# CVE/Package Vulnerability Scan via x402 Micropayment

> CVE/Package Vulnerability Scan via x402 Micropayment is a paid API for AI agents from x402helper.xyz, paid per call via x402, $0.026/call, status unknown (last checked 2026-10-31).

Scans a software package for known CVE vulnerabilities by ecosystem, name, version, or PURL, charged per call via USDC micropayment.

## Facts

- Endpoint: GET https://x402helper.xyz/89e509/cve/scan?utm_source=zero.xyz
- Price: $0.026/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cve-package-vulnerability-scan-via-x402-micropayment-8e92d940
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-Jhb05DUs0oK63CAbsoSZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cve-package-vulnerability-scan-via-x402-micropayment-8e92d940
```

Example prompt: Can you check if the PyPI package jinja2 version 2.4.1 has any known CVEs or security vulnerabilities?

## When to prefer this

Use this endpoint when you need quick, per-call CVE lookups for specific package versions across major ecosystems (npm, PyPI, Maven, crates.io, Go, Packagist, RubyGems, NuGet) and want to pay only per scan via USDC micropayment rather than subscribing to a bulk vulnerability database service.

## Known failure modes

- Missing required 'input' object returns validation error
- Invalid ecosystem enum value results in schema rejection
- Package not found in the vulnerability database may return empty result
- Payment failure or insufficient USDC balance blocks access with 402 response
- Malformed PURL string may produce unexpected results or errors

## How this service works

X402 micropayments server — AI agents pay USDC for OFAC screening, rates, and billing verification.

## Output

Returns a JSON object with a 'success' boolean and a 'result' object containing CVE/vulnerability scan data for the specified package, ecosystem, name, and version combination.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "name": {
       "type": "string",
       "default": null,
       "description": "Package name (Maven uses group:artifact)"
      },
      "purl": {
       "type": "string",
       "default": null,
       "description": "Package-URL instead of ecosystem/name/version, e.g. pkg:pypi/jinja2@2.4.1"
      },
      "version": {
       "type": "string",
       "default": null,
       "description": "Package version, e.g. 2.4.1"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "PyPI",
        "Maven",
        "crates.io",
        "Go",
        "Packagist",
        "RubyGems",
        "NuGet"
       ],
       "type": "string",
       "default": null,
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {},
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cve-package-vulnerability-scan-via-x402-micropayment-8e92d940/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402helper.xyz](https://www.zero.xyz/host/x402helper.xyz/llms.txt)