{"uid":"cap_0pAiOYgjTS4prs6Fd1FH9","slug":"cve-vulnerability-scan-for-software-packages-a989d509","name":"CVE Vulnerability Scan for Software Packages","description":"Vulnerability scan for a software package by ecosystem, name and version, or by package-URL (purl). Queries OSV.dev for known advisories, collects their CVE ids and enriches them with NVD CVSS, CISA KEV and EPSS, then returns a prioritized list of advisories with exact fixed versions. Risk indicators, not advice.","url":"https://api.agentstools.dev/cve/scan?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"name":{"type":"string","description":"Package name (Maven uses group:artifact)"},"purl":{"type":"string","description":"Package-URL instead of ecosystem/name/version, e.g. pkg:pypi/jinja2@2.4.1"},"version":{"type":"string","description":"Package version, e.g. 2.4.1"},"ecosystem":{"enum":["npm","PyPI","Maven","crates.io","Go","Packagist","RubyGems","NuGet"],"type":"string","description":"Package ecosystem"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":{"p10Cents":"2.0000","medianCents":"2.0000","p90Cents":"2.0000","minCents":"2.0000","maxCents":"2.0000","p95Cents":"2.0000","sampleCount":1,"varies":false,"failureChargeRate":1},"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_6QNZpHnJqdXG-HKcYjLSl","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a software package (by ecosystem/name/version or purl) for known CVE vulnerabilities, enriched with CVSS scores, CISA KEV status, and EPSS data, returning a prioritized advisory list with fixed versions.","exampleAgentPrompt":"Can you scan the PyPI package jinja2 version 2.4.1 for known CVEs and tell me their CVSS scores, whether any are in the CISA KEV list, and what version I should upgrade to to fix them?","exampleUseCases":null,"resultDescription":"A prioritized list of security advisories for the queried package, each including CVE ID(s), CVSS severity score (from NVD), EPSS exploitation probability, CISA KEV flag, affected version ranges, and the exact fixed version to upgrade to.","failureModes":["Package not found in OSV.dev — returns empty advisory list or 404","Invalid purl format — returns 400 validation error","Ecosystem/name/version combination not recognized — empty results","NVD or EPSS enrichment unavailable — advisory returned without full scoring data","Version string malformed — query fails with parameter validation error"],"whenToPreferThis":"Use this endpoint when you need a fast, enriched CVE lookup for a specific package version across major ecosystems (npm, PyPI, Maven, crates.io, Go, Packagist, RubyGems, NuGet). It combines OSV.dev advisories with NVD CVSS, CISA KEV, and EPSS in a single call, saving the need to query four separate APIs. Prefer it over raw OSV.dev when you need risk prioritization signals and exact remediation versions in one response.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T00:56:49.190Z","isFirstParty":false,"canonicalSlug":"cve-vulnerability-scan-for-software-packages-a989d509"}