# Datakoot Dependency Vulnerability Audit

> Datakoot Dependency Vulnerability Audit is a paid API for AI agents from x402.datakoot.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Scans a list of software package dependencies for known security vulnerabilities across multiple ecosystems (npm, PyPI, Cargo, etc.) and returns vulnerability IDs and counts per package.

## Facts

- Endpoint: POST https://x402.datakoot.com/api/audit_dependencies?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/datakoot-dependency-vulnerability-audit-46bec0f5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_rPXLXDrHs4_epR51pdbKk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability datakoot-dependency-vulnerability-audit-46bec0f5 -d '<json body>'
```

Example prompt: Can you audit my npm dependencies for known vulnerabilities? Here's my package.json: { "dependencies": { "lodash": "4.17.15", "express": "4.17.1" } }

## When to prefer this

Choose this endpoint when you need a fast, multi-ecosystem dependency vulnerability scan with structured per-package findings including GHSA IDs, without requiring a full CI/CD pipeline integration. It is ideal for AI agents performing on-demand security checks, pre-deployment audits, or code review assistance. It supports npm, PyPI, Cargo, Go, Maven, RubyGems, NuGet, Composer, Pub, and Hex — making it a strong choice when your project spans multiple ecosystems. At $0.002 per call it is cost-effective for frequent automated checks, and a free MCP tier is available for lighter usage.

## Known failure modes

- Package not found in the specified registry — returned in packages_not_found array
- Unrecognized ecosystem value causes validation error
- Malformed or empty manifest string results in parsing failure
- Version string not recognized for a package returns it in packages_unverified
- Payment failure via x402 means no charge and no result returned
- Network timeout if the upstream vulnerability database is slow

## How this service works

48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.

## Output

Returns a JSON object with a plain-English verdict summary, a findings array listing each vulnerable package with its name, version, associated GHSA vulnerability IDs, and vulnerability count, plus aggregate stats: ecosystem type, total packages audited, total vulnerabilities found, packages not found in the registry, unverified packages, and count of packages with vulnerabilities.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "manifest": {
   "type": "string",
   "description": "Raw package.json contents"
  },
  "ecosystem": {
   "type": "string",
   "description": "Package registry for the dependencies: npm (default), pypi, cargo, go, maven, rubygems, nuget, composer, pub, or hex."
  },
  "dependencies": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "[{name, version}] entries"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "verdict": "2 package(s) have known vulnerabilities — review before shipping",
  "findings": [
   {
    "name": "lodash",
    "version": "4.17.15",
    "vulnerability_ids": [
     "GHSA-29mw-wpgm-hmr9",
     "GHSA-35jh-r3h4-6jhm"
    ],
    "vulnerability_count": 6
   },
   {
    "name": "express",
    "version": "4.17.1",
    "vulnerability_ids": [
     "GHSA-qw6h-vgh9-j6wx",
     "GHSA-rv95-896h-c2vc"
    ],
    "vulnerability_count": 2
   }
  ],
  "ecosystem": "npm",
  "packages_audited": 2,
  "packages_not_found": [],
  "packages_unverified": [],
  "total_vulnerabilities": 8,
  "packages_with_vulnerabilities": 2
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/datakoot-dependency-vulnerability-audit-46bec0f5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.datakoot.com](https://www.zero.xyz/host/x402.datakoot.com/llms.txt)