{"uid":"cap_qqIbFHGmAw4evsRTXkKvl","slug":"hermes-dependency-vulnerability-check-d4bfebe6","name":"Hermes Dependency Vulnerability Check","description":"Agent utilities for company research, package maintenance intelligence, dependency vulnerability checks, counterparty availability, SEC company snapshots, OFAC sanctions screening, and deterministic JSON/CSV data-quality work. Company domain intelligence includes a free preview before the paid enrichment call.","url":"https://hermes-counterparty-api.onrender.com/v1/dependency-vulnerability-check","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"package":{"type":"string","maxLength":300,"minLength":1,"description":"Exact package name"},"version":{"type":"string","maxLength":200,"minLength":1,"description":"Exact package version"},"ecosystem":{"type":"string","maxLength":100,"minLength":1,"description":"OSV ecosystem name such as npm, PyPI, Maven, Go, or RubyGems"}}},"responseSchema":{"type":"json","example":{"query":{"package":"fastify","version":"5.6.0","ecosystem":"npm"},"source":{"api_url":"https://api.osv.dev/v1/query","provider":"OSV.dev"},"warnings":[],"vulnerable":false,"schema_version":"1.0","vulnerabilities":[],"vulnerability_count":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_b4KUsi9t8cSzZKHSwfhzW","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a specific package version has known vulnerabilities by querying OSV.dev, returning a structured JSON report of CVEs and security advisories.","exampleAgentPrompt":"Can you check if lodash version 4.17.20 in the npm ecosystem has any known security vulnerabilities?","exampleUseCases":[{"title":"Pre-deploy security audit for Node.js app","prompt":"Before we ship this release, can you check if express version 4.18.2 in npm has any known vulnerabilities I should worry about?"},{"title":"Python package CVE scan in CI pipeline","prompt":"We're using requests version 2.28.1 from PyPI — can you check the OSV database to see if it has any reported security issues?"},{"title":"Maven dependency vetting for enterprise project","prompt":"Can you check if org.apache.logging.log4j:log4j-core version 2.14.1 in the Maven ecosystem has any known vulnerabilities? We need to know before approving this dependency."}],"resultDescription":"Returns a JSON object with a 'vulnerable' boolean, a 'vulnerability_count' integer, a 'vulnerabilities' array (with CVE/advisory details if any), a 'warnings' array, the original query echoed back, and the OSV.dev API source reference. If no vulnerabilities are found, 'vulnerable' is false and both arrays are empty.","failureModes":["Unknown package or version — OSV.dev may return empty results without indicating the package doesn't exist","Invalid ecosystem name — request may fail or return no results if ecosystem string doesn't match OSV taxonomy (e.g. 'node' instead of 'npm')","OSV.dev API downtime — upstream provider unavailable causing the endpoint to error","Partial version matching — OSV may not match if version string format doesn't exactly match their records","Rate limiting or payment failure — x402 payment of 0.005 USDC must succeed before the request is processed"],"whenToPreferThis":"Choose this endpoint when you need a quick, deterministic, per-package vulnerability lookup against the OSV.dev database with a structured JSON response, especially in agent workflows that require pay-per-call billing via x402 USDC. Prefer it over manual OSV.dev queries when integrating security checks into automated pipelines, CI/CD agents, or software supply chain audits. It is also useful when you need the result in a clean schema alongside other Hermes commerce intelligence endpoints on the same platform.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:50:24.605Z","isFirstParty":false}