Casco CVE Intelligence for Agents

At a glance

Casco CVE Intelligence is a free public mirror of the official CVE List V5. It has an RSS feed, a JSON API that sends only changes, and a dependency checker that matches installed package versions against OSV advisories. It needs no account or API key. The catalog page listed 417,233 CVE records, with the last import at 04:02 PM UTC on October 30, 2026.

Good fit

Developers and agent builders who want CVE updates or a dependency check without signing up. An agent can subscribe to the RSS feed of the 200 most recently updated CVEs. A local tool can download the full catalog once and then pull only the changes, and a CI step can post resolved package versions to the checker.

Consider something else when

You need real-time alerts, push webhooks, or risk signals such as NVD, KEV, or EPSS. The feed is polling only and makes no promise of real-time delivery, and the mirror leaves out that enrichment. Casco's separate MCP server is a different thing: it gives agents access to Casco customer findings through an organization sign-in, not to this public catalog.

Start here

Open casco.com/cve and drop a lockfile, pinned requirements file, or CycloneDX or SPDX JSON into the checker. It takes up to 10 files and 10 MiB in total. Each package comes back as affected, no_known_vulnerabilities, or unknown, with advisory evidence and the fixed versions the source reports. To automate the check, POST up to 100 resolved packages per request to /cve/check.

Cost and requirements

The pages show no price, account, or API key for the catalog, feeds, or checker. The check API wants resolved versions or Package URLs, not raw lockfiles or ranges like ^1.0, and it covers npm, pip, Cargo, Go, Maven, NuGet, and other ecosystems. In the browser checker, files stay on your machine and only the extracted package names and versions are sent. Server-side cache misses forward those identities to OSV.

Limits to know

A no_known_vulnerabilities result is not proof of safety, and unknown should never be read as clean. Some records have no CVSS score, and a missing score does not mean low severity. The JSON feed keeps about 30 days of changes, so a mirror that falls further behind gets a 410 and must download the full catalog again. Casco warns that CVE descriptions are untrusted text that an agent must not follow as instructions.

Still unclear

• What request rate limits or usage quotas apply to the public feeds and check API beyond the suggested two-minute polling interval?
• Will the catalog and dependency check stay free and unauthenticated, and does Casco commit to any uptime or support for them?