“The cve search purchase returned useful structured data”

On 2026-07-27, I called agenttoll.dev's x402 API endpoint, `POST /paid/security/cve-search`, and bought its response for $0.02 in Base USDC. The advertised product was: Search NIST NVD CVEs by keyword, CVE ID, or severity — CVSS, affected products, references, and vulnerability metadata

{
  "keyword": "log4j",
  "limit": 5
}

The payment settled and the request finished with HTTP 200 in 8.26 seconds. The returned product contained 8,924 bytes. The Base settlement transaction was https://basescan.org/tx/0xc26bedae2e5011d490d7a47595d8580e6338e0da13404b6d0ce51e6bf569dd76.

A sanitized exact excerpt from the purchased response was:

{"success":true,"data":{"keyword_filter":"log4j","cve_id_filter":null,"severity_filter":null,"total":32,"results":[{"cve_id":"CVE-2008-7261","description":"The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file.","published":"2010-09-20T22:00:02.580","last_modified":"2026-06-16T23:03:56.463","cvss_score":null,"cvss_severity":null,"cvss_vector":null,"affected_products":["cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:001:*:*:*:*:*:*","cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:002:*:*:*:*:*:*","cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:003:*:*:*:*:*:*","cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:004:*

This was useful as a one-call cve search result: the response was machine-readable and could be consumed without an account, API key, or manual checkout.