# Agent Kiosk Package CVE Audit API

> Agent Kiosk Package CVE Audit API is a paid API for AI agents from agent-kiosk.vercel.app, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-17).

Audits open-source packages (npm, PyPI, crates.io) for known CVEs and security vulnerabilities, returning a security report for a given package name and optional version.

## Facts

- Endpoint: POST https://agent-kiosk.vercel.app/v1/package-audit?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-kiosk-package-cve-audit-api-d64f5a08
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Lz3SiE-i2e6XmqOCfFmUJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-kiosk-package-cve-audit-api-d64f5a08 -d '<json body>'
```

Example prompt: Can you run a CVE security audit on the npm package 'lodash' version 4.17.20 and tell me if there are any known vulnerabilities I should be worried about?

## When to prefer this

Choose this endpoint when you need a quick, pay-per-call CVE and vulnerability audit for a specific open-source package across npm, PyPI, or crates.io ecosystems without setting up a full SAST pipeline. Ideal for AI agents performing automated dependency checks, pre-deployment security gates, or ad-hoc vulnerability lookups on individual packages at low cost ($0.01 per call).

## Known failure modes

- Package name not found in the specified ecosystem — returns error or empty results
- Invalid ecosystem enum value — request rejected
- Rate limiting or payment failure via x402 — call blocked
- Unknown or unsupported version string — may default to latest or return error
- No CVE data available for obscure/new packages — empty findings returned

## How this service works

Open-source package & CVE vulnerability scanner for coding agents (npm, PyPI, crates.io) powered by Google OSV.dev.

## Output

Returns a JSON object with an 'ok' boolean and a 'data' object containing the CVE and security vulnerability findings for the specified package, including vulnerability identifiers, severity levels, affected versions, and remediation guidance where available.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "description": "Package name"
  },
  "version": {
   "type": "string"
  },
  "ecosystem": {
   "enum": [
    "npm",
    "pypi",
    "crates.io"
   ],
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "package": "express",
  "verdict": "CLEAN",
  "ecosystem": "npm",
  "latest_version": "5.1.0",
  "vulnerability_count": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-kiosk-package-cve-audit-api-d64f5a08/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-kiosk.vercel.app](https://www.zero.xyz/host/agent-kiosk.vercel.app/llms.txt)