attestd

attestd is a CVE API that turns public vulnerability data into machine-readable risk signals for autonomous systems and other automated workflows. It is meant for situations where software decisions need structured security context rather than prose advisories or scores that require interpretation.

The service says it makes three checks in one call: CVE risk, supply chain compromise, and package name integrity. It returns structured facts that systems can branch on directly, including a deterministic risk_state with values critical, high, elevated, low, or none. The example response also shows fields such as supported, actively_exploited, remote_exploitable, authentication_required, patch_available, fixed_version, confidence, and cve_ids. Attestd says it flags typosquats and AI-hallucinated package names before an agent installs them. It also states that it ingests public sources continuously, using NVD, CISA KEV, and vendor advisories, and that the data is reconciled and updated every six hours.

The page describes intended uses in CI pipelines, automation scripts, and AI agents. It gives examples of using the API as a deploy gate or as a risk signal before a deployment decision. Attestd says it does not detect vulnerabilities on user systems; it interprets publicly known security conditions for software versions.

Access is through an API at api.attestd.io, with a curl example and a Python client example shown on the page. The site also mentions getting a free API key, and says the free tier includes 5,000 calls per month with no credit card required. The page names docs, blog, and sign in links, and refers to use with Claude Code, Cursor, Windsurf, and MCP.