{"uid":"cap_63Bol5nCSZDZhpZyRgdwD","slug":"arxiv-digest-agentdiet-dev-real-time-open-source-package-cve-ghsa-39e25460","name":"Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)","description":"Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://arxiv-digest.agentdiet.dev/v1/vuln-scanner)","url":"https://arxiv-digest.agentdiet.dev/v1/vuln-scanner?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","required":["package"],"properties":{"package":{"type":"string","minLength":1,"description":"Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":[],"displayCostAmount":"0.015","displayCostAsset":"USD","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.015/call","primary":{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.015","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.015","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_CYxUifRvPIfDOIQmh0c3a","protocol":"mpp","methodType":"crypto","chain":"tempo","mode":"charge","costAmount":"0.015","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":"arxiv-digest.agentdiet.dev","brandSlug":"arxiv-digest-agentdiet-dev-mpp","brandBaseUrl":"https://arxiv-digest.agentdiet.dev","brandDocsUrl":null,"whatItDoes":"Queries Google OSV.dev in real time to return active CVEs, GHSA advisories, and patched versions for a given PyPI, npm, Go, or Rust package.","exampleAgentPrompt":"Can you check if the PyPI package 'requests' has any known CVEs or GHSA security advisories right now, and tell me which version patches them?","exampleUseCases":[{"title":"Dependency security audit before release","prompt":"Before we ship, can you scan the npm package 'lodash' for any active CVEs or GitHub security advisories and tell me the fixed version I should upgrade to?"},{"title":"Go module vulnerability check in CI","prompt":"Check whether the Go module 'golang.org/x/net' has any known vulnerabilities or CVE listings I need to worry about for our pipeline."},{"title":"Rust crate supply chain risk review","prompt":"I'm evaluating adding 'hyper' as a Rust dependency — can you pull any active CVEs or GHSA advisories for the crates.io:hyper package so I can assess the risk?"}],"resultDescription":"Returns a structured object containing active CVE identifiers, GHSA advisory references, severity information, affected version ranges, and recommended patched versions for the queried package from Google's OSV.dev database.","failureModes":["Package not found in OSV.dev — returns empty or error result for misspelled or unsupported ecosystems","Invalid package format — if the 'Ecosystem:name' format is malformed, the API may return a validation error","No vulnerabilities found — a clean package returns an empty advisory list (not an error)","OSV.dev upstream unavailability — real-time dependency means outages in Google OSV.dev propagate as errors","Payment failure — HTTP 402 if x402 micropayment is not properly configured"],"whenToPreferThis":"Choose this endpoint when you need real-time, up-to-date CVE and GHSA vulnerability data for open-source packages across PyPI, npm, Go, or Rust ecosystems via a single lightweight call. It is backed directly by Google OSV.dev, making it more current than static vulnerability databases. Prefer it over manual OSV.dev queries when operating inside an agent or MCP workflow that needs structured JSON output with patched version guidance.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:22:44.107Z","isFirstParty":false,"canonicalSlug":"arxiv-digest-agentdiet-dev-real-time-open-source-package-cve-ghsa-8d6cb777"}