# Depmoor Dependency Vulnerability Scanner

> Depmoor Dependency Vulnerability Scanner is a paid API for AI agents from depmoor.cybermax-tools.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-12).

Scans a dependency lockfile for vulnerable packages, ranking them by real exploit risk using CISA KEV and EPSS scores alongside OSV advisories

## Facts

- Endpoint: POST https://depmoor.cybermax-tools.workers.dev/api/scan?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/depmoor-dependency-vulnerability-scanner-057b1e29
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_iJdIwtdocAS3q5klC1rCF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability depmoor-dependency-vulnerability-scanner-057b1e29 -d '<json body>'
```

Example prompt: Scan my package-lock.json for vulnerable packages and rank them by which ones have real-world exploits — here's the file contents: [paste lockfile].

## When to prefer this

Choose this endpoint when you need to triage dependency vulnerabilities by real exploit risk rather than raw CVE count or severity score alone. It is uniquely suited for workflows where you need to know which packages are actively exploited in the wild (CISA KEV) or have high exploitation probability (EPSS), rather than just a list of all CVEs. Prefer it over generic SCA tools when you need actionable fix versions alongside prioritized risk rankings in a single API call.

## Known failure modes

- Unsupported lockfile format — only npm, yarn, pnpm, pip, Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet are supported
- Malformed or truncated lockfile content fails to parse
- Free tier exhausted (5 scans/day limit) without Pro subscription
- No vulnerabilities found (empty result set, not an error)
- Unknown packages not listed in OSV database return no advisory data
- Payment failure for x402 USDC micropayment prevents scan from running

## How this service works

Drop a lockfile (npm, yarn, pnpm, pip, Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet) and see which vulnerable packages to fix first: OSV advisories ranked by CISA KEV and EPSS, with the version that fixes each. Free 5 scans a day; Pro $9/month.

## Output

A JSON response listing vulnerable packages found in the lockfile, each enriched with OSV advisory details, CISA KEV membership (indicating active exploitation), EPSS probability scores (likelihood of exploitation), and the minimum safe version that resolves each vulnerability — sorted by exploit priority.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "filename": {
   "type": "string",
   "description": "Lockfile name, e.g. package-lock.json, poetry.lock, go.sum"
  },
  "lockfile": {
   "type": "string",
   "description": "The lockfile contents"
  },
  "packages": {
   "type": "array",
   "description": "Or a pre-parsed list of {ecosystem, name, version}"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {}
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/depmoor-dependency-vulnerability-scanner-057b1e29/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from depmoor.cybermax-tools.workers.dev](https://www.zero.xyz/host/depmoor.cybermax-tools.workers.dev/llms.txt)