# Agent Data Tools – Package Security Audit > Agent Data Tools – Package Security Audit is a paid API for AI agents from agent-data-tools.revmesh2074.workers.dev, paid per call via x402, $0.2/call, status unknown (last checked 2026-10-16). Audits npm (and other ecosystem) packages for known vulnerabilities, advisories, and risk verdicts using deps.dev and OSV data ## Facts - Endpoint: GET https://agent-data-tools.revmesh2074.workers.dev/package-audit?utm_source=zero.xyz - Price: $0.2/call - Payment: x402 - Status: unknown - Last checked: 2026-10-16 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/agent-data-tools-package-security-audit-703d8fed - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RYsr19Al-YXE3r1IBMrjy Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability agent-data-tools-package-security-audit-703d8fed ``` Example prompt: Can you check whether minimist@1.2.5 and lodash@4.17.20 have any known security vulnerabilities or CVEs I should be worried about before I use them in my project? ## When to prefer this Use this endpoint when you need fast, structured security audit data for up to 10 packages at once without requiring an API key or account. It combines deps.dev and OSV data with EPSS exploitation probability in a single call, making it ideal for CI/CD pipeline checks, pre-install vetting, or AI agent workflows that need to make install/block decisions programmatically. Prefer this over manual OSV or NVD lookups when you want a single verdict per package with cross-referenced advisory IDs and fix recommendations. ## Known failure modes - Package not found in registry — result includes exists:false - Invalid ecosystem prefix — query param rejected - More than 10 packages requested — likely truncated or errored - Version not found — versionExists:false returned - EPSS or advisory detail budget exceeded — fields marked not-fetched-subrequest-budget - Malformed packages query param — 402/400 error before audit runs - Network timeout from upstream deps.dev — partial results ## How this service works Read public static documentation as text or Markdown with code, tables, headings and links for $0.002 USDC on Base via x402. Inspect real cached examples and an unsigned quote, then buy with a capped Node CLI. No account or API key. No JavaScript rendering, authenticated or paywalled access. Other paid utilities remain available. ## Output A JSON object containing per-package results with: existence confirmation, vulnerability verdict (e.g. 'caution'), known vulnerability count, list of GHSA/CVE advisory IDs with summaries and published dates, EPSS exploitation probability scores per CVE, fixed version ranges from OSV, weekly download stats where available, and an overall summary string. Source attribution includes deps.dev and OSV. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "packages" ], "properties": { "packages": { "type": "string", "description": "Comma-separated ecosystem:name items, optionally name@exact-version; max 10. For scoped npm, use npm:@scope/name@version." } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object" } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "source": "deps.dev", "checked": 1, "results": [ { "name": "minimist", "flags": [ "known-vulnerabilities" ], "exists": true, "source": "deps.dev", "verdict": "caution", "version": "1.2.5", "ecosystem": "npm", "advisories": [], "advisoryIds": [ "GHSA-xvch-5gv4-984h" ], "retrievedAt": "2026-10-14T12:00:00.000Z", "versionExists": true, "weeklyDownloads": null, "versionAdvisories": { "note": "OSV advisories are matched to this exact package version.", "source": "OSV", "status": "complete", "retrievedAt": "2026-10-14T12:00:00.000Z", "advisoryCount": 1, "vulnerabilities": [ { "id": "GHSA-xvch-5gv4-984h", "epss": { "note": "EPSS estimates 30-day exploitation probability for CVE aliases; it is not a package-safety guarantee. Null scores are unknown, not zero.", "scores": [ { "cve": "CVE-2021-44906", "date": "2026-10-14", "score": 0.04581, "status": "available", "percentile": 0.91484 } ], "source": "FIRST EPSS", "status": "complete", "retrievedAt": "2026-10-14T12:00:00.000Z", "sourceStatus": "available" }, "source": "OSV", "aliases": [ "CVE-2021-44906" ], "summary": "Prototype Pollution in minimist", "modified": "2026-03-13T22:11:59.523514Z", "published": "2022-03-18T00:01:09Z", "sourceUrl": "https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h", "rangeStatus": "reported", "retrievedAt": "2026-10-14T12:00:00.000Z", "detailStatus": "available", "fixedVersionRanges": [ { "type": "SEMVER", "events": [ { "introduced": "1.0.0" }, { "fixed": "1.2.6" } ], "fixedVersions": [ "1.2.6" ] }, { "type": "SEMVER", "events": [ { "introduced": "0" }, { "fixed": "0.2.4" } ], "fixedVersions": [ "0.2.4" ] } ] } ] }, "knownVulnerabilities": 1, "advisoryDetailsStatus": "not-fetched-subrequest-budget", "weeklyDownloadsStatus": "not-fetched-subrequest-budget", "advisoryDetailsOmitted": 1, "advisoryDetailsUnavailable": … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-data-tools-package-security-audit-703d8fed/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from agent-data-tools.revmesh2074.workers.dev](https://www.zero.xyz/host/agent-data-tools.revmesh2074.workers.dev/llms.txt)