{"uid":"cap_1dWqyvW0O3ctSiwAsNhNh","slug":"sicher-cve-check-package-vulnerability-scanner-deed6825","name":"Sicher CVE Check — Package Vulnerability Scanner","description":"Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities found with their identifiers, severity and summary, and the single figure that decides what to do next: the lowest version that fixes all of them, derived from the fixed-version events in the affected ranges.","url":"https://sicher.halowerk.com/v1/cve-check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"packages":{"type":"array","items":{"type":"object","required":["name","version"],"properties":{"name":{"type":"string","maxLength":200,"minLength":1,"description":"Package name as the ecosystem spells it."},"version":{"type":"string","maxLength":60,"minLength":1,"description":"Exact installed version."},"ecosystem":{"type":"string","maxLength":30,"description":"Ecosystem, e.g. npm, PyPI, Go. Defaults to the top-level value."}},"additionalProperties":false},"maxItems":100,"minItems":1,"description":"The packages to check."},"ecosystem":{"type":"string","default":"npm","maxLength":30,"description":"Default ecosystem for entries that do not name one."},"min_severity":{"enum":["low","medium","high","critical"],"type":"string","description":"Only report findings at or above this severity."},"include_details":{"type":"boolean","default":true,"description":"Fetch summary and severity per finding. Off is faster but returns ids only."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_aYSrIoR3CPTqw4MQOAfKM","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Queries OSV.dev for vulnerabilities across multiple package ecosystems and returns CVE identifiers, severity, summaries, and the minimum fixed version for each affected package.","exampleAgentPrompt":"Check if lodash version 4.17.20 on npm has any known CVEs and tell me the lowest version I should upgrade to in order to fix all of them.","exampleUseCases":[{"title":"Audit CI pipeline for vulnerable dependencies","prompt":"Before we ship this release, check whether express version 4.18.1 on npm has any known vulnerabilities and what the minimum safe version is that patches everything."},{"title":"Python library security review","prompt":"I'm using requests 2.27.0 from PyPI — does it have any CVEs, and what's the earliest version I can upgrade to that resolves all of them?"},{"title":"Go module vulnerability check","prompt":"Scan golang.org/x/net at version 0.0.0-20220425223048-2871e0cb64e4 in the Go ecosystem for known security issues and give me the fixed version I should target."}],"resultDescription":"Returns a list of vulnerabilities for each queried package, including CVE/OSV identifiers, severity ratings, human-readable summaries, and the single lowest package version that resolves all identified vulnerabilities, derived from fixed-version events in the affected ranges.","failureModes":["Package not found in the specified ecosystem — returns empty vulnerability list","Unknown or malformed ecosystem name — returns validation error","OSV.dev upstream unavailable — returns gateway or timeout error","Invalid package version format — returns parse error","Rate limiting or payment failure — returns 402 or 429 status"],"whenToPreferThis":"Choose this endpoint when you need to check specific package versions against known CVEs across multiple ecosystems (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Linux distros) and want a single actionable 'minimum fixed version' output, rather than a full SBOM scan or licence audit. It is ideal for spot-checking individual dependencies in CI pipelines or agent-driven security workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:38:05.568Z","isFirstParty":false,"canonicalSlug":"sicher-cve-check-package-vulnerability-scanner-deed6825"}