Read-only reference implementation of the AVE (Agentic Vulnerability Enumeration) standard's record lookup API.
This is a reference implementation, not the standard. AVE itself, the records and schema, lives in aveproject/ave. This service is a thin, read-only lookup layer over that data, provided so implementers have a working example to call or fork rather than parsing raw JSON files themselves. Anyone can run their own instance; nothing about AVE depends on this specific deployment staying available.
| Method | Path | Description |
|---|---|---|
| GET | / |
Service info, record count, cache age |
| GET | /records |
All records |
| GET | /records/{ave_id} |
One record |
| GET | /records/{ave_id}/mitigation |
The record's neutral mitigation object only |
| GET | /search?q=... |
Substring search across title, description, attack class, behavioral fingerprint |
| GET | /docs |
Interactive OpenAPI docs (auto-generated) |
No authentication. No write endpoints. Rate limited to 60 requests/minute per IP as a basic abuse backstop, generous for any legitimate use.
pip install -r requirements.txt
uvicorn main:app --reloadFetches dist/ave-records-latest.json from
aveproject/ave on startup and every 15
minutes thereafter. This repo holds no copy of the record data itself;
aveproject/ave is the single source of truth.
Deployed on Render. See ARCHITECTURE.md's ADR section for why Render was
chosen over Cloud Run and Vercel, and what would have to change to revisit
that.
See CONTRIBUTING.md.
See SECURITY.md.
Apache 2.0, see LICENSE.