# Depmoor Dependency Vulnerability Scanner

> Depmoor Dependency Vulnerability Scanner is a paid API for AI agents from depmoor.cybermaxtools.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-11).

Scans software lockfiles for vulnerable dependencies and ranks them by real-world exploitability using CISA KEV and EPSS scores, with fix versions included

## Facts

- Endpoint: POST https://depmoor.cybermaxtools.com/api/scan?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/depmoor-dependency-vulnerability-scanner-ad0bf486
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_oaFTd34wwkQr_h5j8jHJ6

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability depmoor-dependency-vulnerability-scanner-ad0bf486 -d '<json body>'
```

Example prompt: Can you scan my package-lock.json for vulnerable dependencies and tell me which ones to fix first based on real-world exploits? Here are the contents: [paste lockfile]

## When to prefer this

Choose Depmoor when you need exploitability-ranked vulnerability results (not just CVE lists) for a wide range of ecosystems in a single call. It uniquely combines OSV advisories with CISA KEV and EPSS scoring so you get actionable prioritization — not just a list of all CVEs. Prefer this over generic SCA tools when the goal is 'what should I fix first' rather than 'what is vulnerable'. Supports 11 ecosystems (npm/yarn/pnpm, pip/Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet) from one endpoint.

## Known failure modes

- Unsupported lockfile format returns an error or empty results
- Malformed or truncated lockfile content may produce incomplete scan results
- Rate limit exceeded on free tier (5 scans/day) returns 402 or rate-limit error
- Large lockfiles may time out or be truncated
- Packages with no OSV advisories return no vulnerabilities (not an error)
- Very new vulnerabilities may not yet appear in OSV/KEV/EPSS data sources

## How this service works

Drop a lockfile (npm, yarn, pnpm, pip, Poetry, Cargo, Go, Composer, Bundler, Gradle, NuGet) and see which vulnerable packages to fix first: OSV advisories ranked by CISA KEV and EPSS, with the version that fixes each. Free 5 scans a day; Pro $9/month.

## Output

Returns a ranked list of vulnerable packages found in the lockfile, each with the associated OSV advisory IDs, CISA KEV status, EPSS exploitation probability score, current version, and the version that fixes the vulnerability — ordered by real-world exploitability priority.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "filename": {
   "type": "string",
   "description": "Lockfile name, e.g. package-lock.json, poetry.lock, go.sum"
  },
  "lockfile": {
   "type": "string",
   "description": "The lockfile contents"
  },
  "packages": {
   "type": "array",
   "description": "Or a pre-parsed list of {ecosystem, name, version}"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {}
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/depmoor-dependency-vulnerability-scanner-ad0bf486/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from depmoor.cybermaxtools.com](https://www.zero.xyz/host/depmoor.cybermaxtools.com/llms.txt)