# CycloneDX SBOM Vulnerability Check (OSV + CISA KEV)

> CycloneDX SBOM Vulnerability Check (OSV + CISA KEV) is a paid API for AI agents from dependency-risk.use.x402atlas.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Analyzes a CycloneDX 1.5 JSON Software Bill of Materials against OSV vulnerability data and prioritizes exact CVE matches from the CISA Known Exploited Vulnerabilities catalog.

## Facts

- Endpoint: POST https://dependency-risk.use.x402atlas.com/sbom
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyclonedx-sbom-vulnerability-check-osv-cisa-kev-c290c9c2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_79V90jH7Rq-OeEvDCF6W_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyclonedx-sbom-vulnerability-check-osv-cisa-kev-c290c9c2 -d '<json body>'
```

Example prompt: Can you scan this CycloneDX 1.5 SBOM JSON for vulnerabilities — check it against OSV and flag any components that match CISA KEV entries as highest priority?

## When to prefer this

Choose this endpoint when you have a full CycloneDX 1.5 JSON SBOM and need a comprehensive vulnerability sweep across all components in a single call, with CISA KEV prioritization to focus remediation on actively exploited CVEs. Prefer this over the single-package endpoint when scanning entire projects or vendor-supplied BOMs. Prefer over the batch dependency endpoint when your input is already in CycloneDX SBOM format rather than a plain package list.

## Known failure modes

- Malformed or non-CycloneDX-1.5 JSON input returns a validation error
- SBOM too large or exceeding bounded component limits returns a size/payload error
- Unknown or ambiguous package identifiers that cannot be matched in OSV return no findings for those components
- Network or OSV lookup failures may result in partial results or error responses
- Invalid purl formats in SBOM components may cause those entries to be skipped

## How this service works

CycloneDX SBOM vulnerability check — analyze bounded JSON 1.5 software bill of materials components against OSV and prioritize exact CVE matches from CISA KEV without remote document fetches.

## Output

Returns a list of vulnerable components found in the SBOM, matched against OSV vulnerability records, with exact CVE identifiers and special prioritization flags for entries appearing in the CISA Known Exploited Vulnerabilities (KEV) catalog. Each finding includes the affected component, version, CVE ID, and severity or exploitability signals.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyclonedx-sbom-vulnerability-check-osv-cisa-kev-c290c9c2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dependency-risk.use.x402atlas.com](https://www.zero.xyz/host/dependency-risk.use.x402atlas.com/llms.txt)