JSON API

Endpoints

Examples

Every data endpoint below is a plain HTTPS GET. The examples cover curl, Python with requests, and PowerShell. The one exception is the Model Context Protocol server, which is a POST; it has its own section below.

curl -s https://cybersecuritytracker.ai/data/days/2026-07-26.json | jq '.items[0] | {title, url, category}'

import requests

day = requests.get("https://cybersecuritytracker.ai/data/days/2026-07-26.json", timeout=30).json()
for item in day["items"][:5]:
    print(item["title"], "->", item["url"])

$day = Invoke-RestMethod "https://cybersecuritytracker.ai/data/days/2026-07-26.json"
$day.items | Select-Object -First 5 title, url

curl -s https://cybersecuritytracker.ai/data/vulns_index.json | jq '[.vulns[] | select(.kev)] | length'

import requests

vulns = requests.get("https://cybersecuritytracker.ai/data/vulns_index.json", timeout=30).json()["vulns"]
movers = [v for v in vulns if v.get("mover_reasons")]
for v in movers[:5]:
    print(v["cve_id"], v["cvss_score"], v["mover_reasons"])

$vulns = (Invoke-RestMethod "https://cybersecuritytracker.ai/data/vulns_index.json").vulns
$vulns | Where-Object { $_.kev } | Select-Object -First 5 cve_id, vendor, cvss_score

curl -s https://cybersecuritytracker.ai/data/breaches_index.json | jq '.breaches[] | select(.kind == "confirmed") | .org_name' | head

import requests

breaches = requests.get("https://cybersecuritytracker.ai/data/breaches_index.json", timeout=30).json()["breaches"]
claims = [b for b in breaches if b["kind"] == "claim"]
print(len(claims), "unverified claims")

$b = (Invoke-RestMethod "https://cybersecuritytracker.ai/data/breaches_index.json").breaches
$b | Group-Object kind | Select-Object Name, Count

curl -s https://cybersecuritytracker.ai/data/stats.json | jq '.ransomware_by_group[:5]'

import requests

stats = requests.get("https://cybersecuritytracker.ai/data/stats.json", timeout=30).json()
for row in stats["ransomware_by_group"][:5]:
    print(row["month"], row["group_name"], row["n"])

(Invoke-RestMethod "https://cybersecuritytracker.ai/data/stats.json").ransomware_by_group |
  Select-Object -First 5 month, group_name, n

curl -s https://cybersecuritytracker.ai/data/meta.json | jq '.vendor_feeds[:5]'

import requests

meta = requests.get("https://cybersecuritytracker.ai/data/meta.json", timeout=30).json()
slugs = [v["slug"] for v in meta["vendor_feeds"]]
print(len(slugs), "vendor feeds, e.g.", slugs[:3])

$meta = Invoke-RestMethod "https://cybersecuritytracker.ai/data/meta.json"
$meta.vendor_feeds | Select-Object -First 5 slug, name

curl -s https://cybersecuritytracker.ai/rss/vendor/fortinet.xml | head -20
curl -s "https://cybersecuritytracker.ai/rss/custom?cats=vulnerabilities&vendors=microsoft,cisco"

import feedparser  # pip install feedparser

feed = feedparser.parse("https://cybersecuritytracker.ai/rss/custom?vendors=microsoft,cisco")
for entry in feed.entries[:5]:
    print(entry.title)

$rss = [xml](Invoke-WebRequest "https://cybersecuritytracker.ai/rss/vendor/fortinet.xml").Content
$rss.rss.channel.item | Select-Object -First 5 title

Custom RSS

One dynamic endpoint builds a merged feed from any combination of category and vendor slugs:

GET /rss/custom?cats=vulnerabilities,ransomware&vendors=microsoft,cisco

Both parameters are optional but at least one is required. Unknown slugs are rejected with 400, request URLs over 4096 characters return 414, and the feed carries a 15-minute cache header. Build one interactively on the feeds page, which also exports your vendor selection as an Outline Processor Markup Language (OPML) file.

Model Context Protocol (MCP) server

The same public data is available through a Model Context Protocol server so an artificial intelligence assistant can query it directly. It is a stateless, read-only endpoint at /mcp speaking JSON-RPC 2.0 (protocol revision 2025-06-18): POST a JSON-RPC message with an Accept of application/json. It holds no session and no private data, and every tool reads only the public shards documented above, never an operator page.

Four tools are exposed: search_vulnerabilities (filter the priority-ranked corpus by text, known-exploited status, and tier),get_vulnerability (one CVE's full record),list_recent_breaches, andget_corpus_insights. Results are truncated to a limit and report total_matched, so a capped list is never mistaken for a complete one.

# 1. Initialize the session
curl -s -X POST https://cybersecuritytracker.ai/mcp \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

# 2. List the tools
curl -s -X POST https://cybersecuritytracker.ai/mcp \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

# 3. Call a tool: the top 5 known-exploited CVEs by priority
curl -s -X POST https://cybersecuritytracker.ai/mcp \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"search_vulnerabilities","arguments":{"kev_only":true,"limit":5}}}'

Fair use

There are no keys and no hard rate limits on the data shards. Be a good neighbor: honor the cache headers, keep sustained polling at or under one request per second, and poll feeds no more than every 15 minutes, which matches their cache lifetime. The pipeline publishes on a schedule, so faster polling only re-reads identical bytes. If you need bulk history, fetch the monthly shards once rather than iterating the day shards.

Attribution

Ransomware leak-site data originates from RansomLook and is licensed CC BY 4.0: if you re-expose breach or actor data from this API, keep that attribution. Vulnerability data derives from CISA Known Exploited Vulnerabilities (KEV), the National Vulnerability Database (NVD), the Exploit Prediction Scoring System (EPSS) by FIRST, and vendor advisories. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Adversary technique, group, and mitigation data comes from MITRE ATT&CK. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. The KEV-to-ATT&CK technique mappings and the ATT&CK-to-NIST 800-53 control mappings come from the MITRE Engenuity Center for Threat-Informed Defense (CTID), used under Apache 2.0; keep both attributions if you re-expose that data.

Changelog

• 2026-07-17Added a Model Context Protocol (MCP) server at /mcp: a stateless, read-only JSON-RPC endpoint (protocol revision 2025-06-18) over this same public data, with tools for searching the priority-ranked vulnerability corpus, fetching one CVE's full record, listing recent breaches, and reading the corpus insights. It reads only the public shards and holds no session or private data. See the Model Context Protocol section above.
• 2026-07-17Added sigma_pack.json (a downloadable Sigma rule pack scoped to the tracker's technique index, with per-rule author attribution, back-links, and the embedded Detection Rule License 1.1 notice) and a static MISP feed under /data/misp/(manifest, one event per month of CISA Known Exploited Vulnerabilities additions, and hashes.csv; point a MISP instance's feed at the manifest URL). The MISP feed carries United States government public-domain facts plus the tracker's own priority tier only.
• 2026-07-17Added attack_navigator_layer_v4_5.json: a downloadable ATT&CK Navigator layer (format 4.5) whose technique heat counts distinct CVEs with an exploitation mapping in the CTID Known Exploited Vulnerabilities mappings snapshot. The file is absent until those mappings are ingested, and the sample basis ships in the layer's own metadata.
• 2026-07-16Retired the monolithic malicious_packages.json andbreaches.json: both now ship as a lean<name>_index.json plus per-record detail shards under /data/malicious_packages/ and/data/breaches/, fetched on demand, matching the vulnerabilities layout. The malicious-package bulk count (bulk_total) and the breach composition and reconciliation notes are unchanged. The older malicious_packages.json andbreaches.json paths are gone; use the indexes and their shards.
• 2026-07-13Retired the monolithic vulns.json: the corpus now ships as a lean vulns_index.json plus per-CVE detail shards under /data/vulns/, fetched on demand, so no single file approaches Cloudflare's 25 MiB per-file cap. The oldervulns.json path is gone; use the index and its shards. The two entries below predate this change and describe the now-retired file.
• 2026-07-08Added the Exploit-DB shard /data/exploits.json and the /rss/exploits.xml feed (metadata and Exploit-DB links only). vulns.json gained anexploits array per CVE, and breaches.jsongained url_is_onion.
• 2026-07-06Added per-vendor RSS feeds, the vendors parameter on/rss/custom, and monthly rollups under/data/rollups/. vulns.json gainedcvss_version, epss_delta_7d,mentions_48h, mover_reasons, andmover_score. meta.json gainedvendor_feeds.
• 2026-07-06Removed the five-category cap on /rss/custom. Added per-persona feeds and why_it_matters on stories.
• 2026-07-01Initial public API: day and month shards, vulnerabilities, breaches, stats, calendar, and metadata.