{"uid":"cap_iJdIwtdocAS3q5klC1rCF","slug":"depmoor-dependency-vulnerability-scanner-057b1e29","name":"Depmoor Dependency Vulnerability Scanner","description":"Drop a lockfile (npm, yarn, pnpm, pip, Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet) and see which vulnerable packages to fix first: OSV advisories ranked by CISA KEV and EPSS, with the version that fixes each. Free 5 scans a day; Pro $9/month.","url":"https://depmoor.cybermax-tools.workers.dev/api/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"filename":{"type":"string","description":"Lockfile name, e.g. package-lock.json, poetry.lock, go.sum"},"lockfile":{"type":"string","description":"The lockfile contents"},"packages":{"type":"array","description":"Or a pre-parsed list of {ecosystem, name, version}"}}},"responseSchema":{"type":"json","example":{}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_sDquVZhAfB9dA8v7yqh8e","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a dependency lockfile for vulnerable packages, ranking them by real exploit risk using CISA KEV and EPSS scores alongside OSV advisories","exampleAgentPrompt":"Scan my package-lock.json for vulnerable packages and rank them by which ones have real-world exploits — here's the file contents: [paste lockfile].","exampleUseCases":[{"title":"Pre-deployment security gate for Node app","prompt":"Before I deploy, can you check my package-lock.json for vulnerabilities and tell me which ones are most urgent based on CISA KEV and EPSS exploit scores? Here are the contents of my lockfile."},{"title":"Python project dependency audit","prompt":"I have a Poetry lockfile for my Python project — can you scan it for any packages with known CVEs and tell me which versions I should upgrade to in order to fix the most dangerous ones first?"},{"title":"Cargo lockfile CVE check for Rust crate","prompt":"Can you analyze my Cargo.lock file for any security vulnerabilities, ranked by how likely they are to be actively exploited, and tell me which package versions would fix each issue?"}],"resultDescription":"A JSON response listing vulnerable packages found in the lockfile, each enriched with OSV advisory details, CISA KEV membership (indicating active exploitation), EPSS probability scores (likelihood of exploitation), and the minimum safe version that resolves each vulnerability — sorted by exploit priority.","failureModes":["Unsupported lockfile format — only npm, yarn, pnpm, pip, Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet are supported","Malformed or truncated lockfile content fails to parse","Free tier exhausted (5 scans/day limit) without Pro subscription","No vulnerabilities found (empty result set, not an error)","Unknown packages not listed in OSV database return no advisory data","Payment failure for x402 USDC micropayment prevents scan from running"],"whenToPreferThis":"Choose this endpoint when you need to triage dependency vulnerabilities by real exploit risk rather than raw CVE count or severity score alone. It is uniquely suited for workflows where you need to know which packages are actively exploited in the wild (CISA KEV) or have high exploitation probability (EPSS), rather than just a list of all CVEs. Prefer it over generic SCA tools when you need actionable fix versions alongside prioritized risk rankings in a single API call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T06:38:35.925Z","isFirstParty":false,"canonicalSlug":"depmoor-dependency-vulnerability-scanner-057b1e29"}