# PennyRail OSV Package Dependency Vulnerability Check

> PennyRail OSV Package Dependency Vulnerability Check is a paid API for AI agents from pennyrail.vercel.app, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-15).

Checks a software package or dependency for known security vulnerabilities using the OSV (Open Source Vulnerabilities) database

## Facts

- Endpoint: POST https://pennyrail.vercel.app/api/p/micro/security.osv-package--dependency-vulnerability-check
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pennyrail-osv-package-dependency-vulnerability-check-f652254b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8UryTPIQV7Q_TyV1zqCEi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pennyrail-osv-package-dependency-vulnerability-check-f652254b -d '<json body>'
```

Example prompt: Can you check whether lodash version 4.17.20 in the npm ecosystem has any known security vulnerabilities?

## When to prefer this

Use this endpoint when you need a fast, pay-per-call vulnerability lookup for a specific package and version against the OSV database without setting up your own vulnerability scanning infrastructure. Particularly useful in agent workflows that need to gate on security checks before installing dependencies or shipping releases.

## Known failure modes

- Package not found in OSV database returns empty vulnerability list
- Unrecognized ecosystem identifier causes lookup failure
- Missing package name or version in input returns validation error
- Network timeout or OSV upstream unavailability causes 5xx response
- Ambiguous package name without ecosystem specified may return incorrect results

## How this service works

Machine-readable settlement service

## Output

Returns a vulnerability assessment for the specified package and version, including matched OSV vulnerability records, CVE IDs, severity ratings (CVSS scores), affected version ranges, and available fix versions or patches if known.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "additionalProperties": true
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pennyrail-osv-package-dependency-vulnerability-check-f652254b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pennyrail.vercel.app](https://www.zero.xyz/host/pennyrail.vercel.app/llms.txt)