# NovaPath Package Vulnerability Advisory Lookup

> NovaPath Package Vulnerability Advisory Lookup is a paid API for AI agents from instructional-decision-engine-x402.vercel.app, paid per call via x402, $0.1/call, status unknown (last checked 2026-11-01).

Queries current OSV vulnerability advisories for an exact npm, PyPI, or Go package version and returns an AI-generated explanation with source-matched evidence and advisory IDs

## Facts

- Endpoint: POST https://instructional-decision-engine-x402.vercel.app/ai/package-advisories?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-01
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/novapath-package-vulnerability-advisory-lookup-2cdf7f52
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6sgcYtOduVH1Lahw5hGu2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability novapath-package-vulnerability-advisory-lookup-2cdf7f52 -d '<json body>'
```

Example prompt: Can you check if lodash version 4.17.20 on npm has any known security advisories? I want to know the OSV advisory IDs and a plain-English explanation of any vulnerabilities found.

## When to prefer this

Choose this endpoint when you need a quick, AI-explained vulnerability lookup for an exact package version in npm, PyPI, or Go ecosystems, backed by live OSV advisory data with traceable advisory IDs. It is especially useful when you want a human-readable summary alongside raw advisory IDs rather than raw database output. Prefer this over general web search for security info when you need structured, source-matched evidence tied to a specific package version.

## Known failure modes

- No advisories found (does not mean the package is safe, only that no OSV match exists)
- Invalid package name or version format rejected by schema pattern validation
- Unsupported ecosystem specified (only npm, PyPI, Go are accepted)
- More than ten matching advisories exist — only the first ten are returned, potentially incomplete
- Package/version combination does not exist in OSV database
- Network timeout or upstream OSV API unavailability

## How this service works

Query current OSV advisories for an exact npm, PyPI or Go package version, then return a bounded AI explanation with source-matched evidence and advisory IDs. No-match means no source match, never a safety guarantee. Supports up to ten matching advisories per request; no exploit execution.

## Output

Returns up to ten matching OSV advisories for the specified package/version/ecosystem combination. Each result includes advisory IDs, a bounded AI-generated explanation of the vulnerability, and source-matched evidence. If no advisories are found, the response indicates no match — explicitly not a safety guarantee.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "package": {
   "type": "string",
   "pattern": "^[A-Za-z0-9@][A-Za-z0-9@._/+-]{0,99}$",
   "maxLength": 100,
   "minLength": 1
  },
  "version": {
   "type": "string",
   "pattern": "^[A-Za-z0-9][A-Za-z0-9._+!~-]{0,59}$",
   "maxLength": 60,
   "minLength": 1
  },
  "ecosystem": {
   "enum": [
    "npm",
    "PyPI",
    "Go"
   ],
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/novapath-package-vulnerability-advisory-lookup-2cdf7f52/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from instructional-decision-engine-x402.vercel.app](https://www.zero.xyz/host/instructional-decision-engine-x402.vercel.app/llms.txt)