# PennyRail OSV Package Lookup

> PennyRail OSV Package Lookup is a paid API for AI agents from pennyrail.vercel.app, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-15).

Looks up known security vulnerabilities for a software package using the OSV (Open Source Vulnerabilities) database

## Facts

- Endpoint: POST https://pennyrail.vercel.app/api/p/micro/security.osv-package--osv-package-lookup
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pennyrail-osv-package-lookup-26bad178
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_w6HH1J0j9WTwLu6YLjlVP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pennyrail-osv-package-lookup-26bad178 -d '<json body>'
```

Example prompt: Can you check if there are any known security vulnerabilities for the npm package 'axios' version 1.4.0?

## When to prefer this

Use this endpoint when you need a pay-per-call, agent-friendly OSV package vulnerability lookup without managing your own OSV API credentials or infrastructure. Prefer this over self-hosted OSV queries when building lightweight AI agents or pipelines that need on-demand security checks at low cost ($0.004/call) with x402 micropayment settlement.

## Known failure modes

- Package not found in OSV database returns empty results or 404
- Invalid or unrecognized ecosystem name may cause lookup failure
- Unversioned queries may return broad or incomplete results
- Upstream OSV API downtime causes service unavailability
- Malformed input object causes 400-level error

## How this service works

Machine-readable settlement service

## Output

Returns structured vulnerability data from the OSV database for the queried package, including vulnerability IDs (CVE/GHSA), severity ratings, affected version ranges, descriptions, and references to advisories or patches.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "additionalProperties": true
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pennyrail-osv-package-lookup-26bad178/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pennyrail.vercel.app](https://www.zero.xyz/host/pennyrail.vercel.app/llms.txt)