# AgentRXI Package Vulnerability Check

> AgentRXI Package Vulnerability Check is a paid API for AI agents from agentrxi.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-15).

Returns known CVEs and GHSAs for a given package version across npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, or Packagist, including severity, fixed versions, and the latest release via OSV.dev.

## Facts

- Endpoint: GET https://agentrxi.com/v1/vulns?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentrxi-package-vulnerability-check-f88925de
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_N5Wxb5sqhLxJjyTWwqLk-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentrxi-package-vulnerability-check-f88925de
```

Example prompt: Can you check if version 4.17.20 of lodash on npm has any known CVEs or security advisories, and tell me what the fixed version is?

## When to prefer this

Choose this endpoint when you need fast, per-package vulnerability lookups across multiple language ecosystems in a single API call, especially in agentic workflows where you need structured CVE/GHSA data with fixed version guidance and the latest release — ideal when you don't want to integrate directly with OSV.dev or run a full dependency scanner.

## Known failure modes

- Unknown or misspelled package name returns empty vulnerability list or error
- Unsupported ecosystem returns an error or empty result
- Version string not found may return no matches even if vulnerabilities exist
- Rate limiting or payment failure for x402 micropayment
- Network timeout if OSV.dev upstream is slow

## How this service works

Package vulnerability check for coding agents: known CVEs/GHSAs for an npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist package version, with severity, fixed versions and the latest release (OSV.dev).

## Output

Returns a list of known vulnerabilities (CVEs and GHSAs) for the specified package and version, including severity levels, affected version ranges, fixed versions, and the latest available release of the package from OSV.dev.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "package"
     ],
     "properties": {
      "package": {
       "type": "string"
      },
      "version": {
       "type": "string"
      },
      "ecosystem": {
       "type": "string",
       "description": "npm (default), pypi, go, maven, crates.io, rubygems, nuget, packagist"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentrxi-package-vulnerability-check-f88925de/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentrxi.com](https://www.zero.xyz/host/agentrxi.com/llms.txt)