# OSV Package Vulnerability Checker

> OSV Package Vulnerability Checker is a paid API for AI agents from data.japanagent.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-11).

Checks an open-source package for known vulnerabilities by querying the OSV (Google Open Source Vulnerabilities) database, returning CVE/GHSA IDs, severity, and fixed versions.

## Facts

- Endpoint: GET https://data.japanagent.dev/vuln/check?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/osv-package-vulnerability-checker-721b28f0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_G7Y2saXt8RrvA6eku0p7i

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability osv-package-vulnerability-checker-721b28f0
```

Example prompt: Before I install it, can you check if the npm package lodash version 4.17.20 has any known vulnerabilities in the OSV database?

## When to prefer this

Use this endpoint when you need a quick, pre-install vulnerability check for any open-source package across major ecosystems (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist) without setting up your own OSV integration. Ideal for coding agents doing automated dependency audits. If you need full vulnerability record details by a known CVE/GHSA ID, use the sibling fetch-by-ID endpoint instead.

## Known failure modes

- Unknown or misspelled package name returns empty vulnerability list
- Invalid ecosystem value returns a 400 error
- Version string not matching any known release may return no results
- OSV database unavailable causes 502/503 error
- Payment failure (x402) blocks the request before it reaches OSV

## How this service works

Check an open-source package for known vulnerabilities via the OSV database (Google Open Source Vulnerabilities). Pass package name, ecosystem (npm, PyPI, Go, crates.io, Maven, RubyGems, etc.) and optional version. Returns vulnerability IDs, summaries, severity and fixed versions. Essential pre-install check for coding agents.

## Output

Returns a list of known vulnerability records for the specified package and ecosystem, including vulnerability IDs (CVE, GHSA, OSV), human-readable summaries, severity levels, affected version ranges, and the fixed version where the vulnerability was patched.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "package",
      "ecosystem"
     ],
     "properties": {
      "package": {
       "type": "string",
       "description": "Package name as registered in the ecosystem (npm: lodash / PyPI: requests / Maven: org.apache.logging.log4j:log4j-core)"
      },
      "version": {
       "type": "string",
       "description": "Optional exact version to check"
      },
      "ecosystem": {
       "type": "string",
       "description": "npm | PyPI | Go | Maven | crates.io | RubyGems | NuGet | Packagist"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/osv-package-vulnerability-checker-721b28f0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from data.japanagent.dev](https://www.zero.xyz/host/data.japanagent.dev/llms.txt)