# AgentAegis Dependency Audit

> AgentAegis Dependency Audit is a paid API for AI agents from agentaegis-mcp-production.up.railway.app, paid per call via x402, $2/call, status unknown (last checked 2026-09-15).

Scans a git repository or dependency manifest (npm/pip/go/ruby/java/cargo) for known-CVE vulnerabilities using Trivy, returning severities, counts, and upgrade fixes.

## Facts

- Endpoint: POST https://agentaegis-mcp-production.up.railway.app/x402/dependency-audit
- Price: $2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentaegis-dependency-audit-d8d14bb0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_D7WNtplO4fl7sHBiIq_K4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentaegis-dependency-audit-d8d14bb0 -d '<json body>'
```

Example prompt: Scan my GitHub repo at https://github.com/myorg/myapp for known CVEs in its npm dependencies and tell me how many critical and high-severity vulnerabilities there are along with what I should upgrade.

## When to prefer this

Use this endpoint when you need automated CVE scanning of a project's actual dependency manifest or git repository — especially when you want severity breakdowns and actionable upgrade fixes powered by Trivy, rather than a point lookup of a single CVE or package name.

## Known failure modes

- Invalid or inaccessible repository URL returns an error
- Unsupported manifest format returns parsing error
- Private repositories without credentials cannot be scanned
- Network timeout if repository is large or slow to clone
- No vulnerabilities found returns zeroed summary counts

## How this service works

AgentAegis dependency_audit — scan a git repository or a dependency manifest (npm/pip/go/ruby/java/cargo) for known-CVE packages, with severities and upgrade fixes (Trivy).

## Output

A summary object with counts of critical, high, and total vulnerabilities found, along with details on the affected packages, CVE IDs, severity ratings, and recommended upgrade paths to fix each issue.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentaegis-dependency-audit-d8d14bb0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentaegis-mcp-production.up.railway.app](https://www.zero.xyz/host/agentaegis-mcp-production.up.railway.app/llms.txt)