# Agent Tools – Manifest Vulnerability Scan (npm/PyPI)

> Agent Tools – Manifest Vulnerability Scan (npm/PyPI) is a paid API for AI agents from agents.crowdspark.me, paid per call via x402, $0.012/call, status unknown (last checked 2026-10-31).

Batch scans a package.json or requirements.txt manifest against OSV.dev advisories, returning per-package vulnerability counts by severity, advisory IDs, and minimum fixed versions.

## Facts

- Endpoint: POST https://agents.crowdspark.me/v1/dev/manifest-scan?utm_source=zero.xyz
- Price: $0.012/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-tools-manifest-vulnerability-scan-npm-pypi-7fd99537
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_rwN1ecw2rTWKk07Dd-VD1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-tools-manifest-vulnerability-scan-npm-pypi-7fd99537 -d '<json body>'
```

Example prompt: Can you scan this package.json for known vulnerabilities and tell me which packages are at risk and what the minimum fixed versions are? Here's the content: {"dependencies":{"lodash":"4.17.20","express":"4.17.1"}}

## When to prefer this

Prefer this endpoint when you need to audit an entire dependency manifest in one call rather than checking packages one by one. It is more cost-efficient than calling package_advisories per package (described as a cheaper batch form). Ideal for CI/CD pipeline integration, pre-deployment checks, or any agent workflow that needs a holistic vulnerability picture across all project dependencies at once. Supports both npm (package.json) and PyPI (requirements.txt) ecosystems.

## Known failure modes

- Manifest exceeds 200,000 character limit — request rejected
- Invalid or unparseable manifest format returns a parse error
- Package not found in OSV.dev returns lookup_failed count increment
- More than 50 dependencies triggers not_checked_over_limit for the excess
- Payment not included or insufficient returns 402 Payment Required
- Unrecognized manifest type when auto-detection fails

## How this service works

Pay-per-call utilities for AI agents over x402, USDC on Base.

## Output

A JSON object with a summary (total packages checked, vulnerable count, total known vulnerabilities), the detected ecosystem (npm or PyPI), and per-package details listing advisory IDs, version checked, vulnerability counts broken down by severity (critical/high/medium/low), and the minimum fixed version — with vulnerable packages sorted first.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "type": {
   "enum": [
    "package.json",
    "requirements.txt"
   ],
   "type": "string",
   "description": "Optional. Auto-detected if omitted"
  },
  "manifest": {
   "type": "string",
   "description": "package.json or requirements.txt contents as a string, max 200,000 chars"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "sources": [
   "OSV.dev (CC-BY 4.0)",
   "deps.dev"
  ],
  "summary": {
   "checked": 2,
   "lookup_failed": 0,
   "dependencies_found": 2,
   "vulnerable_packages": 1,
   "known_vulnerabilities": 5,
   "not_checked_over_limit": 0
  },
  "ecosystem": "npm",
  "vulnerable": [
   {
    "ids": [
     "GHSA-35jh-r3h4-6jhm"
    ],
    "name": "lodash",
    "spec": "4.17.20",
    "vulnerable": true,
    "by_severity": {
     "high": 2,
     "medium": 3
    },
    "version_checked": "4.17.20",
    "vulnerabilities": 5,
    "min_fixed_version": "4.17.21"
   }
  ],
  "manifest_type": "package.json"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-tools-manifest-vulnerability-scan-npm-pypi-7fd99537/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agents.crowdspark.me](https://www.zero.xyz/host/agents.crowdspark.me/llms.txt)