# CVE Vulnerability Scan for Software Packages

> CVE Vulnerability Scan for Software Packages is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-10).

Scans a software package (by ecosystem/name/version or purl) for known CVE vulnerabilities, enriched with CVSS scores, CISA KEV status, and EPSS data, returning a prioritized advisory list with fixed versions.

## Facts

- Endpoint: GET https://api.agentstools.dev/cve/scan?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cve-vulnerability-scan-for-software-packages-a989d509
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0pAiOYgjTS4prs6Fd1FH9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cve-vulnerability-scan-for-software-packages-a989d509
```

Example prompt: Can you scan the PyPI package jinja2 version 2.4.1 for known CVEs and tell me their CVSS scores, whether any are in the CISA KEV list, and what version I should upgrade to to fix them?

## When to prefer this

Use this endpoint when you need a fast, enriched CVE lookup for a specific package version across major ecosystems (npm, PyPI, Maven, crates.io, Go, Packagist, RubyGems, NuGet). It combines OSV.dev advisories with NVD CVSS, CISA KEV, and EPSS in a single call, saving the need to query four separate APIs. Prefer it over raw OSV.dev when you need risk prioritization signals and exact remediation versions in one response.

## Known failure modes

- Package not found in OSV.dev — returns empty advisory list or 404
- Invalid purl format — returns 400 validation error
- Ecosystem/name/version combination not recognized — empty results
- NVD or EPSS enrichment unavailable — advisory returned without full scoring data
- Version string malformed — query fails with parameter validation error

## How this service works

Vulnerability scan for a software package by ecosystem, name and version, or by package-URL (purl). Queries OSV.dev for known advisories, collects their CVE ids and enriches them with NVD CVSS, CISA KEV and EPSS, then returns a prioritized list of advisories with exact fixed versions. Risk indicators, not advice.

## Output

A prioritized list of security advisories for the queried package, each including CVE ID(s), CVSS severity score (from NVD), EPSS exploitation probability, CISA KEV flag, affected version ranges, and the exact fixed version to upgrade to.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (Maven uses group:artifact)"
      },
      "purl": {
       "type": "string",
       "description": "Package-URL instead of ecosystem/name/version, e.g. pkg:pypi/jinja2@2.4.1"
      },
      "version": {
       "type": "string",
       "description": "Package version, e.g. 2.4.1"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "PyPI",
        "Maven",
        "crates.io",
        "Go",
        "Packagist",
        "RubyGems",
        "NuGet"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cve-vulnerability-scan-for-software-packages-a989d509/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)