# pkgpulse Vulnerability Audit (GET)

> pkgpulse Vulnerability Audit (GET) is a paid API for AI agents from pkgpulse.letom1176.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Scans a comma-separated list of packages across npm, PyPI, Go, crates.io, Maven and more for known OSV vulnerabilities, returning severity-ranked advisories and a fix verdict.

## Facts

- Endpoint: GET https://pkgpulse.letom1176.workers.dev/api/vuln-audit?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkgpulse-vulnerability-audit-get-1c97e487
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5KD2m1fXlCQrr3nXgQ_I2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkgpulse-vulnerability-audit-get-1c97e487
```

Example prompt: Can you scan these packages for known vulnerabilities: lodash@4.17.20, pypi:requests@2.28.0, and @babel/traverse@7.22.0 — and tell me which ones are critical or high severity and what I should upgrade to?

## When to prefer this

Use this endpoint when you need a fast, per-call vulnerability scan across one or more packages from multiple ecosystems in a single query, especially when you want OSV-backed severity rankings and concrete upgrade advice. Prefer it over the POST batch audit endpoint when you have a short list of specific packages rather than a full package-lock.json or requirements file. It is the right choice for pre-deploy checks, CI pipeline spot-checks, or when an agent needs to verify a handful of dependencies on demand without uploading a full manifest.

## Known failure modes

- Missing or malformed 'packages' query parameter returns a 400 error
- Unknown package names return a not_found count in summary but do not fail the request
- Payment not included or insufficient USDC returns HTTP 402 requiring x402 payment
- Ecosystem prefix typo (e.g. 'pip:' instead of 'pypi:') may cause package not found
- Rate limiting or upstream OSV database unavailability may cause 5xx errors

## How this service works

Dependency intelligence for AI coding agents, paid per-call via x402 (USDC on Base): npm package health scores with a disclosed rubric, typosquat checks, dependency audits, OSV known-vulnerability scans (npm, PyPI, Go, crates.io, Maven and more) and PyPI preflight checks. Free index at /, free sample at /api/sample.

## Output

A JSON object with a summary (total packages scanned, counts of malicious/not-found/vulnerable, advisories broken down by severity: low/medium/high/critical), a human-readable verdict string (e.g. 'fix now: critical or high severity vulnerabilities present'), the detected input format, and a worst_offenders array listing each vulnerable package with its recommended upgrade version, vulnerability count, and maximum severity.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "packages"
     ],
     "properties": {
      "packages": {
       "type": "string",
       "description": "Comma-separated name@version items; prefix pypi:, go:, crates:, maven: for other ecosystems (npm default)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "summary": {
   "scanned": 200,
   "packages": 214,
   "malicious": 0,
   "not_found": 0,
   "vulnerable": 9,
   "advisories_by_severity": {
    "low": 2,
    "high": 5,
    "medium": 8,
    "critical": 1
   }
  },
  "verdict": "fix now: critical or high severity vulnerabilities present",
  "input_format": "package-lock.json",
  "worst_offenders": [
   {
    "package": "npm:@babel/traverse@7.22.0",
    "upgrade_to": "7.23.2",
    "vuln_count": 1,
    "max_severity": "critical"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkgpulse-vulnerability-audit-get-1c97e487/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pkgpulse.letom1176.workers.dev](https://www.zero.xyz/host/pkgpulse.letom1176.workers.dev/llms.txt)