CISA Known Exploited Vulnerabilities status for one CVE: whether it is on the KEV catalog, the due date, required action and ransomware-campaign flag. $0.005 per call via x402 (USDC on Base); response includes a provenance chain and an Ed25519 attestation.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| payment | No | Encoded x402 X-PAYMENT header value. Omit to receive the payment requirements (free quote). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well by disclosing the $0.005 fee, x402 payment mechanism, provenance chain, and Ed25519 attestation in the response. It does not mention error behavior or idempotency, but the paid-call and attestation details are meaningful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one dense, front-loaded sentence that conveys purpose, scope, pricing, and response characteristics without wasted words. Every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-CVE lookup with no output schema, the description provides enough operational context: what is returned, the payment requirement, and the attestation. It does not spell out the exact response schema or error cases, but that is not critical for a lightweight lookup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only describes the payment parameter, so the description adds necessary context by framing 'id' as a CVE identifier. It also clarifies the payment flow and cost, supplementing the bare parameter names without going into excessive detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning CISA KEV status for a single CVE, including specific fields such as due date, required action, and ransomware-campaign flag. It lacks an explicit verb like 'get' or 'lookup', but the resource and scope are unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates this is for one CVE, which implies it is not for batch or list queries. It does not explicitly mention alternatives or provide when-to-use versus when-not-to-use guidance, though the domain is distinct enough that confusion with siblings is unlikely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool targets a unique dataset and operation: lookups by ID, summary aggregations, time series, or search. Even tools with similar descriptors (e.g., FMRArea lookup vs. search, FDA vs. CPSC recalls) are clearly separated by resource and output type.
All tool names are lowercase snake_case and mostly follow a `domain_resource_kind` pattern such as `fda_recall_lookup` and `cpsc_recall_monthly_summary`. A few outliers like `bank_profile_lite`, `cpi_us_monthly`, and `us_debt_to_penny` break the dominant suffix convention but remain readable.
24 tools is on the high side for a single server, but this appears to be an aggregator of many independent public datasets, so each tool represents a distinct data source and has a purpose. It is slightly above the ideal ergonomic range but not bloated or redundant.
As a read-only attested-data lookup service, the set provides good coverage with both point lookups and aggregate summaries across many domains. The main gaps are the lack of a catalog/discovery endpoint and search support for most identifier-based lookups, but agents can work around those with known identifiers.