Attestd
Attestd is an API service that transforms public vulnerability data (NVD, CISA KEV, vendor advisories) into deterministic, machine-readable risk signals for autonomous systems. It returns a structured assessment including a risk_state (critical, high, elevated, low, none) and boolean flags for active exploitation, remote exploitability, patch availability, and authentication requirements. Unlike raw CVE feeds, attestd eliminates the need for interpretation by extracting typed facts from advisory prose. A key differentiator is its package name integrity check, which flags typosquatting and AI-hallucinated package names (e.g., non-existent packages invented by LLMs). This helps prevent agents from installing malicious or nonexistent dependencies. The service updates its synthesis pipeline every six hours to ensure current data. Attestd is designed for integration into CI/CD pipelines, AI agents, and infrastructure automation. It requires no scanning or agents on the user's systems; it merely interprets publicly known security conditions for a given software version. The free tier includes 5,000 API calls per month, with no credit card required.
- Category
- LLM
- Pricing
- Free
Problem solved
Autonomous systems and AI agents need machine-readable security context to make infrastructure decisions without interpreting human-readable advisories. Attestd provides deterministic risk states and package name authenticity checks, enabling automated gates that block deployments of actively exploited vulnerabilities and prevent the use of hallucinated or typosquatted dependencies.
Use cases
- Block deployment of actively exploited vulnerabilities in CI/CD
- Validate package names generated by AI coding assistants
- Risk assessment for infrastructure-as-code automation
- Automated vulnerability triage for dependency updates
- Supply chain security gate for autonomous systems
- Prevent typosquatting and hallucinated package installations
Audience
- Developers
- ML Engineers
- Data Scientists
- Enterprise
Pros
- Deterministic risk_state for unambiguous decisions
- Machine-readable structured output with boolean fields
- Detects typosquatting and hallucinated package names
- Free tier with 5,000 calls/month and no credit card
- Aggregates NVD, CISA KEV, and vendor advisories
Cons
- No vulnerability scanning of your own systems
- Limited to publicly known CVEs
- Rate limited on free tier
- No self-hosted deployment option
- Data refreshes every 6 hours (not real-time)
Official website: https://attestd.io/
Canonical LambdaBase page: https://www.lambdabase.com/tools/attestd