{"uid":"cap_py7ZUzQjNL5sIf21FiICl","slug":"dependency-cve-watch-f1f284e3","name":"Dependency CVE Watch","description":"Given a package name and ecosystem, query OSV for known vulnerabilities and get a pinned-or-upgrade verdict an agent can act on before adopting a dependency.","url":"https://k2so.wrong.systems/api/services/dependency-cve-watch","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"meta":{"enum":["0","1"],"type":"string","description":"Set to 1 for free metadata JSON (no payment required)"},"package":{"type":"string","description":"Composite input parameter"},"ecosystem":{"type":"string","description":"Composite input parameter"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"Dependency CVE Watch paid response","$schema":"https://json-schema.org/draft/2020-12/schema","required":["ok","paid","service","provider","result"],"properties":{"ok":{"type":"boolean"},"paid":{"type":"boolean"},"result":{"type":"object","required":["ok","service"],"properties":{"ok":{"type":"boolean","description":"Handler success"},"score":{"type":"number"},"service":{"type":"string","description":"Service slug"},"summary":{"type":"string"},"evidence":{"type":"object"},"strengths":{"type":"array","items":{"type":"string"}},"confidence":{"type":"string"},"generatedAt":{"type":"string","description":"ISO-8601 timestamp"},"riskFactors":{"type":"array","items":{"type":"string"}}}},"payment":{"type":"object","properties":{"code":{"type":"string"},"payer":{"type":"string"},"detail":{"type":"string"},"selfPay":{"type":"boolean"},"transaction":{"type":"string"}}},"service":{"type":"string"},"provider":{"type":"string","const":"K-2SO"}}}}}}},"responseSchema":{"type":"json","example":{"ok":true,"paid":true,"result":{"ok":true,"service":"dependency-cve-watch"},"service":"dependency-cve-watch","provider":"K-2SO"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_jXY9Qt9Dp8zLYMOv4LHw6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Queries OSV for known vulnerabilities in a given package/ecosystem and returns a pinned-or-upgrade verdict for dependency adoption decisions.","exampleAgentPrompt":"Before I add the 'lodash' npm package as a dependency, can you check OSV for any known CVEs and tell me whether I should pin it to a specific version or upgrade to the latest?","exampleUseCases":[{"title":"Vetting a new Python dependency","prompt":"I'm about to add 'requests' from PyPI to our project — can you check if it has any known vulnerabilities in OSV and give me a verdict on whether it's safe to adopt or if I need to upgrade to a specific version?"},{"title":"Pre-merge security gate for CI","prompt":"Before this PR merges, check whether the 'axios' npm package we're adding has any CVEs in OSV and tell me if we should pin it or upgrade to a safer version."},{"title":"Auditing a Rust crate for known CVEs","prompt":"We're evaluating the 'serde' crate from the crates.io ecosystem — can you look it up in OSV and tell me if there are any known security issues and whether we should pin or can safely use the latest version?"}],"resultDescription":"Returns a structured JSON object containing: a boolean success flag, a risk score (numeric), a plain-language summary of vulnerability findings, an evidence object with OSV data, a list of strengths and risk factors, a confidence level string, and an ISO-8601 timestamp of when the assessment was generated. Together these give an agent an actionable pin-or-upgrade recommendation.","failureModes":["Unknown package name or ecosystem returns no results or an error","OSV API unavailability causes lookup failure","Malformed package/ecosystem combination returns an error","Payment not processed results in 402 response blocking paid result","Ambiguous package names across ecosystems may return incorrect data"],"whenToPreferThis":"Choose this endpoint when an AI agent needs a quick, actionable security verdict on a specific open-source package before adoption — especially in automated CI/CD pipelines, dependency review workflows, or agentic code-generation contexts where a binary pin-or-upgrade decision is needed rather than a raw vulnerability list dump.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T11:27:34.216Z","isFirstParty":false}