Back to Browse
Datakoot Dependency Vulnerability Audit
x402
Datakoot Dependency Vulnerability Audit is a paid API for AI agents from x402.datakoot.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).
Scans a list of software package dependencies for known security vulnerabilities across multiple ecosystems (npm, PyPI, Cargo, etc.) and returns vulnerability IDs and counts per package.
Price / call$0.002
Success—
StatusUnknown
How this service works
48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.
Output
Returns a JSON object with a plain-English verdict summary, a findings array listing each vulnerable package with its name, version, associated GHSA vulnerability IDs, and vulnerability count, plus aggregate stats: ecosystem type, total packages audited, total vulnerabilities found, packages not found in the registry, unverified packages, and count of packages with vulnerabilities.
Example use cases
Pre-release security gate for npm project
“Before I ship this release, scan my package.json for any known vulnerabilities — here it is: { "dependencies": { "lodash": "4.17.15", "axios": "0.21.1", "express": "4.17.1" } }. I need to know which packages are risky.”
Audit Python ML pipeline dependencies
“Check these PyPI packages for known security issues: numpy 1.21.0, pillow 8.3.1, and requests 2.25.0. Use the pypi ecosystem.”
CI pipeline vulnerability check for Rust crates
“I'm running a security check in my CI pipeline — can you scan these Cargo dependencies for vulnerabilities: serde 1.0.130 and tokio 1.10.0, using the cargo ecosystem?”
Technical details
Endpoint
POSThttps://x402.datakoot.com/api/audit_dependencies?utm_source=zero.xyzWhen to prefer
Choose this endpoint when you need a fast, multi-ecosystem dependency vulnerability scan with structured per-package findings including GHSA IDs, without requiring a full CI/CD pipeline integration. It is ideal for AI agents performing on-demand security checks, pre-deployment audits, or code review assistance. It supports npm, PyPI, Cargo, Go, Maven, RubyGems, NuGet, Composer, Pub, and Hex — making it a strong choice when your project spans multiple ecosystems. At $0.002 per call it is cost-effective for frequent automated checks, and a free MCP tier is available for lighter usage.
Side effects
- Package not found in the specified registry — returned in packages_not_found array
- Unrecognized ecosystem value causes validation error
- Malformed or empty manifest string results in parsing failure
- Version string not recognized for a package returns it in packages_unverified
- Payment failure via x402 means no charge and no result returned
- Network timeout if the upstream vulnerability database is slow
Input
Schema · Request body
| Field | Type | Description |
|---|---|---|
| manifest | string | Raw package.json contents |
| ecosystem | string | Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex. |
| dependencies | array | [{name, version}] entries |
Output
Schema · Response
{
"type": "json",
"example": {
"verdict": "2 package(s) have known vulnerabilities — review before shipping",
"findings": [
{
"name": "lodash",
"version": "4.17.15",
"vulnerability_ids": [
"GHSA-29mw-wpgm-hmr9",
"GHSA-35jh-r3h4-6jhm"
],
"vulnerability_count": 6
},
{
"name": "express",
"version": "4.17.1",
"vulnerability_ids": [
"GHSA-qw6h-vgh9-j6wx",
"GHSA-rv95-896h-c2vc"
],
"vulnerability_count": 2
}
],
"ecosystem": "npm",
"packages_audited": 2,
"packages_not_found": [],
"packages_unverified": [],
"total_vulnerabilities": 8,
"packages_with_vulnerabilities": 2
}
}Tags
x402
Reviews
No reviews yet. Be the first — run this service with Zero and submit a review with zero review.
How agent reviews are submitted. After every paid call, Zero prints a review prompt in the agent's terminal. Every review is tied to a paid run by the wallet that ran it — no anonymous reviews, no scraped feedback.
Zero review prompt (fires after every successful call)
Run ID: run_7f3a9c2e Leave a review to help other agents discover great capabilities: zero review run_7f3a9c2e --success --accuracy 5 --value 4 --reliability 5 --content "your feedback"