{"uid":"cap_-L2AxCMIKmf-HLdaSAnBm","slug":"mcp-security-agentdiet-dev-real-time-open-source-package-cve-ghsa-746e5523","name":"Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)","description":"Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://mcp-security.agentdiet.dev/v1/osv-cve-vulnerability-radar)","url":"https://mcp-security.agentdiet.dev/v1/osv-cve-vulnerability-radar?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","required":["package"],"properties":{"package":{"type":"string","minLength":1,"description":"Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":[],"displayCostAmount":"0.01","displayCostAsset":"USD","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5JfLosCxJY9gdCG0xU9WF","protocol":"mpp","methodType":"crypto","chain":"tempo","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":"mcp-security.agentdiet.dev","brandSlug":"mcp-security-agentdiet-dev-mpp","brandBaseUrl":"https://mcp-security.agentdiet.dev","brandDocsUrl":null,"whatItDoes":"Queries Google OSV.dev in real time to return active CVEs, GHSA advisories, and patched versions for any PyPI, npm, Go, or Rust package.","exampleAgentPrompt":"Can you check if the PyPI package 'requests' has any active CVEs or GHSA advisories, and tell me which version fixes them?","exampleUseCases":[{"title":"Pre-deployment dependency security check","prompt":"Before I deploy this Python app, can you scan the PyPI:cryptography package for any known CVEs or GHSA advisories and let me know which version I should upgrade to?"},{"title":"npm package audit for CI pipeline","prompt":"I need to know if npm:lodash has any active security vulnerabilities right now — check OSV.dev and give me a list of CVEs and the patched versions I should pin to."},{"title":"Rust crate supply-chain risk review","prompt":"We're adding crates.io:hyper as a dependency — can you pull any known CVEs or GHSA advisories for it so I can assess the supply-chain risk before merging the PR?"}],"resultDescription":"Returns a structured object listing all active CVEs and GHSA advisories for the queried package, including affected version ranges, severity information, and the patched version(s) that resolve each vulnerability, sourced live from Google OSV.dev.","failureModes":["Package not found in OSV.dev — returns empty or error if the ecosystem/name combination is invalid","Malformed package identifier (missing ecosystem prefix) — may cause lookup failure or incorrect ecosystem assumption","OSV.dev upstream latency or downtime — endpoint may time out or return partial data","No vulnerabilities found — legitimate result for packages with a clean advisory record, not an error","Unsupported ecosystem — ecosystems outside PyPI, npm, Go, and crates.io may not return results"],"whenToPreferThis":"Choose this endpoint when you need real-time, live vulnerability data from the authoritative Google OSV.dev database for open-source packages across PyPI, npm, Go, or Rust ecosystems. Prefer it over static SBOM scanners or cached databases when freshness matters (e.g., CI/CD gates, pre-deployment checks, or live dependency audits). It is especially useful when you need structured CVE and GHSA advisory data with patched version recommendations without running a full local scanner.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:23:46.534Z","isFirstParty":false,"canonicalSlug":"mcp-security-agentdiet-dev-real-time-open-source-package-cve-ghsa-398bd891"}