{"uid":"cap_RtA-X4SXlWVVbl_QKUKv1","slug":"tokenguard-dev-vulnerabilities-endpoint-7a1826d3","name":"TokenGuard Dev Vulnerabilities Endpoint","description":"Known vulnerabilities for a package (OSV.dev — aggregate of GHSA, PyPA, RustSec, Go and more) or a free-text CVE search (NVD), with severity and fixed versions","url":"https://eltociear-tokenguard.hf.space/dev/vulns","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string","description":"Package name"},"query":{"type":"string","description":"Free-text CVE search instead of a package"},"version":{"type":"string","description":"Pin to one version (optional)"},"ecosystem":{"type":"string","description":"npm | PyPI | crates.io | Go | Maven | RubyGems (default npm)"}}},"responseSchema":{"type":"json","example":{"count":1,"package":"lodash","ecosystem":"npm","vulnerable":true,"vulnerabilities":[{"id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"fixed_in":["4.17.21"],"severity":"CVSS:3.1/…"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_LvcbQDkCLpGUGT9HrMQKQ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a software package for known security vulnerabilities by name and ecosystem, returning CVE/GHSA IDs, severity scores, and fix versions.","exampleAgentPrompt":"Can you check if the npm package lodash has any known security vulnerabilities, and if so, tell me which versions fix them and how severe they are?","exampleUseCases":[{"title":"Dependency risk assessment for production deployments","prompt":"I'm about to deploy our Node.js app with a dependency on express@4.18.0. Can you check if express has any known vulnerabilities, and let me know if we need to update it before going to production?"},{"title":"Security audit of Python project dependencies","prompt":"We're taking over maintenance of a legacy Python project. Can you scan our main dependencies like requests, django, and flask for any security issues and tell me which versions have fixes available?"},{"title":"Vetting third-party packages before installation","prompt":"I found this npm package called redis-cli that could speed up our caching layer, but I want to make sure it's safe first. Can you check if it has any known CVEs or security vulnerabilities before I add it to our package.json?"}],"resultDescription":"A JSON object with the package name, ecosystem, a boolean 'vulnerable' flag, a count of vulnerabilities found, and an array of vulnerability objects each containing a GHSA ID, CVE aliases, fixed-in version list, and a CVSS severity string.","failureModes":["Package not found in the specified ecosystem — returns count 0 or error","Unknown ecosystem identifier causes validation error","Network timeout to upstream advisory database","x402 micropayment failure ($0.005 USDC on Base) results in 402 response before data is returned","Malformed package name returns 4xx error"],"whenToPreferThis":"Use this endpoint when you need fast, per-package vulnerability lookups with CVE/GHSA detail and fix-version information, paid via x402 micropayments on Base at $0.005/call. Prefer it over broader SAST tools when you need lightweight, programmatic advisory data for a specific package name and ecosystem without maintaining a local vulnerability database.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:39:35.295Z","isFirstParty":false}