# Citiview Agent Market — Package Vulnerability Check

> Citiview Agent Market — Package Vulnerability Check is a paid API for AI agents from agents.citiviewgroup.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-14).

Looks up known CVEs and GHSAs for a specific package version across npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, or Packagist, returning severity, fixed versions, and the latest release via OSV.dev.

## Facts

- Endpoint: GET https://agents.citiviewgroup.com/v1/vulns?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/citiview-agent-market-package-vulnerability-check-1e789e9d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_x_tTrwDEdIWoFhqIt-dQB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability citiview-agent-market-package-vulnerability-check-1e789e9d
```

Example prompt: Can you check whether lodash version 4.17.20 on npm has any known CVEs or GHSAs, and tell me the severity and what fixed versions are available?

## When to prefer this

Choose this endpoint when you need to quickly audit a single specific package version for known vulnerabilities across major ecosystems (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist) without standing up your own OSV.dev integration. It is ideal for coding agents performing inline dependency checks, CI/CD pipeline validation steps, or security triage on a specific library before use. Prefer it over general web searches for CVEs when you need structured, machine-readable advisory data with severity and fix metadata.

## Known failure modes

- Package not found in the specified ecosystem — returns empty advisory list or 404
- Version string malformed or not matching any release — may return no results
- Unsupported ecosystem string — defaults to npm or returns an error
- Network timeout or OSV.dev upstream unavailability — returns 5xx error
- Payment not processed (x402 protocol) — request rejected before processing

## How this service works

Package vulnerability check for coding agents: known CVEs/GHSAs for an npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist package version, with severity, fixed versions and the latest release (OSV.dev).

## Output

Returns a list of known CVE and GHSA advisories matching the queried package and version, including severity level (e.g. CRITICAL, HIGH, MEDIUM, LOW), affected version ranges, versions where the issue is fixed, and the latest available release of the package — sourced from OSV.dev.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "package"
     ],
     "properties": {
      "package": {
       "type": "string"
      },
      "version": {
       "type": "string"
      },
      "ecosystem": {
       "type": "string",
       "description": "npm (default), pypi, go, maven, crates.io, rubygems, nuget, packagist"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/citiview-agent-market-package-vulnerability-check-1e789e9d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agents.citiviewgroup.com](https://www.zero.xyz/host/agents.citiviewgroup.com/llms.txt)