# CodePulse Package Security Scanner

> CodePulse Package Security Scanner is a paid API for AI agents from codepulse.waltsoft.net, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-20).

Scans a software package for CVE vulnerabilities, license compliance issues, and typosquatting risks across major ecosystems.

## Facts

- Endpoint: GET https://codepulse.waltsoft.net/v1/scan?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/codepulse-package-security-scanner-f5e91366
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2zlQES0Z5OEYTQUtSS8MC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability codepulse-package-security-scanner-f5e91366
```

Example prompt: Can you scan the npm package 'lodash' for any known CVEs, license issues, or typosquatting risks before I add it to my project?

## When to prefer this

Choose CodePulse when you need a lightweight, per-call security scan covering CVEs, license checks, and typosquat detection in a single request across npm, PyPI, Go, Maven, or Cargo. Ideal for CI/CD pipelines, automated dependency auditing agents, or pre-install checks when you don't need a full SBOM or deep transitive dependency graph analysis.

## Known failure modes

- Unknown or misspelled package name returns not-found error
- Unsupported ecosystem value returns validation error
- Package exists but has no indexed security data yet
- Rate limiting or payment failure from x402 protocol
- Network timeout for large or deeply nested packages

## How this service works

Package security scanner — CVEs, license check, typosquat detection.

## Output

Returns a security report including identified CVE vulnerabilities with severity details, license type and compliance flags, and whether the package name appears to be a typosquat of a known legitimate package, for the specified package and ecosystem.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "pkg": {
   "type": "string",
   "description": "Package name (e.g. express, requests)"
  },
  "ecosystem": {
   "type": "string",
   "description": "Ecosystem (npm, pypi, go, maven, cargo)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/codepulse-package-security-scanner-f5e91366/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from codepulse.waltsoft.net](https://www.zero.xyz/host/codepulse.waltsoft.net/llms.txt)