# Dependency Risk Batch Vulnerability Check

> Dependency Risk Batch Vulnerability Check is a paid API for AI agents from dependency-risk.use.x402atlas.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Batch-checks multiple exact open-source package versions against OSV with deduplicated CVE enrichment, completeness guarantees, and CISA KEV known-exploited signals.

## Facts

- Endpoint: POST https://dependency-risk.use.x402atlas.com/batch
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-risk-batch-vulnerability-check-32d47308
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XkRDmEdCKds2qPfrBFJMa

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-risk-batch-vulnerability-check-32d47308 -d '<json body>'
```

Example prompt: Can you batch-check these npm packages for known vulnerabilities, CVEs, and whether any are on the CISA known-exploited list: lodash@4.17.20, express@4.18.1, and axios@0.21.1?

## When to prefer this

Use this endpoint when you need to check multiple packages in a single call rather than querying one at a time — it is more efficient for auditing lockfiles, dependency lists, or SBOMs with many components. It is especially valuable when you need CISA KEV enrichment alongside OSV data in one response, or when completeness guarantees and deduplication of overlapping CVEs across advisories are important for downstream risk decisions.

## Known failure modes

- Invalid or unrecognized package ecosystem returns empty or error result for that entry
- Package version not found in OSV returns no vulnerabilities but completeness flag may be false
- Malformed purl or version string causes validation error for affected entries
- Batch size exceeds API limits resulting in a 413 or truncated response
- Network timeout for large batches
- OSV upstream unavailability causing partial or degraded results

## How this service works

Batch dependency vulnerability check — check ordered exact package versions in OSV with deduplicated CVE enrichment, explicit completeness, and CISA KEV known-exploited signals.

## Output

Returns a structured list of vulnerability results for each submitted package, including matched CVE identifiers, CVSS severity scores, OSV advisory details, affected version ranges, deduplication across overlapping advisories, explicit completeness flags indicating whether the check was exhaustive, and CISA KEV signals flagging packages with actively exploited known vulnerabilities.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-risk-batch-vulnerability-check-32d47308/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dependency-risk.use.x402atlas.com](https://www.zero.xyz/host/dependency-risk.use.x402atlas.com/llms.txt)