attestd is a CVE API for developers. Convert public vulnerability data and active exploitation signals into deterministic, machine-readable risk signals your automation and AI agents can act on directly.

I built Attestd because AI agents are making deployment and infrastructure decisions faster than humans can supervise, and the security data layer wasn't built for that world. Every CVE feed and vulnerability advisory is formatted for a human analyst to read. None of it is structured for an autonomous system to branch on. Since launching the supply chain pipeline, it has caught compromised packages across LiteLLM, PyTorch Lightning, Bitwarden CLI, TanStack, node-ipc, and others before public disclosure. All flagged as risk_state: none with supply_chain.compromised: true. One case came in 2.5 hours before BleepingComputer published. If you are building AI agents that make autonomous decisions about infrastructure or dependencies, that is exactly the use case Attestd is built for.

How are you actually pulling the "active exploitation signals" part, since most public feeds are pretty noisy and lag behind what's really being exploited in the wild?

how does the active exploitation signal get refreshed, and is there a way to plug attestd into something like a GitHub Actions workflow to fail a build on a new CVE?

How are you actually pulling the "active exploitation signals" part, since most public feeds are pretty noisy and lag behind what's really being exploited in the wild?

how does the active exploitation signal get refreshed, and is there a way to plug attestd into something like a GitHub Actions workflow to fail a build on a new CVE?

attestd

CVE and supply chain risk signals for autonomous AI agents.

CVE and supply chain risk signals for autonomous AI agents.