# Mekler AI Package Vulnerability Checker

> Mekler AI Package Vulnerability Checker is a paid API for AI agents from api.mekler.ai, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-27).

Checks an exact PyPI or npm package version against OSV advisories and CISA KEV catalog, returning grouped CVE/GHSA records with affected/fixed version evidence and known exploitation data.

## Facts

- Endpoint: POST https://api.mekler.ai/v1/data/packages/check-version-vulnerabilities?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mekler-ai-package-vulnerability-checker-2687991e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_4ITtV4xiZCCiSMewYHGTT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mekler-ai-package-vulnerability-checker-2687991e -d '<json body>'
```

Example prompt: Can you check whether the PyPI package 'requests' version 2.19.0 has any known vulnerabilities in OSV or the CISA exploited list?

## When to prefer this

Use this endpoint when you need to check a specific, exact package version (not a range or unpinned dependency) against OSV and CISA KEV for point-in-time vulnerability status. It is ideal for CI/CD gates, deployment audits, and security triage where you have a known pinned version. It does NOT perform dependency graph traversal, malware scanning, or registry existence checks — use other tools for those needs. Prefer this over generic web searches when you need structured, machine-readable advisory data with grouped aliases and exploitation evidence.

## Known failure modes

- OSV API pagination incomplete — returns partial results uncharged
- CISA KEV source fetch failure — endpoint returns without KEV data, uncharged
- Invalid ecosystem value (not 'pypi' or 'npm') — validation error
- Package name or version exceeds length limits — schema validation error
- Package not found in OSV — returns verdict with no advisories but no error
- Newly published advisories not yet indexed — may produce false negatives
- Withdrawn advisories excluded — may cause confusion if only known by that ID

## How this service works

Check an exact PyPI or npm package version against OSV advisories, group aliases and report affected/fixed version evidence and CISA known exploitation. Preserve source disagreements, withdrawn records, unsupported ranges and dated coverage. No dependency traversal, malware scan, registry existence check or safety guarantee. 0.01 USDC per completed diagnostic; source failures and incomplete pagination are uncharged.

## Output

Returns a JSON object with verdict (affected/unaffected/unknown), grouped vulnerability records aliasing CVE and GHSA IDs, per-advisory version status (affected/fixed/unaffected), fixed version lists, CISA known exploitation entries with due dates, coverage metadata (pages queried, query completeness, KEV catalog version), withdrawn advisory IDs, source disagreement flags, and a list of limitations about what is not checked.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "maxLength": 128
  },
  "version": {
   "type": "string",
   "maxLength": 80,
   "minLength": 1
  },
  "ecosystem": {
   "enum": [
    "pypi",
    "npm"
   ],
   "type": "string"
  },
  "request_id": {
   "type": "string",
   "pattern": "^[A-Za-z0-9_-]{16,64}$"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "requests",
  "status": "ok",
  "verdict": "affected",
  "version": "2.19.0",
  "coverage": {
   "pages": 1,
   "kev_count": 1,
   "kev_source": "https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json",
   "osv_source": "https://api.osv.dev/v1/query",
   "query_complete": true,
   "kev_released_at": "2026-10-20T00:00:00Z",
   "advisory_records": 1,
   "withdrawn_records": 0,
   "kev_catalog_version": "2026.10.20"
  },
  "ecosystem": "pypi",
  "advisories": [
   {
    "id": "GHSA-mekl-0000-0001",
    "version_status": "affected",
    "known_exploitation": [
     {
      "cve": "CVE-2026-99901",
      "due_date": "2026-11-10",
      "date_added": "2026-10-20",
      "ransomware_use": "Unknown"
     }
    ],
    "fixed_versions_reported": [
     "2.20.0"
    ]
   }
  ],
  "limitations": [
   "No known matches means no affected version found in this bounded OSV response; unknown, unpublished, missing or newly changed advisories remain possible."
  ],
  "observed_at": "2026-10-21T00:00:00Z",
  "vulnerability_groups": [
   {
    "identifiers": [
     "CVE-2026-99901",
     "GHSA-mekl-0000-0001"
    ],
    "advisory_ids": [
     "GHSA-mekl-0000-0001"
    ],
    "version_status": "affected",
    "source_disagreement": false
   }
  ],
  "withdrawn_advisory_ids": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mekler-ai-package-vulnerability-checker-2687991e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.mekler.ai](https://www.zero.xyz/host/api.mekler.ai/llms.txt)