# 2s Security Package Vulnerability & Scorecard Lookup

> 2s Security Package Vulnerability & Scorecard Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.00216/call, status unknown (last checked 2026-09-15).

Returns vulnerability data, OpenSSF Scorecard, license, and repo stats for a given open-source package across npm, PyPI, Go, Maven, Cargo, or NuGet ecosystems.

## Facts

- Endpoint: GET https://2s.io/api/security/package
- Price: $0.00216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-security-package-vulnerability-scorecard-lookup-29a60f1a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_33In7gEDPnuTlLhvbvzqV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-security-package-vulnerability-scorecard-lookup-29a60f1a
```

Example prompt: Check if the npm package lodash version 4.17.20 has any known vulnerabilities, and what's its OpenSSF security scorecard score?

## When to prefer this

Use this endpoint when you need ground-truth security intelligence for an open-source package across major ecosystems (npm, PyPI, Go, Maven, Cargo, NuGet) — especially when you need CVE/vulnerability data, OpenSSF Scorecard, license info, and repo health all in one call. Prefer this over manual OSV or deps.dev queries when you want aggregated, structured output without signup or API keys, paying only per call via USDC.

## Known failure modes

- Package not found in the specified ecosystem — empty items array or ok:false
- Unsupported ecosystem value — validation error
- Missing required parameters (name or ecosystem) — 400-level error
- Version not found — may fall back to latest or return empty
- Upstream data source unavailable — partial or empty response

## How this service works

Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."

## Output

Returns a JSON object with ok status, an items array containing: package metadata (name, version, ecosystem), list of vulnerabilities with CVE IDs/aliases/summaries/severities/published dates, total vulnerability count, deprecation flag, source repository URL, repository stats (stars, forks, open issues), license, and OpenSSF Scorecard with per-check scores and an overall score. Data sourced from OSV, deps.dev, and OpenSSF Scorecard.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "name": "lodash",
   "version": "4.17.21",
   "ecosystem": "npm"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (e.g. lodash, requests)."
      },
      "version": {
       "type": "string",
       "description": "Version (defaults to latest)."
      },
      "ecosystem": {
       "type": "string",
       "description": "Package ecosystem: npm, pypi, go, maven, cargo, or nuget."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-security-package-vulnerability-scorecard-lookup-29a60f1a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)