# agentsvc.io CVE Lookup

> agentsvc.io CVE Lookup is a paid API for AI agents from agentsvc.io, paid per call via x402, $0.009/call, status unknown (last checked 2026-10-10).

Looks up known vulnerabilities for a software package, version, or CVE/GHSA identifier via OSV.dev

## Facts

- Endpoint: POST https://agentsvc.io/api/v1/proxy/cve-lookup?utm_source=zero.xyz
- Price: $0.009/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentsvc-io-cve-lookup-1e762e44
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__i-Ubvr9WtChvzOHwvt98

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentsvc-io-cve-lookup-1e762e44 -d '<json body>'
```

Example prompt: Check if lodash version 4.17.15 on npm has any known vulnerabilities — give me a list of CVEs, their severity, and what version fixes them.

## When to prefer this

Use this endpoint when you need real-time vulnerability data from the OSV.dev database for a specific package, version, or CVE/GHSA identifier. Prefer it over static NVD lookups when you need structured affected-version ranges and fix versions in a single call. Ideal for agents performing automated dependency audits, CI security checks, or investigating a specific advisory without needing an account or API key.

## Known failure modes

- Unknown or malformed CVE/GHSA ID returns empty results or error
- Ecosystem name is case-sensitive — incorrect casing (e.g. 'pypi' instead of 'PyPI') may return no results
- Package not found in specified ecosystem returns empty vulnerability list
- Version string format mismatch may cause incorrect range matching
- Payment failure or insufficient USDC balance returns 402 error

## How this service works

86 APIs for AI agents: web scraping and crawling to Markdown, AI summaries, data extraction and cited answers, screenshots and PDF, PDF, OCR and document conversion, news, paper and developer search and more, paid per call with USDC on Base, Solana, Polygon or Arbitrum via x402. No account, no API key, free sample on every service.

## Output

Returns a JSON object containing a vulnerability flag (vulnerable: true/false), count of findings, and an array of vulnerability records from OSV.dev. Each record includes the GHSA/CVE ID, summary, severity, CVSS vector, CWE IDs, affected package and version ranges (introduced/fixed), published date, and reference URLs.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "limit": {
   "type": "integer",
   "default": 20,
   "maximum": 50,
   "minimum": 1
  },
  "cve_id": {
   "type": "string",
   "description": "CVE-2021-44228 or GHSA-xxxx-xxxx-xxxx"
  },
  "package": {
   "type": "string"
  },
  "version": {
   "type": "string"
  },
  "ecosystem": {
   "type": "string",
   "description": "OSV ecosystem name, case sensitive: npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "count": 6,
   "query": {
    "package": "lodash",
    "version": "4.17.15",
    "ecosystem": "npm"
   },
   "source": "OSV.dev",
   "checked_at": "2026-10-06T14:30:56.665Z",
   "vulnerable": true,
   "vulnerabilities": [
    {
     "id": "GHSA-29mw-wpgm-hmr9",
     "cwe": [
      "CWE-1333",
      "CWE-400"
     ],
     "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
     "aliases": [
      "CVE-2020-28500"
     ],
     "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
     "affected": [
      {
       "ranges": [
        {
         "fixed": "4.17.21",
         "introduced": "4.0.0",
         "last_affected": null
        }
       ],
       "package": "lodash",
       "ecosystem": "npm"
      },
      {
       "ranges": [
        {
         "fixed": "4.17.21",
         "introduced": "4.0.0",
         "last_affected": null
        }
       ],
       "package": "lodash-es",
       "ecosystem": "npm"
      }
     ],
     "severity": "MODERATE",
     "published": "2022-01-06",
     "references": [
      "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
      "https://github.com/github/advisory-database/pull/6139"
     ],
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
    }
   ]
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentsvc-io-cve-lookup-1e762e44/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentsvc.io](https://www.zero.xyz/host/agentsvc.io/llms.txt)