Attestd

Attestd is a security data API that translates CVE advisories, NVD data, CISA KEV signals, and supply chain integrity events into deterministic, machine-readable fields for autonomous systems and AI agent pipelines. Vulnerability data from NVD, MITRE, and vendor advisories is written for human analysts. It is not structured for programmatic consumption. As AI agents make autonomous deployment and infrastructure decisions at machine speed, the security data layer must operate at the same speed or it becomes the bottleneck. Attestd returns structured boolean and categorical signals an agent can branch on directly. Same version always returns the same risk_state given the same underlying data. No interpretation required. Coverage includes 350 CVE products across databases, web servers, container runtimes, message queues, language runtimes, auth and identity, CI/CD, service mesh, and observability tooling. Supply chain integrity signals cover 256,000+ packages across PyPI and npm, with an automated qualification pipeline running on a 6-hour cycle. Native integrations for LangChain, CrewAI, and AutoGen. Python SDK on PyPI. JavaScript SDK on npm with Sigstore provenance. MCP server available on npm and via hosted HTTP transport at mcp.attestd.io. Attestd is not a scanner. It does not access internal systems. It is a persistent security perception layer designed to be queried continuously as infrastructure and dependencies change.