# PennyRail OSV Package Vulnerability Lookup

> PennyRail OSV Package Vulnerability Lookup is a paid API for AI agents from pennyrail.vercel.app, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-15).

Queries the OSV (Open Source Vulnerabilities) database to return known security vulnerabilities for a given software package

## Facts

- Endpoint: POST https://pennyrail.vercel.app/api/p/micro/security.osv-package--package-vulnerabilities
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pennyrail-osv-package-vulnerability-lookup-1623942d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_y4NPZh2doBTeH_Ozt-cpZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pennyrail-osv-package-vulnerability-lookup-1623942d -d '<json body>'
```

Example prompt: Can you check the OSV vulnerability database for any known security issues in the npm package 'lodash' version 4.17.20?

## When to prefer this

Use this endpoint when you need a quick, pay-per-call lookup of OSV vulnerability data for a specific package without managing your own OSV API credentials or infrastructure. Ideal for agent pipelines doing on-demand dependency checks, especially when cost predictability at $0.004/call matters and you want to avoid rate-limit concerns of direct OSV API access.

## Known failure modes

- Unknown or misspelled package name returns empty results rather than an error
- Unsupported ecosystem may yield no results
- Very new packages may not yet have OSV entries even if vulnerabilities are known
- Broad or unversioned queries may return very large result sets
- Network or upstream OSV API timeout results in a 5xx error

## How this service works

Machine-readable settlement service

## Output

Returns a list of known vulnerability records from the OSV database for the specified package, including vulnerability IDs (e.g. CVE, GHSA), affected version ranges, severity information, descriptions, and references to advisories or patches.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "additionalProperties": true
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pennyrail-osv-package-vulnerability-lookup-1623942d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pennyrail.vercel.app](https://www.zero.xyz/host/pennyrail.vercel.app/llms.txt)