{"uid":"cap_eqAx-WadvIM_VuQ-Inf5q","slug":"p0-package-risk-vulnerability-lookup-1ea07b5e","name":"P0 Package Risk & Vulnerability Lookup","description":"An open index of the machine-to-machine (agent) economy. x402 routes: ranked discovery over the live x402 service market, every indexed service scored by real 30-day calls and paying-wallet bounds, with a receipt naming the snapshot hash and scoring revision. /economy routes, for Tempo MPP, Virtuals ACP, Olas, Masumi, ERC-8004 agent registries, Solana agent registries, Base agent contracts and MCP servers (Official MCP Registry): each protocol's published figures (agent or server counts, transactions or payment events; payers and USD volume only where the source publishes them: payers for x402 and Tempo MPP, USD volume for x402 and Virtuals ACP), each with its unit, window and source; units differ, so totals are not summed. L402 listings are not covered.","url":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/package/risk?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name","version"],"properties":{"name":{"type":"string","maxLength":214,"description":"Package name; Maven is groupId:artifactId, Go is the module path"},"version":{"type":"string","maxLength":64,"description":"Exact version, e.g. 4.17.15"},"ecosystem":{"enum":["npm","PyPI","Go","crates.io","RubyGems","Maven","NuGet"],"type":"string","description":"Package ecosystem"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["ecosystem","name","version","vulnerable","record_count","vulnerabilities","package_verified","scorecard","scorecard_reason","as_of","source","source_url","attribution","note"],"properties":{"name":{"type":"string"},"note":{"type":"string"},"as_of":{"type":"string"},"source":{"type":"string"},"version":{"type":"string"},"returned":{"type":"integer"},"ecosystem":{"type":"string"},"scorecard":{"type":["object","null"],"required":["repo","score","date","checks","source","source_url","attribution"],"properties":{"date":{"type":["string","null"]},"repo":{"type":"string"},"score":{"type":["number","null"],"description":"Aggregate, 0-10"},"checks":{"type":"array","items":{"type":"object","required":["name","score","reason"],"properties":{"name":{"type":"string"},"score":{"type":["number","null"],"description":"0-10; null = not evaluated"},"reason":{"type":"string"}}}},"source":{"type":"string"},"repo_from":{"type":"string"},"source_url":{"type":"string"},"attribution":{"type":"string","description":"CDLA-Permissive-2.0 credit"},"scorecard_version":{"type":["string","null"]}},"description":"OpenSSF Scorecard of the whole source repository; null when unavailable (see scorecard_reason)"},"truncated":{"type":"boolean"},"source_url":{"type":"string"},"vulnerable":{"type":"boolean","description":"true when OSV holds at least one record for this exact version"},"attribution":{"type":"string","description":"Required OSV and per-database credit"},"by_severity":{"type":"object","description":"Record counts by label; UNRATED when a record has none","additionalProperties":{"type":"integer"}},"max_severity":{"type":["string","null"]},"record_count":{"type":"integer"},"distinct_cves":{"type":"integer","description":"Distinct CVE ids across records and aliases"},"vulnerabilities":{"type":"array","items":{"type":"object","required":["id","aliases","summary","severity","fixed_in","source","license","url"],"properties":{"id":{"type":"string"},"cwe":{"type":"array","items":{"type":"string"}},"url":{"type":"string"},"source":{"type":"string"},"aliases":{"type":"array","items":{"type":"string"}},"license":{"type":"string"},"summary":{"type":["string","null"]},"fixed_in":{"type":"array","items":{"type":"string"},"description":"Fixed versions named by the record, one per affected branch"},"modified":{"type":["string","null"]},"severity":{"type":["string","null"],"description":"The source's own label: LOW, MODERATE, HIGH, CRITICAL (GitHub records); null when the record has none"},"malicious":{"type":"boolean","description":"true for OpenSSF malicious-package reports"},"published":{"type":["string","null"]},"cvss_vector":{"type":["string","null"]}}},"maxItems":25,"description":"Up to 25 records, most severe first"},"package_verified":{"type":"string","description":"How the package version was confirmed to exist"},"scorecard_reason":{"type":["string","null"],"description":"Why scorecard is null"},"malicious_reports":{"type":"integer"},"excluded_for_licence":{"type":"integer","description":"Records withheld because their database licence (share-alike, non-commercial) or origin is not cleared"}}}}}}},"responseSchema":{"type":"json","example":{"name":"lodash","note":"Records OSV.dev holds for exactly this package version, as OSV matches them; different databases may describe the same issue (aliases) so record_count can exceed distinct_cves. severity is the source's own label (GitHub records only); no number is computed. No record is not proof of safety: OSV only lists disclosed issues. Package existence is confirmed by the records themselves or, when there are none, by the package registry (package_verified). scorecard: OpenSSF Scorecard of the whole source repo named by the registry entry, as of its scan date; null with scorecard_reason when none is named, covered or scanned.","as_of":"2026-10-25T09:00:00.000Z","source":"OSV.dev","version":"4.17.15","returned":2,"ecosystem":"npm","scorecard":{"date":"2026-10-20T07:35:09Z","repo":"github.com/lodash/lodash","score":6.6,"checks":[{"name":"Code-Review","score":7,"reason":"Found 22/30 approved changesets -- score normalized to 7"}],"source":"OpenSSF Scorecard","repo_from":"npm registry: repository","source_url":"https://api.scorecard.dev/projects/github.com/lodash/lodash","attribution":"OpenSSF Scorecard (https://scorecard.dev), licensed CDLA Permissive 2.0 (https://cdla.dev/permissive-2-0/); check reasons shortened by P0.","scorecard_version":"v5.5.0"},"truncated":false,"source_url":"https://osv.dev/list?ecosystem=npm&q=lodash","vulnerable":true,"attribution":"Vulnerability records from OSV.dev (https://osv.dev), aggregated from the GitHub Advisory Database (CC-BY 4.0), PyPI Advisory Database (CC-BY 4.0), Go Vulnerability Database (CC-BY 4.0), RustSec (CC0 1.0), OSS-Fuzz (CC-BY 4.0), OpenSSF Malicious Packages (Apache 2.0), Global Security Database (CC0 1.0) and NVD (public domain). Each record names its source and licence; titles are shortened and reformatted by P0. Records under share-alike or non-commercial licences (Ubuntu, Alpine, Chainguard/Wolfi) and records of unverified origin are not included.","by_severity":{"HIGH":1,"MODERATE":1},"max_severity":"HIGH","record_count":2,"distinct_cves":2,"vulnerabilities":[{"id":"GHSA-35jh-r3h4-6jhm","cwe":["CWE-77"],"url":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm","source":"GitHub Advisory Database","aliases":["CVE-2021-23337"],"license":"CC-BY-4.0","summary":"Command Injection in lodash","fixed_in":["4.17.21"],"modified":"2026-03-05T20:39:45Z","severity":"HIGH","malicious":false,"published":"2021-05-06T16:05:51Z","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}],"package_verified":"OSV.dev records for this exact version","scorecard_reason":null,"malicious_reports":0,"excluded_for_licence":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_xviKyp2gBEOPEN2Sqqj2W","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns known vulnerabilities (from OSV.dev) and OpenSSF Scorecard security data for a specific package version in a given ecosystem","exampleAgentPrompt":"Can you check whether lodash version 4.17.15 on npm has any known vulnerabilities, and what its OpenSSF Scorecard security score is?","exampleUseCases":[{"title":"Audit dependency before shipping","prompt":"Before we release, check if axios version 1.6.0 on npm has any known CVEs or security issues I should be aware of."},{"title":"Score a Python package for supply chain risk","prompt":"What's the OpenSSF Scorecard score for the PyPI package requests version 2.31.0, and are there any disclosed vulnerabilities?"},{"title":"Validate a Go module for safe use","prompt":"I'm about to import github.com/gin-gonic/gin at version 1.9.1 as a Go module — are there any known vulnerabilities or scorecard red flags I should know about?"}],"resultDescription":"A JSON object containing: whether the package version is vulnerable, a list of vulnerability records from OSV.dev (with severity labels, source, and aliases), a count of records, the package verification status, an OpenSSF Scorecard with aggregate score (0-10) and individual check scores, the data timestamp, source URLs, and attribution information for all underlying data licenses.","failureModes":["Package not found in the specified ecosystem returns package_verified: false with empty vulnerability list","Unknown ecosystem value returns a 400-level error","Malformed version string may return no records even if vulnerabilities exist","OSV.dev or Scorecard upstream unavailability may result in stale or partial data","Scorecard is null with a scorecard_reason if the repository is unnamed, uncovered, or unscanned"],"whenToPreferThis":"Use this endpoint when you need authoritative, multi-source vulnerability data (OSV.dev aggregating GitHub Advisory, NVD, PyPI Advisory, RustSec, Go Vuln DB, etc.) plus OpenSSF Scorecard in a single call for a specific package version. Prefer it over generic web searches when you need structured, machine-readable security data with clear attribution and licensing. It covers npm, PyPI, Go, crates.io, RubyGems, Maven, and NuGet. Note: L402 listings are not included; this endpoint is specifically about package/dependency security risk, not agent service discovery.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T12:32:57.690Z","isFirstParty":false,"canonicalSlug":"p0-package-risk-vulnerability-lookup-1ea07b5e"}