"
            }
          }
        ]
      }
    ]
  },
  "source": {
    "url": "https://api.osv.dev/v1/querybatch",
    "retrievedAt": "2026-10-29T12:00:00.000Z",
    "status": "OK"
  },
  "limitations": [
    "Risk assessment is based on available data from OSV, CISA, EPSS, and NVD.",
    "Missing CVSS or EPSS data may affect risk scoring.",
    "Assessment is not a definitive security evaluation; review each vulnerability individually."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/risk/assess" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "packages": [
    {
      "ecosystem": "PyPI",
      "package": "requests",
      "version": "2.28.0"
    }
  ]
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/dependency-tree$0.05 USDC

Get dependency tree

Return direct and transitive dependencies, dependency versions and available dependency metadata using Google deps.dev API.

Body

Field	Required	Notes
`ecosystem`	Yes	string; One of: GO, RUBYGEMS, NPM, CARGO, MAVEN, PYPI, NUGET
`packageName`	Yes	string
`version`	No	string

Request exampleJSON

{
  "ecosystem": "NPM",
  "packageName": "express",
  "version": "4.18.0"
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "input": {
    "ecosystem": "NPM",
    "packageName": "express",
    "version": "4.18.0"
  },
  "dependencyTree": {
    "result": {
      "system": "NPM",
      "name": "express",
      "version": "4.18.0",
      "dependencies": [
        {
          "system": "NPM",
          "name": "accepts",
          "version": "1.3.8"
        }
      ]
    }
  },
  "sources": [
    {
      "source": "Google deps.dev API",
      "url": "https://api.deps.dev/v3/systems/NPM/packages/express/versions/4.18.0/dependencies",
      "retrievedAt": "2026-10-29T12:00:00.000Z"
    }
  ],
  "limitations": [
    "Dependency tree data is from deps.dev.",
    "Only direct and transitive dependencies in deps.dev are included.",
    "Not all ecosystems have complete dependency data."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/dependency-tree" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "ecosystem": "NPM",
  "packageName": "express",
  "version": "4.18.0"
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/package/project-health$0.05 USDC

Get package project health

Return project activity indicators, repository associations, package metadata and available security information using Google deps.dev API.

Body

Field	Required	Notes
`ecosystem`	Yes	string; One of: GO, RUBYGEMS, NPM, CARGO, MAVEN, PYPI, NUGET
`packageName`	Yes	string

Request exampleJSON

{
  "ecosystem": "NPM",
  "packageName": "express"
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "input": {
    "ecosystem": "NPM",
    "packageName": "express"
  },
  "projectHealth": {
    "result": {
      "system": "NPM",
      "name": "express",
      "versions": [
        {
          "version": "4.18.0",
          "isDefault": true
        }
      ]
    }
  },
  "sources": [
    {
      "source": "Google deps.dev API",
      "url": "https://api.deps.dev/v3/systems/NPM/packages/express",
      "retrievedAt": "2026-10-29T12:00:00.000Z"
    }
  ],
  "limitations": [
    "Project health data is from deps.dev.",
    "Activity indicators may vary by ecosystem.",
    "Repository associations depend on package metadata."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/package/project-health" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "ecosystem": "NPM",
  "packageName": "express"
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/repository/scorecard$0.05 USDC

Get repository Scorecard

Retrieve the official OpenSSF Scorecard result for a GitHub, GitLab or other supported repository.

Body

Field	Required	Notes
`repository`	Yes	string; uri

Request exampleJSON

{
  "repository": "https://github.com/ossf/scorecard"
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "repository": "https://github.com/ossf/scorecard",
  "scorecard": {
    "score": 8.6,
    "checks": [
      {
        "name": "Maintained",
        "score": 10
      },
      {
        "name": "Security-Policy",
        "score": 10
      }
    ]
  },
  "sources": [
    {
      "source": "OpenSSF Scorecard API",
      "url": "https://api.scorecard.dev/projects/github.com/ossf/scorecard",
      "retrievedAt": "2026-10-29T12:00:00.000Z"
    }
  ],
  "limitations": [
    "Scorecard results are from OpenSSF.",
    "Only GitHub, GitLab, and supported repositories are included.",
    "Scores are heuristic indicators, not guarantees of security."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/repository/scorecard" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "repository": "https://github.com/ossf/scorecard"
}
JSON

POSThttps://brainiac.software/api/v1/cybersecurity-intelligence/lockfile/audit$0.10 USDC

Audit lockfile

Parse supported package lockfiles, identify dependencies and versions, then combine deps.dev and existing OSV/CISA/EPSS/NVD findings.

Body

Field	Required	Notes
`lockfileContent`	Yes	string
`ecosystem`	No	string; One of: NPM, PYPI, MAVEN, RUBYGEMS, CARGO, NUGET, GO

Request exampleJSON

{
  "lockfileContent": "package-lock.json content here",
  "ecosystem": "NPM"
}

Response exampleJSON

{
  "retrievedAt": "2026-10-29T12:00:00.000Z",
  "input": {
    "lockfileContent": "package-lock.json content",
    "ecosystem": "NPM"
  },
  "dependencies": [],
  "vulnerabilities": [],
  "sources": [],
  "limitations": [
    "Lockfile parsing is limited to common formats.",
    "Only deps.dev-supported ecosystems can be audited.",
    "Combine with existing OSV/CISA/EPSS/NVD findings for complete vulnerability data."
  ]
}

cURL

curl -i -X POST "https://brainiac.software/api/v1/cybersecurity-intelligence/lockfile/audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "lockfileContent": "package-lock.json content here",
  "ecosystem": "NPM"
}
JSON