Read API and MCP

Read API v1

The read API is public. Requests without a key see the same data as requests with one; a key only raises the rate limit. Endpoints accept GET only and return JSON.

OpenAPI 3.1 reference · Account and API keys

GET /api/v1/cves

CVEs with CVSS, KEV status and dates, and EPSS.

GET /api/v1/cves/{id}

One CVE: description, CVSS, KEV dates, EPSS and patch link.

GET /api/v1/vendors

Vendors with CVE, KEV and article counts.

GET /api/v1/vendors/{slug}

One vendor’s CVE, KEV and article counts.

GET /api/v1/actors

Threat actors with article and report counts.

GET /api/v1/actors/{key}

One threat actor’s article, outlet and report counts.

GET /api/v1/articles

Headlines, dates, outlets and original URLs.

GET /api/v1/briefing/latest

The latest briefing edition with its citations.

Bounded pages and filters

Lists default to 20 items, with a maximum of 50. The opaque next_cursor continues a page through cursor. Offset pagination and free-text queries are unavailable. Unknown or duplicate parameters return 400.

CVEs are ordered by most recent observation, then ID. Filters are kev=true|false, vendor and severity=low|medium|high|critical. Filters apply to each examined window; an empty page may still have a next cursor. Vendor and actor directories use slug order.

Articles use recent ingestion order. One exact filter is available at a time: cve, vendor or actor. Filtered articles use article-ID order, grouped by vendor identifier where needed. A source article may occur in more than one vendor group; its uid supports deduplication. The cursor continues even when a group is empty.

Remote MCP

https://cybersixt.com/mcp uses stateless Streamable HTTP with JSON responses. The server negotiates protocol 2025-11-25, 2025-06-18 or 2025-03-26. It supports initialize, the initialized notification, ping, tools/list and tools/call. Tools mirror the API and are read-only. No standalone SSE stream or session identifier is required.

POST requests carry Content-Type: application/json and Accept: application/json, text/event-stream. Requests after initialisation carry MCP-Protocol-Version.

An example tool call:

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "cve",
    "arguments": { "id": "CVE-2026-1234" }
  }
}

Limits and keys

Anonymous access allows 30 requests per minute per IP. A signed-in account may create one optional cx_k_ key, shown once. Authorization: Bearer cx_k_… allows 120 requests per minute per key, within a shared ceiling of 180 per minute per IP. Keys only lift limits. Rotation revokes the previous key immediately.

Rate limits apply before cache lookup, including invalid requests. A 429 response carries Retry-After: 60. Normalised results are cached for five minutes. An uncached call reads at most 101 rows, and a response is at most 192 KiB. Requests never trigger new lookups at NVD, CISA or FIRST.

What is excluded

Article and report bodies, indicator values and private account data are never returned.