# fittings GitHub Advisory Database Lookup

> fittings GitHub Advisory Database Lookup is a paid API for AI agents from fittings.sh, paid per call via x402, $0.00399/call, status unknown (last checked 2026-10-10).

Retrieves the full GitHub Advisory Database record for a given GHSA or CVE identifier, including severity, CVSS, EPSS, CWEs, and affected package version ranges per ecosystem.

## Facts

- Endpoint: GET https://fittings.sh/v1/ghsa/advisory?utm_source=zero.xyz
- Price: $0.00399/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fittings-github-advisory-database-lookup-db35bb88
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Qpyw-r8cS3Un7Mnm9ecGR

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fittings-github-advisory-database-lookup-db35bb88
```

Example prompt: Can you look up the GitHub Advisory Database record for CVE-2021-44228 — I need the severity, CVSS score, EPSS score, CWEs, and the affected package version ranges?

## When to prefer this

Use this endpoint when you need structured, machine-readable vulnerability metadata (severity, CVSS, EPSS, CWEs, affected version ranges) for a known GHSA or CVE identifier. It is ideal for automated dependency scanning, security triage pipelines, or enriching vulnerability reports with authoritative GitHub Advisory Database data. Prefer this over NVD or OSV lookups when you specifically need GitHub Advisory Database records with ecosystem-level package version ranges.

## Known failure modes

- Unknown or invalid GHSA/CVE ID returns an error or empty result
- Advisory not yet published or embargoed may return no data
- maxAffected out of range (outside 1-100) may return a validation error
- Network or upstream GitHub Advisory Database availability issues causing timeouts

## How this service works

The full GitHub Advisory Database record for a GHSA or CVE id: severity, CVSS, EPSS, CWEs, and the affected package and version ranges per ecosystem.

## Output

Returns the full GitHub Advisory Database record including: severity level, CVSS base score, EPSS probability score, CWE identifiers, and a list of affected packages with their version ranges per ecosystem (e.g., npm, PyPI, Maven). Optionally includes the full advisory text description.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "id"
     ],
     "properties": {
      "id": {
       "type": "string",
       "description": "GHSA id (GHSA-jfh8-c2jp-5v3q) or CVE id (CVE-2021-44228)"
      },
      "maxAffected": {
       "type": "number",
       "description": "Affected package rows to return, 1-100, default 20"
      },
      "includeDescription": {
       "type": "boolean",
       "description": "Include the full advisory text, default false"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fittings-github-advisory-database-lookup-db35bb88/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from fittings.sh](https://www.zero.xyz/host/fittings.sh/llms.txt)