{"uid":"cap_rPXLXDrHs4_epR51pdbKk","slug":"datakoot-dependency-vulnerability-audit-46bec0f5","name":"Datakoot Dependency Vulnerability Audit","description":"48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.","url":"https://x402.datakoot.com/api/audit_dependencies?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"manifest":{"type":"string","description":"Raw package.json contents"},"ecosystem":{"type":"string","description":"Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex."},"dependencies":{"type":"array","items":{"type":"object"},"description":"[{name, version}] entries"}}},"responseSchema":{"type":"json","example":{"verdict":"2 package(s) have known vulnerabilities — review before shipping","findings":[{"name":"lodash","version":"4.17.15","vulnerability_ids":["GHSA-29mw-wpgm-hmr9","GHSA-35jh-r3h4-6jhm"],"vulnerability_count":6},{"name":"express","version":"4.17.1","vulnerability_ids":["GHSA-qw6h-vgh9-j6wx","GHSA-rv95-896h-c2vc"],"vulnerability_count":2}],"ecosystem":"npm","packages_audited":2,"packages_not_found":[],"packages_unverified":[],"total_vulnerabilities":8,"packages_with_vulnerabilities":2}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_VzPfKoRpirzU-wpCzUDxk","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a list of software package dependencies for known security vulnerabilities across multiple ecosystems (npm, PyPI, Cargo, etc.) and returns vulnerability IDs and counts per package.","exampleAgentPrompt":"Can you audit my npm dependencies for known vulnerabilities? Here's my package.json: { \"dependencies\": { \"lodash\": \"4.17.15\", \"express\": \"4.17.1\" } }","exampleUseCases":[{"title":"Pre-release security gate for npm project","prompt":"Before I ship this release, scan my package.json for any known vulnerabilities — here it is: { \"dependencies\": { \"lodash\": \"4.17.15\", \"axios\": \"0.21.1\", \"express\": \"4.17.1\" } }. I need to know which packages are risky."},{"title":"Audit Python ML pipeline dependencies","prompt":"Check these PyPI packages for known security issues: numpy 1.21.0, pillow 8.3.1, and requests 2.25.0. Use the pypi ecosystem."},{"title":"CI pipeline vulnerability check for Rust crates","prompt":"I'm running a security check in my CI pipeline — can you scan these Cargo dependencies for vulnerabilities: serde 1.0.130 and tokio 1.10.0, using the cargo ecosystem?"}],"resultDescription":"Returns a JSON object with a plain-English verdict summary, a findings array listing each vulnerable package with its name, version, associated GHSA vulnerability IDs, and vulnerability count, plus aggregate stats: ecosystem type, total packages audited, total vulnerabilities found, packages not found in the registry, unverified packages, and count of packages with vulnerabilities.","failureModes":["Package not found in the specified registry — returned in packages_not_found array","Unrecognized ecosystem value causes validation error","Malformed or empty manifest string results in parsing failure","Version string not recognized for a package returns it in packages_unverified","Payment failure via x402 means no charge and no result returned","Network timeout if the upstream vulnerability database is slow"],"whenToPreferThis":"Choose this endpoint when you need a fast, multi-ecosystem dependency vulnerability scan with structured per-package findings including GHSA IDs, without requiring a full CI/CD pipeline integration. It is ideal for AI agents performing on-demand security checks, pre-deployment audits, or code review assistance. It supports npm, PyPI, Cargo, Go, Maven, RubyGems, NuGet, Composer, Pub, and Hex — making it a strong choice when your project spans multiple ecosystems. At $0.002 per call it is cost-effective for frequent automated checks, and a free MCP tier is available for lighter usage.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:45:05.827Z","isFirstParty":false,"canonicalSlug":"datakoot-dependency-vulnerability-audit-46bec0f5"}