# Package Security Advisory Lookup

> Package Security Advisory Lookup is a paid API for AI agents from agents.crowdspark.me, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-31).

Returns known vulnerabilities, license, latest version, deprecation status, and a safe/caution/avoid verdict for a given npm, PyPI, cargo, Go, or Maven package version.

## Facts

- Endpoint: GET https://agents.crowdspark.me/v1/dev/package-advisories?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-security-advisory-lookup-c77f8e58
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7p8qkY1V2Wq6c5HeGV9-8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-security-advisory-lookup-c77f8e58
```

Example prompt: Before I add lodash version 4.17.20 to my project, can you check if it has any known vulnerabilities in npm and tell me if I should avoid it or if there's a safe version to use instead?

## When to prefer this

Use this endpoint when an AI agent or developer workflow needs to quickly audit a single package version for security issues before installation, dependency pinning, or CI/CD gating. It is ideal when you need a single-call verdict (safe/caution/avoid) with supporting CVE details and a suggested fix version, without needing to integrate directly with OSV.dev or multiple package registries. Prefer it over raw OSV.dev API calls when you also need license, deprecation status, and latest version in one response.

## Known failure modes

- Unknown package name returns a 404 or empty result
- Unsupported ecosystem returns a validation error
- Specifying a version that does not exist may return no vulnerability data or an error
- Rate limit exceeded on free tier (>25 calls/day per IP without payment header) returns 402 or 429
- Network timeout if OSV.dev upstream is slow
- Maven packages require group:artifact format; bare artifact name may fail

## How this service works

Pay-per-call utilities for AI agents over x402, USDC on Base.

## Output

A JSON object containing the package name, ecosystem, version checked, vulnerability count and items (with CVE IDs, severity, and fixed-in versions), severity breakdown (HIGH/MODERATE/LOW counts), latest version and whether it is newer, license(s), deprecated flag, a suggested minimum fixed version, and an overall verdict of 'safe', 'caution', or 'avoid' with human-readable reasons explaining the decision.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name, e.g. lodash or requests (maven: group:artifact)"
      },
      "version": {
       "type": "string",
       "description": "Optional. Defaults to the latest version"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodash",
  "reasons": [
   "5 known advisories affect this version (worst: high)",
   "a newer version exists"
  ],
  "verdict": "avoid",
  "version": "4.17.20",
  "licenses": [
   "MIT"
  ],
  "ecosystem": "npm",
  "deprecated": false,
  "latest_version": "4.18.1",
  "version_checked": "requested",
  "vulnerabilities": {
   "count": 5,
   "items": [
    {
     "id": "GHSA-29mw-wpgm-hmr9",
     "cve": [
      "CVE-2020-28500"
     ],
     "fixed_in": [
      "4.17.21"
     ],
     "severity": "MODERATE"
    }
   ],
   "by_severity": {
    "HIGH": 2,
    "MODERATE": 3
   }
  },
  "suggested_min_fixed_version": "4.18.0"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-security-advisory-lookup-c77f8e58/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agents.crowdspark.me](https://www.zero.xyz/host/agents.crowdspark.me/llms.txt)