# Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)

> Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) is a paid API for AI agents from email-verify.agentdiet.dev, paid per call via MPP, $0.01/call, status unknown (last checked 2026-10-28).

Queries Google OSV.dev to return active CVEs, GHSA advisories, and patched versions for a given PyPI, npm, Go, or Rust crate package

## Facts

- Endpoint: POST https://email-verify.agentdiet.dev/v1/pypi-vuln-scan?utm_source=zero.xyz
- Price: $0.01/call
- Payment: MPP
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Provider: email-verify.agentdiet.dev
- Website: https://email-verify.agentdiet.dev
- Canonical page: https://www.zero.xyz/c/email-verify-agentdiet-dev-real-time-open-source-package-cve-ghsa-b9cd1905
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bSzRidxQDTTyGdAJAwHLB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability email-verify-agentdiet-dev-real-time-open-source-package-cve-ghsa-b9cd1905 -d '<json body>'
```

Example prompt: Can you check if the PyPI package 'requests' has any active CVEs or GHSA security advisories, and tell me which versions are patched?

## When to prefer this

Choose this endpoint when you need real-time, live vulnerability data from Google OSV.dev for a specific open-source package across PyPI, npm, Go modules, or Rust crates. It is ideal for on-demand security checks during CI/CD pipelines, dependency audits, or agent-driven code reviews, especially when you need both CVE and GHSA advisory data in a single call without setting up your own OSV.dev integration.

## Known failure modes

- Package not found in the specified ecosystem — returns empty or error response
- Invalid package identifier format — missing or malformed 'Ecosystem:name' syntax causes validation error
- OSV.dev upstream unavailable — service may timeout or return an error if Google's API is down
- Unsupported ecosystem specified — ecosystems outside PyPI, npm, Go, crates.io may not return results
- Payment failure — x402 micropayment not fulfilled results in 402 response blocking the query

## How this service works

Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://email-verify.agentdiet.dev/v1/pypi-vuln-scan)

## Output

Returns a structured response containing active CVE identifiers, GHSA advisory IDs, vulnerability descriptions, severity information, and details about patched or fixed versions for the queried package and ecosystem.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "package"
 ],
 "properties": {
  "package": {
   "type": "string",
   "minLength": 1,
   "description": "Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/email-verify-agentdiet-dev-real-time-open-source-package-cve-ghsa-b9cd1905/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from email-verify.agentdiet.dev](https://www.zero.xyz/host/email-verify.agentdiet.dev/llms.txt)