{"uid":"cap_Y79CXDECpPppfotaEHgZy","slug":"synthora-osv-dev-batch-vulnerability-query-8d73a0cc","name":"SYNTHORA OSV.dev Batch Vulnerability Query","description":"POST an array of package+version queries to keyless OSV.dev and get vulnerability id lists for each in a single call — built for scanning a whole lockfile at once. Lets autonomous agents and agent-to-agent CI pipelines audit an entire SBOM in one round-trip instead of N. Ranking surface for bulk supply-chain risk. First 3 calls FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.","url":"https://osv-vuln-querybatch.hergertsynthora.com/service","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"queries":{"type":"array","description":"queries"}}},"responseSchema":{"type":"json","example":{"ok":true,"niche":"osv-vuln-querybatch","result":{"vulnerabilities":[]},"provenance":{"url":"https://api.osv.dev/v1/querybatch","source":"OSV.dev Batch Vulnerability Query"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_uPT2od8bo6z3RXBZhqKqG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Batch-queries OSV.dev to return known vulnerability IDs for an array of package+version pairs in a single API call, enabling whole-lockfile or SBOM audits in one round-trip.","exampleAgentPrompt":"Scan all the packages in my requirements.txt for known vulnerabilities using OSV — send them all in one batch and tell me which ones have CVEs or known security issues.","exampleUseCases":[{"title":"Lockfile audit before production deploy","prompt":"Before I push this release, check every package in my package-lock.json against OSV in one shot and list any that have known vulnerabilities so I can decide whether to hold the deploy."},{"title":"CI pipeline SBOM security gate","prompt":"As part of our CI pipeline, take the full SBOM from this build — all 80 packages and their versions — and batch-query OSV to flag any with known CVEs so we can fail the build if anything critical comes back."},{"title":"Supply chain risk ranking for open source audit","prompt":"I have a list of 30 Python libraries and their pinned versions from our internal tool inventory — run them all through OSV at once and give me a ranked list of which ones have the most vulnerability hits so our security team can prioritize remediation."}],"resultDescription":"Returns a JSON object with an 'ok' status flag and a 'result' object containing a 'vulnerabilities' array — one entry per queried package — each listing the OSV vulnerability IDs (e.g. CVE, GHSA identifiers) associated with that package version. Also includes provenance metadata pointing back to the upstream OSV.dev batch API.","failureModes":["Empty or malformed 'queries' array returns an empty vulnerabilities list with ok:true but no useful data","Package ecosystem or version string not recognized by OSV returns an empty vulnerability list for that entry (silent miss)","OSV.dev upstream API downtime causes the proxy to fail or return an error","Rate limiting or oversized batch arrays may cause timeouts or partial results","Payment failure (x402 USDC) will block the call before it reaches OSV"],"whenToPreferThis":"Choose this endpoint when you need to audit multiple packages in a single network call — for example, scanning an entire lockfile, requirements.txt, or SBOM in one round-trip rather than issuing N individual queries. It is purpose-built for CI/CD pipelines and agent-to-agent workflows where latency and call count matter. If you only need to check a single package, a direct OSV.dev single-query endpoint may be simpler; if you need full vulnerability detail (not just IDs), you will need a follow-up enrichment step.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:38:27.683Z","isFirstParty":false}