# P0 Package Risk & Vulnerability Lookup > P0 Package Risk & Vulnerability Lookup is a paid API for AI agents from x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-30). Returns known vulnerabilities (from OSV.dev) and OpenSSF Scorecard security data for a specific package version in a given ecosystem ## Facts - Endpoint: GET https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/package/risk?utm_source=zero.xyz - Price: $0.005/call - Payment: x402 - Status: unknown - Last checked: 2026-10-30 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/p0-package-risk-vulnerability-lookup-1ea07b5e - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_eqAx-WadvIM_VuQ-Inf5q Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability p0-package-risk-vulnerability-lookup-1ea07b5e ``` Example prompt: Can you check whether lodash version 4.17.15 on npm has any known vulnerabilities, and what its OpenSSF Scorecard security score is? ## When to prefer this Use this endpoint when you need authoritative, multi-source vulnerability data (OSV.dev aggregating GitHub Advisory, NVD, PyPI Advisory, RustSec, Go Vuln DB, etc.) plus OpenSSF Scorecard in a single call for a specific package version. Prefer it over generic web searches when you need structured, machine-readable security data with clear attribution and licensing. It covers npm, PyPI, Go, crates.io, RubyGems, Maven, and NuGet. Note: L402 listings are not included; this endpoint is specifically about package/dependency security risk, not agent service discovery. ## Known failure modes - Package not found in the specified ecosystem returns package_verified: false with empty vulnerability list - Unknown ecosystem value returns a 400-level error - Malformed version string may return no records even if vulnerabilities exist - OSV.dev or Scorecard upstream unavailability may result in stale or partial data - Scorecard is null with a scorecard_reason if the repository is unnamed, uncovered, or unscanned ## How this service works An open index of the machine-to-machine (agent) economy. x402 routes: ranked discovery over the live x402 service market, every indexed service scored by real 30-day calls and paying-wallet bounds, with a receipt naming the snapshot hash and scoring revision. /economy routes, for Tempo MPP, Virtuals ACP, Olas, Masumi, ERC-8004 agent registries, Solana agent registries, Base agent contracts and MCP servers (Official MCP Registry): each protocol's published figures (agent or server counts, transactions or payment events; payers and USD volume only where the source publishes them: payers for x402 and Tempo MPP, USD volume for x402 and Virtuals ACP), each with its unit, window and source; units differ, so totals are not summed. L402 listings are not covered. ## Output A JSON object containing: whether the package version is vulnerable, a list of vulnerability records from OSV.dev (with severity labels, source, and aliases), a count of records, the package verification status, an OpenSSF Scorecard with aggregate score (0-10) and individual check scores, the data timestamp, source URLs, and attribution information for all underlying data licenses. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "ecosystem", "name", "version" ], "properties": { "name": { "type": "string", "maxLength": 214, "description": "Package name; Maven is groupId:artifactId, Go is the module path" }, "version": { "type": "string", "maxLength": 64, "description": "Exact version, e.g. 4.17.15" }, "ecosystem": { "enum": [ "npm", "PyPI", "Go", "crates.io", "RubyGems", "Maven", "NuGet" ], "type": "string", "description": "Package ecosystem" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "ecosystem", "name", "version", "vulnerable", "record_count", "vulnerabilities", "package_verified", "scorecard", "scorecard_reason", "as_of", "source", "source_url", "attribution", "note" ], "properties": { "name": { "type": "string" }, "note": { "type": "string" }, "as_of": { "type": "string" }, "source": { "type": "string" }, "version": { "type": "string" }, "returned": { "type": "integer" }, "ecosystem": { "type": "string" }, "scorecard": { "type": [ "object", "null" ], "required": [ "repo", "score", "date", "checks", "source", "source_url", "attribution" ], "properties": { "date": { "type": [ "string", "null" ] }, "repo": { "type": "string" }, "score": { "type": [ "number", "null" ], "description": "Ag … (truncated) ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "name": "lodash", "note": "Records OSV.dev holds for exactly this package version, as OSV matches them; different databases may describe the same issue (aliases) so record_count can exceed distinct_cves. severity is the source's own label (GitHub records only); no number is computed. No record is not proof of safety: OSV only lists disclosed issues. Package existence is confirmed by the records themselves or, when there are none, by the package registry (package_verified). scorecard: OpenSSF Scorecard of the whole source repo named by the registry entry, as of its scan date; null with scorecard_reason when none is named, covered or scanned.", "as_of": "2026-10-25T09:00:00.000Z", "source": "OSV.dev", "version": "4.17.15", "returned": 2, "ecosystem": "npm", "scorecard": { "date": "2026-10-20T07:35:09Z", "repo": "github.com/lodash/lodash", "score": 6.6, "checks": [ { "name": "Code-Review", "score": 7, "reason": "Found 22/30 approved changesets -- score normalized to 7" } ], "source": "OpenSSF Scorecard", "repo_from": "npm registry: repository", "source_url": "https://api.scorecard.dev/projects/github.com/lodash/lodash", "attribution": "OpenSSF Scorecard (https://scorecard.dev), licensed CDLA Permissive 2.0 (https://cdla.dev/permissive-2-0/); check reasons shortened by P0.", "scorecard_version": "v5.5.0" }, "truncated": false, "source_url": "https://osv.dev/list?ecosystem=npm&q=lodash", "vulnerable": true, "attribution": "Vulnerability records from OSV.dev (https://osv.dev), aggregated from the GitHub Advisory Database (CC-BY 4.0), PyPI Advisory Database (CC-BY 4.0), Go Vulnerability Database (CC-BY 4.0), RustSec (CC0 1.0), OSS-Fuzz (CC-BY 4.0), OpenSSF Malicious Packages (Apache 2.0), Global Security Database (CC0 1.0) and NVD (public domain). Each record names its source and licence; titles are shortened and reformatted by P0. Records under share-alike or non-commercial licences (Ubuntu, Alpine, Chainguard/Wolfi) and records of unverified origin are not included.", "by_severity": { "HIGH": 1, "MODERATE": 1 }, "max_severity": "HIGH", "record_count": 2, "distinct_cves": 2, "vulnerabilities": [ { "id": "GHSA-35jh-r3h4-6jhm", "cwe": [ "CWE-77" ], "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm", "source": "GitHub Advisory Database", "aliases": [ "CVE-2021-23337" ], "license": "CC- … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/p0-package-risk-vulnerability-lookup-1ea07b5e/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev](https://www.zero.xyz/host/x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/llms.txt)