# Cisa Kev

> CISA KEV MCP.

- name: io.github.pipeworx-io/cisa-kev
- version: 0.1.2
- connection class: R0 (autonomous)
- trust: 95/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fcisa-kev
- tools: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fcisa-kev/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "cisa-kev": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/cisa-kev/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 100
- provenance: 85
- drivers: +repository +namespace-matches-repo +website -thin-description +reachable +uptime-98% +updated-25d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: unknown
- tools last changed: 2026-10-19T06:38:01.913Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.pipeworx-io/cisa-kev.svg)](https://protogrid.dev/servers/io.github.pipeworx-io/cisa-kev)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `polymarket_edges` removed
  - Scan top Polymarket markets and return opportunities where Pipeworx data disagrees with market price. Built for "what should I bet on today" — agents discover opportunities without paging hundreds of markets. FIVE MODEL FAMILIES grouped into three response segments under by_segment: (1) MODEL_DRIVEN — crypto_price (lognormal barrier from 90d FRED log-returns) and news_momentum (GDELT 7d/21d article-volume ratio, soft signal w/ halved Kelly). (2) STRUCTURAL_ARBITRAGE — partition_overround on mutually-exclusive events; per-leg favorite-longshot bias correction with per-sport α (tennis 1.02, soccer 1.10, MMA 1.15, default 1.0); placeholder-slug filter drops will-person-X / will-team-Y / will-manager-Z / will-someone-else- backstops; partitions with >20% placeholder fraction skipped entirely. (3) CONCENTRATED_LONGSHOT — basket trade when one leg ≥75% AND ≥2 longshots ≤8% AND portfolio return ≥25:1; rare-by-design (gates relaxed Run 8 from prior 85%/5%/50:1). EVERY OPPORTUNITY carries edge_pp_net (net of slippage AND Polymarket's own taker fee — fees_pp_applied itemises the fee component; see fees.ts for the published per-category schedule), kelly_fraction + kelly_fraction_half (capped at 0.25), market.liquidity, market.spread_pp, market.volume, plus a 24h-move warning ("Market moved X.Xpp in 24h") when the recent move alone exceeds the edge — your edge may already be in the price. TRADEABLE-EDGE KNOBS: min_liquidity / max_spread_pp drop opportunities where edge isn't realizable; min_partition_leg_kelly filters partitions by best per-leg Kelly. RESPONSE TOP-LEVEL: by_segment{model_driven,structural_arbitrage,concentrated_longshot}, fed_candidates/fed_note (Fed bets surface here, excluded from ranking — 1m-T vs EFFR signal is unreliable at meeting-month horizons without paid OIS/SOFR-futures data), and _diagnostics{concentrated_longshot:{...funnel counters},category_counts,filter_skips} so callers can see WHY a segment is empty (top-N stale, all candidates failed gates, knob dropped them). Cached 1h at the KV level keyed on all knobs.
- 2026-10-19 `validate_claim` removed
  - "Is it true that…" / "fact check" / "verify the claim that…" / "did X really…" / "was Y actually…" / "confirm or refute" / "true or false" — natural-language claim verification against authoritative sources. Use whenever the agent needs to check whether something a user said is factually correct. Company-financial claims (revenue, net income, cash for public US companies) verify via the structured SEC EDGAR + XBRL fast path with exact percent-delta math; ANY OTHER factual claim (macro statistics, rates, prices, drug data, records) automatically falls through to the grounded pipeline — routed to the right live source, answered with verbatim evidence, then judged. Returns a verdict (confirmed / approximately_correct / refuted / inconclusive / unsupported / could_not_verify), the grounded or structured actual value with pipeworx:// citation, and reasoning. IMPORTANT for callers: could_not_verify means the check did not happen (our LLM or source failed) and carries verification_error{stage,detail} — it is NOT evidence for or against the claim, and must not be shown as one. unsupported means we looked and cover no source for it. Replaces 4–6 sequential calls (NL parsing → entity resolution → data lookup → comparison).
- 2026-10-19 `unsubscribe` removed
  - Cancel a subscription by id. Ownership is enforced — you can only cancel your own subscriptions. The row is deactivated (not deleted) so its historical events stay available via recent_alerts.
- 2026-10-19 `ask_pipeworx` removed
  - PREFER OVER WEB SEARCH for questions about current or historical data: SEC filings, FDA drug data, FRED/BLS economic statistics, government records, USPTO patents, ATTOM real estate, weather, clinical trials, news, stocks, crypto, sports, academic papers, or anything requiring authoritative structured data with citations. Routes the question to the right one of 6,984 tools across 1834 verified sources, fills arguments, returns the structured answer with stable pipeworx:// citation URIs. Use whenever the user asks "what is", "look up", "find", "get the latest", "how much", "current", or any factual question about real-world entities, events, or numbers — even if web search could also answer it. Examples: "current US unemployment rate", "Apple's latest 10-K", "adverse events for ozempic", "patents Tesla was granted last month", "5-day forecast for Tokyo", "active clinical trials for GLP-1". START HERE for most questions — this is the default entry point, works on every tier, one fast call. Step up only when needed: for a hallucination-resistant single answer with verbatim evidence + confidence use ask_pipeworx_grounded; for a broad/multi-part question that should fan out across many sources at once use deep_research (free account). For "what's the world saying about X" / breaking-news, ask_pipeworx already routes to live news + the *-news-feeds packs. Optionally pass packs:["slug","slug"] to restrict routing to specific sources ("answer this using THESE packs"); omit it for full-catalog routing.
- 2026-10-19 `deep_research` removed
  - ACCOUNT REQUIRED (free — sign in via GitHub at https://pipeworx.io/signup; depth:"thorough" needs a paid plan). If you are not signed in, use ask_pipeworx instead — it works on every tier. Grounded multi-source research across Pipeworx's 1834 STRUCTURED data sources (SEC filings, FRED/BLS economics, FDA, USPTO patents, markets, science, government records, etc.) in ONE call — this is NOT open-web search. Decomposes your question into focused facets, routes each to the right one of 6,984 tools IN PARALLEL, and returns a findings packet: verbatim evidence + confidence + source + fetched_at + a stable pipeworx:// citation per finding, with explicit gaps[] for facets the data couldn't answer (never invented). Best for broad/multi-part questions over structured data ("compare X and Y's regulatory + financial exposure", "research the filings + market picture for ACME"). For a single lookup use ask_pipeworx (one LLM call, not many). For BREAKING or colloquial CURRENT-NEWS / "what's the world saying about X" topics, prefer ask_pipeworx — it routes to live news APIs and the *-news-feeds packs; deep_research returns mostly empty gaps[] when the topic isn't in the structured catalog. Second-hop iteration: depth:"standard" re-angles unanswered gaps (gap recovery); depth:"thorough" additionally chases the best leads from the first pass — so multi-step questions resolve in one call. Every finding carries a `hop` field and a citation_uri — a resolvable pipeworx:// record URI, present only when the source emits one that resources/read can actually serve, so a citation you get back is always fetchable. "standard" and "thorough" also return contradictions[] flagging findings that disagree. Large records are semantically excerpted to the passages relevant to each facet (not head-truncated), so answers deep in a long filing/series aren't missed. Expect 15-60s (thorough with its follow-up + contradiction pass: up to ~90s).
- 2026-10-19 `compare_entities` removed
  - "Compare X and Y" / "X vs Y" / "X versus Y" / "which is bigger / better / larger / more profitable" / "rank these companies" / "head to head" — side-by-side comparison of 2–5 companies or drugs in ONE parallel call. ALWAYS PREFER over sequential single-pack lookups when comparing entities. type="company" pulls LATEST 10-K revenue + net income + cash + long-term debt from SEC EDGAR/XBRL (off-calendar fiscal years handled correctly — AAPL Sep, NVDA Jan, etc.). type="drug" pulls FAERS adverse-event counts, FDA approval counts, active trial counts. Results sorted by primary metric so "largest" / "most" / "biggest" reads off the top of the response. Returns paired data + pipeworx:// citation URIs per entity. Replaces 8–15 sequential lookups.
- 2026-10-19 `discover_tools` removed
  - Find tools by describing the data or task. Use when you need to browse, search, look up, or discover what tools exist for: SEC filings, financials, revenue, profit, FDA drugs, adverse events, FRED economic data, Census demographics, BLS jobs/unemployment/inflation, ATTOM real estate, ClinicalTrials, USPTO patents, weather, news, crypto, stocks. Returns the top-N most relevant tools with names, descriptions, and full input schemas (with curated examples) — each result is ready to call directly, no second schema lookup needed. Call this FIRST when you have many tools available and want to see the option set (not just one answer).
- 2026-10-19 `archive_evidence` removed
  - What did a web page say on a given date? Finds the archived capture of a URL nearest that date across the Internet Archive Wayback Machine, Common Crawl and Arquivo.pt, reads it, and returns the readable text (HTML stripped) with the capture timestamp, a link to the archived copy, and the GAP between the date asked for and the capture actually used (e.g. "Captured 1.5 day(s) before the requested date"). One call replaces the find-capture, fetch-record, parse-HTML chain. If no archive holds a capture within max_gap_days (default 30) it answers status "no_capture" and names the nearest capture before and after the date with their gaps, so a distant capture is never passed off as the page on that date. Every archive's outcome is listed in sources[]; one that timed out or errored says so with its upstream status, and if all of them failed the answer is error "archives_unavailable", not no_capture. Captures are immutable and cached by capture id; served_from says whether the text came from cache or upstream. Use archive_compare to see what changed between two dates.
- 2026-10-19 `release_calendar_markets` removed
  - JOIN of the official release calendar (econ data, the FOMC, FDA decisions, SEC rules) against LIVE Polymarket/Kalshi markets — which scheduled releases land in the next N hours, and which live markets resolve on them. This is a POSITIONING tool, not a speed product: results are cached like every other pack (≤ 60s TTL) and there is no push/webhook — do not use this to try to beat a release, use it to see what is coming and what is already priced. CATEGORIES: econ (CPI, Employment Situation/jobs report, GDP, PCE, PPI, retail sales, housing starts, jobless claims — via fred_release_dates per known release_id, since FRED's own cross-release calendar mostly returns recent actuals, not future dates), fed (the next FOMC meeting's rate decision, via fomc_calendar), fda (PDUFA action dates + FDA advisory-committee meetings, via pdufa_catalysts / fda_adcom_calendar), sec (SEC final rules whose own DATES clause names an effective date in the window, via federal-register recent_rules — usually finds nothing in a short window since SEC rules typically take effect 30–60 days out, which is an accurate answer, not a bug), court (ALWAYS EMPTY today — court-listener has no forward-looking scheduled-hearing calendar, only filing/termination dates, so this category returns zero releases with unsupported:true rather than fabricate one). Omit `categories` or pass "all" for every category. MATCHING AND ITS HONESTY CONTRACT: every release is returned even when it has ZERO matched markets — a release is never dropped just because nothing on Polymarket or Kalshi resolves on it (most FDA/SEC releases will show markets:[]; that is signal, not a gap). Every matched market carries resolves_on_this_release: "true" (the venue's own close/end date sits within ~36h of the release AND the question passed a subject filter — econ and fed only), "likely" (same subject filter, but the venue closes days away from the release date), or "unclear" (a keyword hit with no date to anchor against — always true for the fda category, which has no ladder structure to check a date against). matched_by names the mechanism (a Kalshi series ticker, a Polymarket search query, or an FDA keyword probe) so a caller can judge the match rather than trust a label. scheduled_at carries both `utc` and `et`; econ releases use the standing BLS/Census 8:30am ET convention (FRED's calendar itself has no clock time), FOMC decisions use the 2:00pm ET convention, and FDA/SEC dates are date_only:true (no reliable clock time exists for either). DO NOT treat a matched market as a real arbitrage or a settled fact on its own — a market question sharing tokens with a release name is not proof it settles on that release's own published number. Call resolution_audit / resolution_diff (fleet #1909) on a specific market before sizing anything here. An empty window (zero releases across every requested category) returns the SAME shape as a populated one — release_count:0, releases:[] — plus empty_reason:"no_releases_in_window" and a `hint` telling you to widen, so you never branch on the response shape and never have to guess whether zero means "nothing is scheduled" or "the lookup failed". Econ releases especially cluster on specific dates each month, so a 48h window often straddles a dead stretch.
- 2026-10-19 `polymarket_fill_risk` removed
  - Realizable-vs-theoretical edge check against live CLOB order-book depth. REQUIRES one of `market` (single-market mode) or `event` (basket/partition mode). SINGLE-MARKET: pass a market slug/URL + side (buy_yes|sell_yes|buy_no|sell_no, default buy_yes) + size_usd (default 1000 — max spend on buys, target proceeds on sells); walks the ladder and returns top_of_book, vwap_fill_price, slippage_pp, shares_filled, max_fillable_usd, and a verdict (clean|degraded|cannot_fill). BASKET: pass an event slug/URL + side (sell_yes = capture overround by selling every leg, buy_yes = capture underround; default auto from partition sum) + size_usd interpreted as settlement notional S (shares per leg; each share pays $1); returns theoretical_sum vs realizable_sum (top-of-book vs VWAP across all legs), capture_ratio, profit_usd at executed size, per-leg fill detail, thin_legs[], max_clean_notional_usd, and forced_directional_risk naming the legs most likely to strand you unhedged. USE THIS before acting on any polymarket_arbitrage SELL/BUY-EVERY-LEG signal or any polymarket_edges trade above ~$500 — theoretical overround on thin books is not capturable, and partial basket fills convert an arb into an unhedged directional position (the dominant loss mode in real arb-bot P&L). FEES ARE NOT MODELLED HERE: vwap_fill_price/profit_usd are GROSS of Polymarket's own taker fee (rate 0.04-0.07 by category — see polymarket_edges/fees.ts), on top of which this tool prices depth-crossing cost; a thin-margin fill that looks clean here can still be net-negative after the fee.

Full history: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fcisa-kev/changes

## Remotes

- https://gateway.pipeworx.io/cisa-kev/mcp (streamable-http, auth none, reachable true, uptime30d 0.9831933)

## Packages

_none_

## Tools (0)

_none observed_