{"uid":"cap_fw4-rnGudECq3o0yPDbJA","slug":"stack-facts-preflight-package-security-check-3d435aa9","name":"Stack Facts Preflight Package Security Check","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/preflight?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string","maxLength":200},"package":{"type":"string","pattern":"^pkg:","maxLength":512,"minLength":7},"version":{"type":"string","maxLength":200},"ecosystem":{"type":"string","maxLength":200}}},"responseSchema":{"type":"json","example":{"data":{"notice":null,"yanked":false,"package":{"name":"lodash","purl":"pkg:npm/lodash@4.17.20","version":"4.17.20","ecosystem":"npm"},"reasons":[{"id":"GHSA-35jh-r3h4-6jhm","code":"vuln","fixed":["4.17.21"],"aliases":["CVE-2021-23337"],"summary":"Command Injection in lodash","verdict":"warn","severity":"HIGH"}],"verdict":"warn","deprecated":false,"kev_catalog_version":"2026.10.10"},"meta":{"stale":false,"notice":"Normalised (modified) from the …","dataset":"preflight","datasets":{"eol":{},"kev":{},"osv":{},"registry":{}}}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.008","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.008/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_b19bXTovwJUZ09RILWZxX","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.008","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an open-source package for malware, known vulnerabilities (OSV), actively exploited CVEs (CISA KEV), and end-of-life status before installation, returning a signed verdict per call paid in USDC.","exampleAgentPrompt":"Before I add lodash 4.17.20 from the npm ecosystem to my project, can you run a preflight security check on it — I want to know about any known vulnerabilities, whether it's being actively exploited, and if it's end-of-life?","exampleUseCases":[{"title":"Pre-install npm dependency audit","prompt":"I'm about to install express 4.18.2 from npm — can you check if it has any known CVEs, whether any of them are in the CISA exploited vulnerabilities catalog, and whether that version is still supported?"},{"title":"Python package supply chain check","prompt":"Before I add requests 2.28.0 from PyPI to my production service, can you do a security preflight on it? I need to know about vulnerabilities, active exploits, and end-of-life status."},{"title":"Block vulnerable transitive dependency","prompt":"My build pipeline just flagged log4j 2.14.1 in the Java Maven ecosystem — can you check its vulnerability status and tell me what version I should upgrade to in order to be safe?"}],"resultDescription":"Returns a JSON object with a top-level verdict ('safe', 'warn', or 'block'), a list of reasons (each with CVE/GHSA ID, severity, summary, fix versions, and whether it appears in CISA KEV), the package PURL, and dataset metadata including snapshot IDs, sha256 hashes, cryptographic signatures, data source URLs, and freshness timestamps for OSV, KEV, and EOL datasets.","failureModes":["Invalid or missing purl format (must start with 'pkg:') returns a 400 error","Unknown ecosystem or package name returns an empty reasons list with a 'safe' verdict but may indicate a lookup miss","Stale dataset flag (stale:true) in metadata indicates data may not reflect the latest vulnerabilities","Payment not included or insufficient USDC results in HTTP 402 response before data is returned","Package version not found in ecosystem returns no vulnerability matches"],"whenToPreferThis":"Choose this endpoint when you need a pre-installation security check that combines multiple authoritative data sources (OSV, CISA KEV, endoflife.date) in a single signed, pay-per-call API call with no account setup. Prefer it over free vulnerability databases when you need signed, auditable responses, CISA KEV correlation, and EOL status all in one call. Ideal for AI agent pipelines that need autonomous, accountless security checks on open source dependencies before installation or deployment.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:39:14.179Z","isFirstParty":false,"canonicalSlug":"stack-facts-preflight-package-security-check-3d435aa9"}