# Hermes Dependency Vulnerability Check

> Hermes Dependency Vulnerability Check is a paid API for AI agents from hermes-counterparty-api.onrender.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Checks whether a specific package version has known vulnerabilities by querying OSV.dev, returning a structured JSON report of CVEs and security advisories.

## Facts

- Endpoint: POST https://hermes-counterparty-api.onrender.com/v1/dependency-vulnerability-check
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/hermes-dependency-vulnerability-check-d4bfebe6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qqIbFHGmAw4evsRTXkKvl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability hermes-dependency-vulnerability-check-d4bfebe6 -d '<json body>'
```

Example prompt: Can you check if lodash version 4.17.20 in the npm ecosystem has any known security vulnerabilities?

## When to prefer this

Choose this endpoint when you need a quick, deterministic, per-package vulnerability lookup against the OSV.dev database with a structured JSON response, especially in agent workflows that require pay-per-call billing via x402 USDC. Prefer it over manual OSV.dev queries when integrating security checks into automated pipelines, CI/CD agents, or software supply chain audits. It is also useful when you need the result in a clean schema alongside other Hermes commerce intelligence endpoints on the same platform.

## Known failure modes

- Unknown package or version — OSV.dev may return empty results without indicating the package doesn't exist
- Invalid ecosystem name — request may fail or return no results if ecosystem string doesn't match OSV taxonomy (e.g. 'node' instead of 'npm')
- OSV.dev API downtime — upstream provider unavailable causing the endpoint to error
- Partial version matching — OSV may not match if version string format doesn't exactly match their records
- Rate limiting or payment failure — x402 payment of 0.005 USDC must succeed before the request is processed

## How this service works

Agent utilities for company research, package maintenance intelligence, dependency vulnerability checks, counterparty availability, SEC company snapshots, OFAC sanctions screening, and deterministic JSON/CSV data-quality work. Company domain intelligence includes a free preview before the paid enrichment call.

## Output

Returns a JSON object with a 'vulnerable' boolean, a 'vulnerability_count' integer, a 'vulnerabilities' array (with CVE/advisory details if any), a 'warnings' array, the original query echoed back, and the OSV.dev API source reference. If no vulnerabilities are found, 'vulnerable' is false and both arrays are empty.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "package": {
   "type": "string",
   "maxLength": 300,
   "minLength": 1,
   "description": "Exact package name"
  },
  "version": {
   "type": "string",
   "maxLength": 200,
   "minLength": 1,
   "description": "Exact package version"
  },
  "ecosystem": {
   "type": "string",
   "maxLength": 100,
   "minLength": 1,
   "description": "OSV ecosystem name such as npm, PyPI, Maven, Go, or RubyGems"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": {
   "package": "fastify",
   "version": "5.6.0",
   "ecosystem": "npm"
  },
  "source": {
   "api_url": "https://api.osv.dev/v1/query",
   "provider": "OSV.dev"
  },
  "warnings": [],
  "vulnerable": false,
  "schema_version": "1.0",
  "vulnerabilities": [],
  "vulnerability_count": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/hermes-dependency-vulnerability-check-d4bfebe6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from hermes-counterparty-api.onrender.com](https://www.zero.xyz/host/hermes-counterparty-api.onrender.com/llms.txt)