{"uid":"cap_cTFPm2IK_Ed3RZkcyUUmL","slug":"onchain-risk-agentdiet-dev-real-time-open-source-package-cve-ghsa-da181fca","name":"Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)","description":"Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://onchain-risk.agentdiet.dev/v1/npm-vuln-scan)","url":"https://onchain-risk.agentdiet.dev/v1/npm-vuln-scan?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","required":["package"],"properties":{"package":{"type":"string","minLength":1,"description":"Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":[],"displayCostAmount":"0.01","displayCostAsset":"USD","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_gWpdQBwA9GQ3Cj7X8sOVo","protocol":"mpp","methodType":"crypto","chain":"tempo","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":"onchain-risk.agentdiet.dev","brandSlug":"onchain-risk-agentdiet-dev-mpp","brandBaseUrl":"https://onchain-risk.agentdiet.dev","brandDocsUrl":null,"whatItDoes":"Queries live OSV.dev to return active CVEs, GHSA advisories, and patched versions for a given PyPI, npm, Go, or Rust crate package.","exampleAgentPrompt":"Can you check if the npm package lodash has any active CVEs or GHSA security advisories, and tell me which versions are patched?","exampleUseCases":[{"title":"Pre-deployment dependency security check","prompt":"Before I deploy this app, check if the PyPI package requests has any known vulnerabilities or CVEs I should be aware of, and tell me which version I should upgrade to if it does."},{"title":"Supply chain audit for Go module","prompt":"I'm using golang.org/x/net in my Go project — can you scan it against OSV.dev and let me know if there are any active security advisories or CVEs affecting it?"},{"title":"Rust crate vulnerability review","prompt":"I want to include the hyper crate from crates.io in my Rust project — can you look up any known CVEs or GHSA advisories for it and tell me if there's a safe patched version?"}],"resultDescription":"Returns a structured object listing all active CVE identifiers, GHSA advisories, affected version ranges, and recommended patched versions for the queried package, sourced live from Google OSV.dev.","failureModes":["Package not found or ecosystem not supported returns empty vulnerability list or error","Invalid package identifier format (missing ecosystem prefix) may return an error or unexpected results","OSV.dev upstream unavailability causes request failure","Network timeout if OSV.dev is slow to respond","Payment failure (HTTP 402) if x402 USDC payment is not supplied correctly"],"whenToPreferThis":"Choose this endpoint when you need real-time, live vulnerability data from the authoritative OSV.dev database for PyPI, npm, Go, or Rust crate packages. It is preferable over static NVD lookups or bundled advisory databases when freshness matters, and over GitHub's own advisory API when you need a single endpoint covering multiple ecosystems uniformly.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:22:54.619Z","isFirstParty":false,"canonicalSlug":"onchain-risk-agentdiet-dev-real-time-open-source-package-cve-ghsa-d465dd5f"}