{"uid":"cap_O0gXdL8gccjKJ-TvTEjma","slug":"signaldesk-ai-osv-batch-vulnerability-lookup-9dd0be8c","name":"SignalDesk AI OSV Batch Vulnerability Lookup","description":"Evidence-backed autonomous AI jobs and paid data tools. Queue/D1/cron run outside the chat; free quotas and bounded execution apply.","url":"https://x402-agent.kariguetoazul.workers.dev/api/security/osv-batch?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"queries":{"type":"array","items":{"type":"object","required":["ecosystem","package","version"],"properties":{"package":{"type":"string","maxLength":200,"minLength":1,"description":"Package name."},"version":{"type":"string","maxLength":100,"minLength":1,"description":"Exact version."},"ecosystem":{"enum":["npm","PyPI","Maven","crates.io","Go","RubyGems","NuGet"],"type":"string","maxLength":4096,"description":"OSV ecosystem."}},"additionalProperties":false},"maxItems":10,"minItems":1,"description":"Package/version queries."}}},"responseSchema":{"type":"json","example":{"source":{"provider":"OSV","expires_at":"2026-10-02T10:14:48.075Z","fetched_at":"2026-10-02T09:44:48.075Z","source_url":"https://api.osv.dev/v1/querybatch","transformed":true},"results":[{"package":"lodash","version":"4.17.15","ecosystem":"npm","vulnerabilities":[{"id":"GHSA-29mw-wpgm-hmr9","modified":"2025-09-29T21:12:31.102523Z"},{"id":"GHSA-35jh-r3h4-6jhm","modified":"2026-09-10T03:49:04.067984Z"},{"id":"GHSA-f23m-r3pf-42rh","modified":"2026-09-10T03:50:44.050013Z"},{"id":"GHSA-p6mc-m468-83gw","modified":"2025-08-12T21:56:17.174859Z"},{"id":"GHSA-r5fr-rjxr-66jc","modified":"2026-09-10T03:51:02.970455Z"},{"id":"GHSA-xxjr-mmjv-4gpg","modified":"2026-09-10T03:50:33.722177Z"}]}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.006","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.006/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_rVCzclbCsiVfMSQ-gtYU1","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.006","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Batch-queries the OSV (Open Source Vulnerabilities) database to find known CVEs and security advisories for up to 10 package/version/ecosystem combinations in a single call.","exampleAgentPrompt":"Check OSV for known vulnerabilities in lodash 4.17.15 on npm, axios 0.21.1 on npm, and requests 2.25.0 on PyPI — I need a list of any GHSA or CVE IDs affecting those versions.","exampleUseCases":[{"title":"Dependency audit before production release","prompt":"Before we deploy, can you check OSV for any known CVEs in express 4.17.1 on npm, django 3.2.0 on PyPI, and spring-core 5.3.0 on Maven?"},{"title":"CI pipeline security gate for Go modules","prompt":"I need to verify these Go packages are safe: golang.org/x/crypto version 0.0.0-20200622213623 and golang.org/x/net version 0.0.0-20200226121028 — pull their OSV vulnerability records for me."},{"title":"Triage open source supply chain risk","prompt":"Can you batch-check OSV for vulnerabilities in these crates.io packages: serde 1.0.130, tokio 1.10.0, and hyper 0.14.4? I want to see any security advisories before adding them to our Rust project."}],"resultDescription":"Returns a JSON object with source metadata (provider, fetch time, expiry, source URL) and a results array. Each result maps a package/version/ecosystem tuple to its list of known vulnerabilities, where each vulnerability includes its GHSA/CVE ID and the date it was last modified in the OSV database.","failureModes":["Missing required fields (package, version, or ecosystem) returns a validation error","Unsupported ecosystem value outside the allowed enum returns a schema error","Querying more than 10 packages in a batch exceeds maxItems and is rejected","Unknown or misspelled package names return an empty vulnerability list (not an error)","Upstream OSV API unavailability causes a proxy error or timeout","Payment failure (x402) blocks the request before it reaches OSV"],"whenToPreferThis":"Use this endpoint when you need to batch-check multiple packages across different ecosystems for known vulnerabilities in a single API call, rather than making separate requests per package. It is especially useful in CI/CD pipelines, dependency audits, or agent workflows where you need evidence-backed, OSV-sourced security data with minimal round-trips. Prefer this over direct OSV API calls when you need x402 micropayment-gated access with structured response caching.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T00:42:07.898Z","isFirstParty":false,"canonicalSlug":"signaldesk-ai-osv-batch-vulnerability-lookup-9dd0be8c"}