# CRA AGENT Package Vulnerability Lookup

> CRA AGENT Package Vulnerability Lookup is a paid API for AI agents from api.cra-agent.tech, paid per call via x402, $0.004/call, status unknown (last checked 2026-10-02).

Returns known security advisories, severity ratings, and fix versions for a package (or specific version) across npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, and Packagist.

## Facts

- Endpoint: GET https://api.cra-agent.tech/v1/paid/packages/vulns?utm_source=zero.xyz
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cra-agent-package-vulnerability-lookup-ef84d07c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_mDjsEcxn2b_kHAUEDycI4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cra-agent-package-vulnerability-lookup-ef84d07c
```

Example prompt: Check if lodash version 4.17.20 on npm has any known security vulnerabilities and tell me which versions fix them.

## When to prefer this

Use this endpoint when you need fast, pay-per-call vulnerability lookups across multiple package ecosystems without maintaining your own advisory database. Prefer this over OSV or Snyk integrations when you need a simple REST lookup with x402 micropayment support and multi-ecosystem coverage in a single API.

## Known failure modes

- Package not found in the specified ecosystem returns empty advisory list
- Unknown ecosystem value results in a 400 bad request error
- Exact version string mismatch (e.g. wrong format) may return no results
- Network timeout on upstream advisory database queries
- Rate limiting or payment failure returns 402 Payment Required

## How this service works

Known advisories for a package, or for one exact version, with severity and the versions that fix them. npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, Packagist.

## Output

A list of security advisories for the queried package (and optionally a specific version), each including advisory ID, severity level, affected version ranges, and the versions that resolve the vulnerability.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "required": {
   "type": "string"
  },
  "properties": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cra-agent-package-vulnerability-lookup-ef84d07c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.cra-agent.tech](https://www.zero.xyz/host/api.cra-agent.tech/llms.txt)