{"uid":"cap_LjeRrKkIDL_ATsIBp6E54","slug":"relay402-package-vulnerability-checker-4455937b","name":"relay402 Package Vulnerability Checker","description":"Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Returns advisories with CVE aliases, severity, summary, fixed versions and reference links. Optional version narrows results to vulnerabilities affecting that exact version. Built for coding agents that install dependencies autonomously.","url":"https://relay402.georgespring.workers.dev/api/package-vulns","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["ecosystem","name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":64},"ecosystem":{"enum":["npm","PyPI","Go","Maven","crates.io","RubyGems","NuGet","Packagist"],"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_VOWW-F3cx_u8KBVnrh9v-","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a named package in a specified ecosystem (npm, PyPI, Go, etc.) for known security vulnerabilities and risk signals, returning a vulnerability assessment.","exampleAgentPrompt":"Before I add it to our project, can you check whether the npm package 'axios' version '1.6.0' has any known vulnerabilities?","exampleUseCases":[{"title":"Pre-install dependency safety check","prompt":"I'm about to install 'requests' version '2.28.0' from PyPI into our codebase — can you check if it has any known security vulnerabilities first?"},{"title":"CI pipeline package audit","prompt":"As part of our build pipeline, check if the Go module 'github.com/gin-gonic/gin' has any reported vulnerabilities so we can block the build if it does."},{"title":"Vendor supply-chain vetting","prompt":"We're evaluating a new vendor who uses the Maven package 'org.apache.log4j:log4j' — can you scan it for known CVEs before we approve the dependency?"}],"resultDescription":"Returns a vulnerability assessment for the specified package including risk score, risk level (e.g. low/medium/high/critical), and details of any known CVEs or security advisories found in the package version. May include counts of vulnerabilities by severity.","failureModes":["Package name not found in the specified ecosystem — returns 404 or empty result","Invalid ecosystem value — schema enforces enum, returns validation error","Version string malformed or too long — schema enforces maxLength:64","Payment not provided or insufficient — returns HTTP 402 requiring USDC payment on Base","Network or upstream vulnerability database unavailable — returns 5xx error","Package exists but has no vulnerability data — returns empty findings, not an error"],"whenToPreferThis":"Choose this endpoint when an AI agent needs a quick, pay-per-call vulnerability check on a specific package without managing API keys or subscriptions. It covers all major ecosystems (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist) in one interface. Prefer this over OSV or Snyk integrations when you need zero-setup auth via x402 micropayment, or when running in an autonomous agent context where credential management is impractical.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:42:16.796Z","isFirstParty":false}