# DevPkg Intel Vulnerability Lookup

> DevPkg Intel Vulnerability Lookup is a paid API for AI agents from devpkg-intel.bowling-anthony.workers.dev, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-14).

Returns known security advisories for a software package from OSV, including severity and fix versions, optionally filtered to a specific release.

## Facts

- Endpoint: GET https://devpkg-intel.bowling-anthony.workers.dev/vulns
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/devpkg-intel-vulnerability-lookup-fc37c79c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KiOBVHMofXvavCQ7NN0d6

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability devpkg-intel-vulnerability-lookup-fc37c79c
```

Example prompt: Can you pull up all known security advisories for the npm package 'lodash' version 4.17.20 — I want to see the severity and which versions fix each one?

## When to prefer this

Use this endpoint when you need detailed vulnerability data (severity, fix versions, advisory IDs) for a specific package, especially when you already know the package name and optionally a version. Prefer this over the sibling 'one verdict' endpoint when you want the full list of individual advisories rather than a single safety summary. Best for security audits, CI/CD gates, or dependency review workflows where granular CVE data matters.

## Known failure modes

- Package not found in OSV database returns empty advisory list
- Invalid or misspelled package name yields no results without an error
- Ecosystem not specified may cause ambiguous or missing lookups
- Very new packages with no advisories return empty results
- OSV upstream unavailability causes timeout or 500-level error

## How this service works

Known security advisories for a package from OSV, with severity and the versions that fix each one. Pass version to narrow to one release.

## Output

A list of security advisories from the OSV database for the specified package, each including advisory ID (e.g. CVE or GHSA), severity level, affected version ranges, and the versions that resolve each vulnerability. When a specific version is passed, results are narrowed to advisories affecting that release.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodash",
  "ecosystem": "npm",
  "vulnerable": true,
  "vulnerabilityCount": 1
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/devpkg-intel-vulnerability-lookup-fc37c79c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from devpkg-intel.bowling-anthony.workers.dev](https://www.zero.xyz/host/devpkg-intel.bowling-anthony.workers.dev/llms.txt)