Roundhouse

Dragons Eye Lookup

Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less.

OtherLiveeip155:8453Exactvia facilitator:payAI
https://api.ransomware-tracker.com/v1/cve-batch
CveBulkKevEpssVulnerability
Calls · 30d
1
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 15 snapshots so far.
$40.97
Verified settled volume
185 settlements proven x402 by their on-chain EIP-3009 marker.
$0.500
Listed price
As published in the catalog. Always read the live 402 before paying.
—
Calls · 30d
Upstream's own call count for this endpoint, not ours.
—
Unique payers · 30d
Never called
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x2dAF658B01e257206375798a15832E9f547D65dD

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "offer": {
    "asset": "USDC",
    "input": {
      "type": "http",
      "method": "GET",
      "queryParams": {
        "ids": "CVE-2026-0257,CVE-2026-20182"
      }
    },
    "price": "$0.50",
    "network": "eip155:8453",
    "mime_type": "application/json",
    "how_to_pay": "x402 v2: sign the accepts[0] requirement and retry with the PAYMENT-SIGNATURE header (challenge also in the PAYMENT-REQUIRED header). Invalid input is answered before payment and never charged.",
    "input_schema": {
      "type": "object",
      "required": [
        "type",
        "method"
      ],
      "properties": {
        "type": {
          "type": "string",
          "const": "http"
        },
        "method": {
          "enum": [
            "GET"
          ],
          "type": "string"
        },
        "queryParams": {
          "type": "object",
          "required": [
            "ids"
          ],
          "properties": {
            "ids": {
              "type": "string",
              "maxLength": 1000,
              "description": "Comma-separated CVE ids, max 50"
            }
          }
        }
      },
      "additionalProperties": false
    },
    "price_atomic": "500000",
    "what_you_get": "Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less.",
    "output_schema": {
      "type": "object",
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string"
        },
        "example": {
          "type": "object"
        }
      }
    },
    "sample_output": {
      "covered": 2,
      "results": [
        {
          "cve_id": "CVE-2026-0257",
          "summary": {
            "cvss_v3": 9.1,
            "cvss_v3_severity": "CRITICAL",
            "affected_products": [
              "pan-os"
            ]
          },
          "defenses": {
            "countermeasures": [
              {
                "url": "https://d3fend.mitre.org/technique/d3f:SoftwareUpdate/",
                "label": "Software Update",
                "tactic": "Harden",
                "d3fend_id": "D3-SU"
              }
            ]
          },
          "exploits": {
            "count": 9,
            "items": [
              {
                "url": "https://github.com/example/CVE-2026-0257",
                "name": "example/CVE-2026-0257",
                "stars": 1
              }
            ]
          },
          "attack_flow": {
            "steps": [
              {
                "step": "initial_access",
                "label": "Exploit public-facing application",
                "tactic": "TA0001",
                "technique": "T1190"
              }
            ],
            "status": "ok",
            "ai_generated": true
          },
          "exploitation": {
            "epss": 0.969,
            "in_kev": true,
            "ransomware_use": "Unknown",
            "has_public_exploit": true
          },
          "data_refreshed_at": "2026-10-17T06:00:00Z"
        }
      ],
      "requested": 2,
      "not_covered": []
    },
    "related_endpoints": [
      {
        "url": "https://api.ransomware-tracker.com/v1/lookup",
        "price": "$0.01",
        "method": "GET",
        "description": "Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sourc"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/recent",
        "price": "$0.01",
        "method": "GET",
        "description": "Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusabl"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/group",
        "price": "$0.02",
        "method": "GET",
        "description": "Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups r"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/batch",
        "price": "$0.05",
        "method": "GET",
        "description": "Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for "
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/vendor-report",
        "price": "$3",
        "method": "GET",
        "description": "Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/bulk-check",
        "price": "$0.50",
        "method": "GET",
        "description": "Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for ris"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/watch",
        "price": "$0.30",
        "method": "POST",
        "description": "Dragons Eye Lookup: Prepaid vendor ransomware watch: up to 25 vendors for 30 days, webhook on new claims. Pay once; each vendor (domain or company name) is re-checked about once a day for 30 days. Whe"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/indicator-check",
        "price": "$0.01",
        "method": "GET",
        "description": "Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clu"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/indicator-batch",
        "price": "$0.25",
        "method": "GET",
        "description": "Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. "
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/cve",
        "price": "$0.03",
        "method": "GET",
        "description": "Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, publi"
      },
      {
        "url": "https://api.ransomware-tracker.com/v1/group-intel",
        "price": "$0.05",
        "method": "GET",
        "description": "Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported to"
      }
    ]
  },
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
      "amount": "500000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 120
    }
  ],
  "resource": {
    "url": "https://api.ransomware-tracker.com/v1/cve-batch",
    "tags": [
      "cve",
      "bulk",
      "kev",
      "epss",
      "vulnerability"
    ],
    "mimeType": "application/json",
    "description": "Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less.",
    "serviceName": "Dragons Eye Lookup"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "method": "GET",
          "queryParams": {
            "ids": "CVE-2026-0257,CVE-2026-20182"
          }
        },
        "output": {
          "type": "json",
          "example": {
            "covered": 2,
            "results": [
              {
                "cve_id": "CVE-2026-0257",
                "summary": {
                  "cvss_v3": 9.1,
                  "cvss_v3_severity": "CRITICAL",
                  "affected_products": [
                    "pan-os"
                  ]
                },
                "defenses": {
                  "countermeasures": [
                    {
                      "url": "https://d3fend.mitre.org/technique/d3f:SoftwareUpdate/",
                      "label": "Software Update",
                      "tactic": "Harden",
                      "d3fend_id": "D3-SU"
                    }
                  ]
                },
                "exploits": {
                  "count": 9,
                  "items": [
                    {
                      "url": "https://github.com/example/CVE-2026-0257",
                      "name": "example/CVE-2026-0257",
                      "stars": 1
                    }
                  ]
                },
                "attack_flow": {
                  "steps": [
                    {
                      "step": "initial_access",
                      "label": "Exploit public-facing application",
                      "tactic": "TA0001",
                      "technique": "T1190"
                    }
                  ],
                  "status": "ok",
                  "ai_generated": true
                },
                "exploitation": {
                  "epss": 0.969,
                  "in_kev": true,
                  "ransomware_use": "Unknown",
                  "has_public_exploit": true
                },
                "data_refreshed_at": "2026-10-17T06:00:00Z"
              }
            ],
            "requested": 2,
            "not_covered": []
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method"
            ],
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "type": "object",
                "required": [
                  "ids"
                ],
                "properties": {
                  "ids": {
                    "type": "string",
                    "maxLength": 1000,
                    "description": "Comma-separated CVE ids, max 50"
                  }
                }
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

0.5USDC≈ $0.5 USD
on Base · exact scheme

Pay 0.5 USDC on Base to 0x2dAF…D65dD. The signed payment is good for 2 minutes.

Paid to
0x2dAF…D65dD
USD Coin contract
0x8335…02913
Payment window
2 minutes
As published
500000 smallest units
The catalog’s raw entry
[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
    "amount": "500000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 120
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "type": "http",
        "method": "GET",
        "queryParams": {
          "ids": "CVE-2026-0257,CVE-2026-20182"
        }
      },
      "output": {
        "type": "json",
        "example": {
          "covered": 2,
          "results": [
            {
              "cve_id": "CVE-2026-0257",
              "summary": {
                "cvss_v3": 9.1,
                "cvss_v3_severity": "CRITICAL",
                "affected_products": [
                  "pan-os"
                ]
              },
              "defenses": {
                "countermeasures": [
                  {
                    "url": "https://d3fend.mitre.org/technique/d3f:SoftwareUpdate/",
                    "label": "Software Update",
                    "tactic": "Harden",
                    "d3fend_id": "D3-SU"
                  }
                ]
              },
              "exploits": {
                "count": 9,
                "items": [
                  {
                    "url": "https://github.com/example/CVE-2026-0257",
                    "name": "example/CVE-2026-0257",
                    "stars": 1
                  }
                ]
              },
              "attack_flow": {
                "steps": [
                  {
                    "step": "initial_access",
                    "label": "Exploit public-facing application",
                    "tactic": "TA0001",
                    "technique": "T1190"
                  }
                ],
                "status": "ok",
                "ai_generated": true
              },
              "exploitation": {
                "epss": 0.969,
                "in_kev": true,
                "ransomware_use": "Unknown",
                "has_public_exploit": true
              },
              "data_refreshed_at": "2026-10-17T06:00:00Z"
            }
          ],
          "requested": 2,
          "not_covered": []
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method"
          ],
          "properties": {
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "GET"
              ],
              "type": "string"
            },
            "queryParams": {
              "type": "object",
              "required": [
                "ids"
              ],
              "properties": {
                "ids": {
                  "type": "string",
                  "maxLength": 1000,
                  "description": "Comma-separated CVE ids, max 50"
                }
              }
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog
2026-10-24 14:34Z
Last indexed by Roundhouse
2026-10-26 20:46Z
Last enriched (probe, favicon, geo)
2026-10-24 17:16Z
x402 version
2
Max timeout
120s
Liveness probe
HTTP 402
Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 15 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md
Show the prompt
Using Roundhouse, look up the x402 service Dragons Eye Lookup and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=Dragons%20Eye%20Lookup'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://api.ransomware-tracker.com/v1/cve-batch, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.