{"uid":"cap_4ITtV4xiZCCiSMewYHGTT","slug":"mekler-ai-package-vulnerability-checker-2687991e","name":"Mekler AI Package Vulnerability Checker","description":"Check an exact PyPI or npm package version against OSV advisories, group aliases and report affected/fixed version evidence and CISA known exploitation. Preserve source disagreements, withdrawn records, unsupported ranges and dated coverage. No dependency traversal, malware scan, registry existence check or safety guarantee. 0.01 USDC per completed diagnostic; source failures and incomplete pagination are uncharged.","url":"https://api.mekler.ai/v1/data/packages/check-version-vulnerabilities?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string","maxLength":128},"version":{"type":"string","maxLength":80,"minLength":1},"ecosystem":{"enum":["pypi","npm"],"type":"string"},"request_id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,64}$"}}},"responseSchema":{"type":"json","example":{"name":"requests","status":"ok","verdict":"affected","version":"2.19.0","coverage":{"pages":1,"kev_count":1,"kev_source":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","osv_source":"https://api.osv.dev/v1/query","query_complete":true,"kev_released_at":"2026-10-20T00:00:00Z","advisory_records":1,"withdrawn_records":0,"kev_catalog_version":"2026.10.20"},"ecosystem":"pypi","advisories":[{"id":"GHSA-mekl-0000-0001","version_status":"affected","known_exploitation":[{"cve":"CVE-2026-99901","due_date":"2026-11-10","date_added":"2026-10-20","ransomware_use":"Unknown"}],"fixed_versions_reported":["2.20.0"]}],"limitations":["No known matches means no affected version found in this bounded OSV response; unknown, unpublished, missing or newly changed advisories remain possible."],"observed_at":"2026-10-21T00:00:00Z","vulnerability_groups":[{"identifiers":["CVE-2026-99901","GHSA-mekl-0000-0001"],"advisory_ids":["GHSA-mekl-0000-0001"],"version_status":"affected","source_disagreement":false}],"withdrawn_advisory_ids":[]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pge71lqVKtj95geevxP1V","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an exact PyPI or npm package version against OSV advisories and CISA KEV catalog, returning grouped CVE/GHSA records with affected/fixed version evidence and known exploitation data.","exampleAgentPrompt":"Can you check whether the PyPI package 'requests' version 2.19.0 has any known vulnerabilities in OSV or the CISA exploited list?","exampleUseCases":[{"title":"Security audit before deployment","prompt":"Before we ship, check if the npm package 'lodash' version 4.17.4 has any known CVEs or GHSA advisories and whether CISA considers it actively exploited."},{"title":"CI pipeline vulnerability gate","prompt":"Check the PyPI package 'Pillow' version 9.0.0 against OSV advisories — tell me if it's affected, what the fixed versions are, and if it appears in the CISA KEV catalog."},{"title":"Triage a flagged dependency","prompt":"Our security scanner flagged 'axios' version 0.21.1 on npm — can you look it up in OSV and CISA to see exactly which vulnerabilities affect that version and what's available as a fix?"}],"resultDescription":"Returns a JSON object with verdict (affected/unaffected/unknown), grouped vulnerability records aliasing CVE and GHSA IDs, per-advisory version status (affected/fixed/unaffected), fixed version lists, CISA known exploitation entries with due dates, coverage metadata (pages queried, query completeness, KEV catalog version), withdrawn advisory IDs, source disagreement flags, and a list of limitations about what is not checked.","failureModes":["OSV API pagination incomplete — returns partial results uncharged","CISA KEV source fetch failure — endpoint returns without KEV data, uncharged","Invalid ecosystem value (not 'pypi' or 'npm') — validation error","Package name or version exceeds length limits — schema validation error","Package not found in OSV — returns verdict with no advisories but no error","Newly published advisories not yet indexed — may produce false negatives","Withdrawn advisories excluded — may cause confusion if only known by that ID"],"whenToPreferThis":"Use this endpoint when you need to check a specific, exact package version (not a range or unpinned dependency) against OSV and CISA KEV for point-in-time vulnerability status. It is ideal for CI/CD gates, deployment audits, and security triage where you have a known pinned version. It does NOT perform dependency graph traversal, malware scanning, or registry existence checks — use other tools for those needs. Prefer this over generic web searches when you need structured, machine-readable advisory data with grouped aliases and exploitation evidence.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T06:44:07.197Z","isFirstParty":false,"canonicalSlug":"mekler-ai-package-vulnerability-checker-2687991e"}