{"uid":"cap_hgPG7xYBgLukdDiMyafff","slug":"arxiv-digest-agentdiet-dev-real-time-open-source-package-cve-ghsa-5e9e5d23","name":"Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)","description":"Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://arxiv-digest.agentdiet.dev/v1/go-module-cve)","url":"https://arxiv-digest.agentdiet.dev/v1/go-module-cve?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","required":["package"],"properties":{"package":{"type":"string","minLength":1,"description":"Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":[],"displayCostAmount":"0.015","displayCostAsset":"USD","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.015/call","primary":{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.015","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.015","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_4bsKb2-k5z8gVWeZljegG","protocol":"mpp","methodType":"crypto","chain":"tempo","mode":"charge","costAmount":"0.015","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":"arxiv-digest.agentdiet.dev","brandSlug":"arxiv-digest-agentdiet-dev-mpp","brandBaseUrl":"https://arxiv-digest.agentdiet.dev","brandDocsUrl":null,"whatItDoes":"Queries Google OSV.dev in real time to return active CVEs, GHSA advisories, and patched versions for a given PyPI, npm, Go, or Rust package.","exampleAgentPrompt":"Can you check if the PyPI package 'requests' has any known CVEs or GHSA security advisories right now, and tell me which versions are patched?","exampleUseCases":[{"title":"Pre-deployment dependency security audit","prompt":"Before I ship this release, can you scan the npm package 'lodash' for any active CVEs or GitHub security advisories and tell me if there's a safe patched version I should upgrade to?"},{"title":"Go module vulnerability check in CI pipeline","prompt":"Does the Go module 'golang.org/x/net' have any known vulnerabilities listed on OSV.dev? I need the CVE IDs and which versions fix them."},{"title":"Rust crate security review","prompt":"I'm using the Rust crate 'hyper' in my project — can you pull up any active CVEs or GHSA advisories for it from OSV.dev so I can decide if I need to update?"}],"resultDescription":"Returns a structured response containing active CVE identifiers, GHSA advisory IDs, affected version ranges, severity information, and recommended patched versions for the queried package, sourced live from Google OSV.dev.","failureModes":["Unknown or misspelled package name returns empty or error response","Unsupported ecosystem prefix causes lookup failure","OSV.dev upstream API unavailability leads to timeout or error","Malformed 'Ecosystem:name' format may result in bad request error","Package with no known vulnerabilities returns empty vulnerability list (not an error)"],"whenToPreferThis":"Choose this endpoint when you need real-time, live vulnerability data from the authoritative Google OSV.dev database for packages across PyPI, npm, Go modules, or Rust crates. Prefer it over static SBOM scanners or cached databases when freshness matters — e.g., just before a deployment, during a CI/CD security gate, or when evaluating a newly disclosed CVE. It is particularly useful for agents that need to programmatically check a specific package rather than scan an entire project lockfile.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:23:16.418Z","isFirstParty":false,"canonicalSlug":"arxiv-digest-agentdiet-dev-real-time-open-source-package-cve-ghsa-8d6cb777"}