{"uid":"cap_5KD2m1fXlCQrr3nXgQ_I2","slug":"pkgpulse-vulnerability-audit-get-1c97e487","name":"pkgpulse Vulnerability Audit (GET)","description":"Dependency intelligence for AI coding agents, paid per-call via x402 (USDC on Base): npm package health scores with a disclosed rubric, typosquat checks, dependency audits, OSV known-vulnerability scans (npm, PyPI, Go, crates.io, Maven and more) and PyPI preflight checks. Free index at /, free sample at /api/sample.","url":"https://pkgpulse.letom1176.workers.dev/api/vuln-audit?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["packages"],"properties":{"packages":{"type":"string","description":"Comma-separated name@version items; prefix pypi:, go:, crates:, maven: for other ecosystems (npm default)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"summary":{"scanned":200,"packages":214,"malicious":0,"not_found":0,"vulnerable":9,"advisories_by_severity":{"low":2,"high":5,"medium":8,"critical":1}},"verdict":"fix now: critical or high severity vulnerabilities present","input_format":"package-lock.json","worst_offenders":[{"package":"npm:@babel/traverse@7.22.0","upgrade_to":"7.23.2","vuln_count":1,"max_severity":"critical"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.015","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_7DU-H3SDHSQXwi_j_JMsa","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a comma-separated list of packages across npm, PyPI, Go, crates.io, Maven and more for known OSV vulnerabilities, returning severity-ranked advisories and a fix verdict.","exampleAgentPrompt":"Can you scan these packages for known vulnerabilities: lodash@4.17.20, pypi:requests@2.28.0, and @babel/traverse@7.22.0 — and tell me which ones are critical or high severity and what I should upgrade to?","exampleUseCases":[{"title":"Pre-deploy security gate for Node app","prompt":"Before I deploy, scan these npm packages for known vulnerabilities: express@4.18.1, axios@0.21.1, jsonwebtoken@8.5.1 — flag anything critical or high and tell me what to upgrade to."},{"title":"Python data pipeline dependency audit","prompt":"Check these PyPI packages for security issues: pypi:numpy@1.23.0, pypi:pandas@1.4.2, pypi:requests@2.27.0 — I need to know the worst offenders and severity levels before I push to production."},{"title":"Multi-ecosystem monorepo vulnerability check","prompt":"Audit my mixed dependencies for OSV vulnerabilities: lodash@4.17.20, go:golang.org/x/net@0.0.0-20220425223048-2871e0cb64e4, crates:serde@1.0.130 — give me a severity breakdown and tell me if anything is critical."}],"resultDescription":"A JSON object with a summary (total packages scanned, counts of malicious/not-found/vulnerable, advisories broken down by severity: low/medium/high/critical), a human-readable verdict string (e.g. 'fix now: critical or high severity vulnerabilities present'), the detected input format, and a worst_offenders array listing each vulnerable package with its recommended upgrade version, vulnerability count, and maximum severity.","failureModes":["Missing or malformed 'packages' query parameter returns a 400 error","Unknown package names return a not_found count in summary but do not fail the request","Payment not included or insufficient USDC returns HTTP 402 requiring x402 payment","Ecosystem prefix typo (e.g. 'pip:' instead of 'pypi:') may cause package not found","Rate limiting or upstream OSV database unavailability may cause 5xx errors"],"whenToPreferThis":"Use this endpoint when you need a fast, per-call vulnerability scan across one or more packages from multiple ecosystems in a single query, especially when you want OSV-backed severity rankings and concrete upgrade advice. Prefer it over the POST batch audit endpoint when you have a short list of specific packages rather than a full package-lock.json or requirements file. It is the right choice for pre-deploy checks, CI pipeline spot-checks, or when an agent needs to verify a handful of dependencies on demand without uploading a full manifest.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T12:31:04.854Z","isFirstParty":false,"canonicalSlug":"pkgpulse-vulnerability-audit-get-1c97e487"}