# PayAI CVE Package Vulnerability Scanner

> PayAI CVE Package Vulnerability Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-11).

Scans a software package for known vulnerabilities by querying OSV.dev, then enriches results with NVD CVSS scores, CISA KEV status, and EPSS probabilities, returning a prioritized advisory list with fixed versions.

## Facts

- Endpoint: GET https://payai.agentstools.dev/cve/scan?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-cve-package-vulnerability-scanner-aff01f36
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JyfQstx_7OFJB5RibWB4s

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-cve-package-vulnerability-scanner-aff01f36
```

Example prompt: Can you scan the PyPI package 'requests' version 2.25.0 for known vulnerabilities, and tell me which CVEs are critical, if any are in the CISA KEV list, and what version I should upgrade to?

## When to prefer this

Use this endpoint when you need a fused, enriched vulnerability view for a specific package version that goes beyond raw OSV data — particularly when you need CVSS severity, CISA KEV exploit status, and EPSS probability in a single call with fixed-version guidance. Prefer over raw OSV.dev API when prioritization context (KEV + EPSS) matters for triage decisions.

## Known failure modes

- Package not found in OSV.dev — returns empty advisory list or 404
- Invalid ecosystem enum value — returns 400 validation error
- No version specified alongside ecosystem and name — may return all advisories or error
- purl malformed — returns parse error
- NVD or EPSS enrichment temporarily unavailable — may return partial data without CVSS or EPSS scores
- Rate limit or payment failure — returns 402 or 429

## How this service works

Vulnerability scan for a software package by ecosystem, name and version, or by package-URL (purl). Queries OSV.dev for known advisories, collects their CVE ids and enriches them with NVD CVSS, CISA KEV and EPSS, then returns a prioritized list of advisories with exact fixed versions. Risk indicators, not advice.

## Output

A prioritized list of security advisories for the queried package, each including CVE IDs, NVD CVSS base scores and vectors, CISA KEV inclusion status, EPSS exploit probability scores, affected version ranges, and the exact fixed version to upgrade to.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (Maven uses group:artifact)"
      },
      "purl": {
       "type": "string",
       "description": "Package-URL instead of ecosystem/name/version, e.g. pkg:pypi/jinja2@2.4.1"
      },
      "version": {
       "type": "string",
       "description": "Package version, e.g. 2.4.1"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "PyPI",
        "Maven",
        "crates.io",
        "Go",
        "Packagist",
        "RubyGems",
        "NuGet"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-cve-package-vulnerability-scanner-aff01f36/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)