Field	Type	Required	Notes
`keyword`	string	no	Words to match in the description; multiple words are ANDed
`exact`	boolean	no	Match the keyword as an exact phrase
`cpe`	string	no	CPE 2.3 match string, e.g. cpe:2.3:a:apache:log4j
`severity`	string	no	LOW \| MEDIUM \| HIGH \| CRITICAL (CVSS v3)
`publishedFrom`	string	no	YYYY-MM-DD; requires publishedTo, window at most 120 days
`publishedTo`	string	no	YYYY-MM-DD; requires publishedFrom
`includeRejected`	boolean	no	Include withdrawn CVE records, default false
`limit`	number	no	1-50, default 10
`offset`	number	no	0-10000, default 0

Example input:

{
  "cpe": "cpe:2.3:a:apache:log4j",
  "severity": "CRITICAL",
  "limit": 5
}

Metered

The 402 quotes a ceiling — the price of the declared cap, 50 results — and settlement is for what the call actually used. A small request settles for less than it was quoted, so read the quote as an upper bound rather than a price.

Cost and provenance


Price	$0.004 per call, metered per results
Source	NIST National Vulnerability Database API 2.0, public domain
Licence	public-domain

Why call it rather than answer from memory

A dependency or triage agent asking "what is known against this product" cannot answer from weights, and NVD throttles anonymous callers to 5 requests per 30 seconds, which is one query per agent step at best.

Calling it

A skill is loaded on its own, so this document has to be enough by itself. It does not assume the general fittings skill is also loaded. call.mjs ships alongside this file; if it is missing (this document reached you without the rest of the skill), fetch it once with curl -sO https://fittings.sh/skill/call.mjs.

Free, and needs no wallet. Read the schema and see what a call would cost:

curl -s https://fittings.sh/catalog/cve.search | jq

Paying. The endpoint answers 402 Payment Required with a signed quote, you sign an authorization, and a facilitator settles it — you never send a transaction and never pay gas. Before it spends anything, the client checks its own hash against the gateway and refuses rather than sign with logic the gateway has moved past:

# Dry run. Prints the quote and pays nothing, because no key is set.
node call.mjs cve.search cpe=cpe:2.3:a:apache:log4j severity=CRITICAL limit=5

# For real: a wallet holding USDC on Base, and nothing else.
export FITTINGS_PRIVATE_KEY=0x...
node call.mjs cve.search cpe=cpe:2.3:a:apache:log4j severity=CRITICAL limit=5

Spending is never a side effect of curiosity: with no FITTINGS_PRIVATE_KEY the client fetches the quote and stops. FITTINGS_MAX_PRICE caps what it will pay without asking, and defaults to $0.05.

Use a throwaway wallet holding a few dollars, not a main one. The key sits in plaintext wherever the agent runs, and the whole cost of entry is USDC on Base — no account, no API key, and no ETH, because the payer signs off-chain and the facilitator broadcasts and pays the gas.

Writing your own client instead of using this one? @x402/core and @x402/evm on npm, and the fittings skill records the two things that cost real debugging time: the challenge is in a response header rather than the body, and it must be re-signed from the exact request being retried.

If this is not the right service, https://fittings.sh/catalog/search?q=... searches all of them for free.

cve-search

CVE search by criteria

The call