# broker-epss-scanner: Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner

> broker-epss-scanner: Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner is a paid API for AI agents from x402broker.com, paid per call via x402 or MPP, $0.01/call, status unknown (last checked 2026-10-20).

Queries Google OSV.dev in real-time to return active CVEs, GHSA advisories, and patched versions for any PyPI, npm, Go, or Rust package.

## Facts

- Endpoint: GET https://x402broker.com/v1/epss-scanner?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402, MPP
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/broker-epss-scanner-real-time-open-source-package-cve-ghsa-5d5c4279
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cLYbUUvCFjqUCRO555cdf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability broker-epss-scanner-real-time-open-source-package-cve-ghsa-5d5c4279
```

Example prompt: Can you check if the npm package 'lodash' has any known CVEs or GHSA security advisories right now, and tell me what the patched version is?

## When to prefer this

Choose this endpoint when you need real-time, live vulnerability data for open-source packages across PyPI, npm, Go, or Rust ecosystems sourced from the authoritative Google OSV.dev database. Prefer it over static NVD or Snyk lookups when you need the latest GHSA advisories and patched version recommendations without maintaining your own vulnerability database.

## Known failure modes

- Package not found in OSV.dev returns empty or 404 response
- Unsupported ecosystem (outside PyPI, npm, Go, Rust) may return no results
- OSV.dev upstream unavailability causes timeout or 503
- Missing required 'package' query parameter returns validation error
- Ambiguous package name may return advisories for wrong package

## How this service works

Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://x402broker.com/v1/epss-scanner)

## Output

Returns a structured response containing active CVE identifiers, GHSA advisory references, affected version ranges, and recommended patched versions for the queried open-source package, sourced live from Google OSV.dev.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "package"
 ],
 "properties": {
  "package": {
   "type": "string",
   "minLength": 1,
   "description": "Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/broker-epss-scanner-real-time-open-source-package-cve-ghsa-5d5c4279/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402broker.com](https://www.zero.xyz/host/x402broker.com/llms.txt)