{"uid":"cap_oaFTd34wwkQr_h5j8jHJ6","slug":"depmoor-dependency-vulnerability-scanner-ad0bf486","name":"Depmoor Dependency Vulnerability Scanner","description":"Drop a lockfile (npm, yarn, pnpm, pip, Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet) and see which vulnerable packages to fix first: OSV advisories ranked by CISA KEV and EPSS, with the version that fixes each. Free 5 scans a day; Pro $9/month.","url":"https://depmoor.cybermaxtools.com/api/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"filename":{"type":"string","description":"Lockfile name, e.g. package-lock.json, poetry.lock, go.sum"},"lockfile":{"type":"string","description":"The lockfile contents"},"packages":{"type":"array","description":"Or a pre-parsed list of {ecosystem, name, version}"}}},"responseSchema":{"type":"json","example":{}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Q0u5q-uUlJSCA5FHX_dNi","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans software lockfiles for vulnerable dependencies and ranks them by real-world exploitability using CISA KEV and EPSS scores, with fix versions included","exampleAgentPrompt":"Can you scan my package-lock.json for vulnerable dependencies and tell me which ones to fix first based on real-world exploits? Here are the contents: [paste lockfile]","exampleUseCases":[{"title":"CI pipeline vulnerability gate","prompt":"Before we merge this PR, scan the attached poetry.lock and flag any packages that appear in the CISA KEV list or have an EPSS score above 0.5 — I need to know which ones are actively being exploited and what version fixes each."},{"title":"Triage backlog of known vulnerabilities","prompt":"We've got a huge backlog of dependency alerts. Can you scan our go.sum and rank all the vulnerable packages by how likely they are to be exploited, using EPSS scores, so our security team knows where to focus first?"},{"title":"Cargo crate security audit","prompt":"Audit my Rust project's Cargo.lock for any packages with known vulnerabilities and show me the fix versions — prioritize anything that's in the CISA Known Exploited Vulnerabilities catalog."}],"resultDescription":"Returns a ranked list of vulnerable packages found in the lockfile, each with the associated OSV advisory IDs, CISA KEV status, EPSS exploitation probability score, current version, and the version that fixes the vulnerability — ordered by real-world exploitability priority.","failureModes":["Unsupported lockfile format returns an error or empty results","Malformed or truncated lockfile content may produce incomplete scan results","Rate limit exceeded on free tier (5 scans/day) returns 402 or rate-limit error","Large lockfiles may time out or be truncated","Packages with no OSV advisories return no vulnerabilities (not an error)","Very new vulnerabilities may not yet appear in OSV/KEV/EPSS data sources"],"whenToPreferThis":"Choose Depmoor when you need exploitability-ranked vulnerability results (not just CVE lists) for a wide range of ecosystems in a single call. It uniquely combines OSV advisories with CISA KEV and EPSS scoring so you get actionable prioritization — not just a list of all CVEs. Prefer this over generic SCA tools when the goal is 'what should I fix first' rather than 'what is vulnerable'. Supports 11 ecosystems (npm/yarn/pnpm, pip/Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet) from one endpoint.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:32:25.398Z","isFirstParty":false,"canonicalSlug":"depmoor-dependency-vulnerability-scanner-ad0bf486"}