Read the docs
API & MCP

Threatist data,
wherever your tools run.

The same prioritised vulnerability records you see on this site, over REST and MCP today and A2A next. Built for scripts, security tooling and AI agents.

Read the docs OpenAPI document

REST API

JSON over HTTPS. Pull records into scripts, SIEM, ticketing and patch workflows.

MCP server

Tools for AI assistants and agents that speak the Model Context Protocol.

A2A agent

Agent-to-agent protocol for autonomous security agents that delegate vulnerability questions.

Coming soon
Quickstart

First call in a minute

No key needed. Ask for any record by its TI id or by an alias such as a CVE, or add the MCP server to your AI assistant.

  1. Send a GET request, no sign-up
  2. Use up to 60 requests a minute and 1,000 a day per address
  3. Follow next to page through lists

Use of the API and its data is covered by the terms of use, including the attribution "Data from Threatist".

curl https://threatist.io/v1/vulns/CVE-2021-44228 -L

# the alias answers 308 to the record's TI address
REST

Endpoints

Times are RFC 3339 in UTC and dates YYYY-MM-DD. A missing value is null and an empty list is []. Every value names its source; each record lists its sources once, with licence and fetch time. Errors are problem details with a code. New fields, parameters and values can appear within /v1, so ignore what you do not know; breaking changes come only with /v2.

MethodPathQuery parameters
GET/v1/
Describe the API		—
GET/v1/openapi.json
This OpenAPI document		—
GET/v1/vulns
Search records		q, sort, band, signal, exploited, cwe, product, published, fixStatus, impactType, attackVector, privileges, userInteraction, vendor, component, cursor, limit
GET/v1/vulns/{id}
Get a record		—
GET/v1/vendors/{slug}/vulns
A vendor's records		q, sort, band, signal, exploited, cwe, product, published, fixStatus, impactType, attackVector, privileges, userInteraction, component, cursor, limit
GET/v1/kev
Known exploited vulnerabilities		since, cursor, limit
GET/v1/advisories/{id}
Get a vendor advisory		—
MCP

Tools

Add https://threatist.io/mcp to any client that supports remote MCP servers over HTTP, such as Claude, Cursor or VS Code. No key is needed; tool calls count against the same quota as REST requests. A record comes shortened by default, without CPE matches and with the strongest references; pass full: true to get all of it.

ToolWhat it returns
get_vulnerabilityA record for a TI id or an alias such as a CVE or GHSA id
search_vulnerabilitiesRecords matching a text and filters, a page at a time
list_exploitedRecent additions to CISA's Known Exploited Vulnerabilities catalogue
get_vendorA vendor's records, highest priority first
get_advisoryA Red Hat RHSA or Microsoft KB or ADV with its CVEs and records
Response

One record, every signal

A record as it appears in a list: aliases, scores, exploitation and fixes. The record itself carries everything on the record page.

See TI-2021-19919 on the site →
{
  "id": "TI-2021-19919",
  "aliases": [
    {
      "id": "CVE-2021-44228",
      "type": "CVE",
      "url": null
    },
    {
      "id": "GHSA-jfh8-c2jp-5v3q",
      "type": "GHSA",
      "url": null
    }
  ],
  "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
  "published": "2021-12-10",
  "cvss": {
    "version": "3.1",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "baseScore": 10,
    "severity": "CRITICAL",
    "source": "cisa-adp"
  },
  "epss": {
    "score": 0.99999,
    "percentile": 1,
    "date": "2026-11-06",
    "source": "epss"
  },
  "kev": {
    "dateAdded": "2021-12-10",
    "dueDate": "2021-12-24",
    "ransomware": "known",
    "source": "kev"
  },
  "priority": {
    "score": 100,
    "band": "CRITICAL",
    "confidence": "high"
  },
  "cwes": [
    {
      "id": "CWE-20",
      "name": "Improper Input Validation",
      "sources": [
        "cna",
        "ghsa:GHSA-jfh8-c2jp-5v3q"
      ]
    },
    {
      "id": "CWE-400",
      "name": "Uncontrolled Resource Consumption",
      "sources": [
        "cna",
        "ghsa:GHSA-jfh8-c2jp-5v3q"
      ]
    },
    {
      "id": "CWE-502",
      "name": "Deserialization of Untrusted Data",
      "sources": [
        "cna",
        "ghsa:GHSA-jfh8-c2jp-5v3q"
      ]
    },
    {
      "id": "CWE-917",
      "name": "Improper Neutralization of Special Elements used in an Expression Language Statement",
      "sources": [
        "ghsa:GHSA-jfh8-c2jp-5v3q",
        "nvd"
      ]
    }
  ],
  "fixAvailable": true,
  "links": {
    "html": "/vulns/TI-2021-19919",
    "self": "/v1/vulns/TI-2021-19919"
  }
}