# pkgpulse Vulnerability Check

> pkgpulse Vulnerability Check is a paid API for AI agents from pkgpulse.letom1176.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-30).

Scans a package from npm, PyPI, Go, crates.io, Maven, or other ecosystems against OSV for known CVEs and returns severity counts, upgrade advice, and a plain-English verdict

## Facts

- Endpoint: GET https://pkgpulse.letom1176.workers.dev/api/vuln-check?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkgpulse-vulnerability-check-1be88b20
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fJd3jDl_xcKRfK95a-E67

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkgpulse-vulnerability-check-1be88b20
```

Example prompt: Check lodash version 4.17.15 on npm for known vulnerabilities and tell me if I need to upgrade and to what version.

## When to prefer this

Use this endpoint when you need to check a specific package and version (or latest) for known CVEs across major ecosystems including npm, PyPI, Go modules, crates.io, and Maven. It is ideal for per-package pre-install checks, CI gate decisions, or agent-driven dependency triage where you want a structured severity breakdown and upgrade recommendation in a single call. Prefer this over a full dependency audit endpoint when you only need to check one package at a time, or when you have a PURL and want a precise point-in-time vulnerability snapshot with GHSA/CVE detail.

## Known failure modes

- Unknown package name returns 404 or empty result
- Invalid ecosystem value causes a validation error
- Version range syntax errors may return unexpected results
- Rate limiting or payment failure (x402) returns 402 Payment Required
- Packages not yet indexed in OSV may return no vulnerabilities even if issues exist
- Very new CVEs may not yet appear in OSV data

## How this service works

Dependency intelligence for AI coding agents, paid per-call via x402 (USDC on Base): npm package health scores with a disclosed rubric, typosquat checks, dependency audits, OSV known-vulnerability scans (npm, PyPI, Go, crates.io, Maven and more) and PyPI preflight checks. Free index at /, free sample at /api/sample.

## Output

Returns a JSON object with the package name, ecosystem, version checked, latest available version, a verdict ('vulnerable' or 'clear'), a human-readable headline summarizing findings, counts of vulnerabilities by severity (critical/high/medium/low/total), a recommended upgrade version, whether the latest version clears all issues, and a list of individual vulnerabilities each with GHSA/CVE ID, summary, fixed-in version, severity label, and CVSS score.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name, e.g. lodash, @babel/core, requests, github.com/gin-gonic/gin"
      },
      "purl": {
       "type": "string",
       "description": "Alternative to name/version/ecosystem: a package URL, e.g. pkg:pypi/requests@2.19.0"
      },
      "version": {
       "type": "string",
       "description": "Exact version or range (^4.17.0, >=2.28,<3). Omit for latest (npm, PyPI)"
      },
      "ecosystem": {
       "type": "string",
       "description": "npm (default), pypi, go, crates, maven, nuget, rubygems, packagist, pub, hex"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodash",
  "counts": {
   "low": 0,
   "high": 3,
   "total": 6,
   "medium": 3,
   "critical": 0
  },
  "latest": "4.18.1",
  "verdict": "vulnerable",
  "headline": "lodash@4.17.15: 6 known vulnerabilities (3 high, 3 medium). Upgrade to 4.18.0 or later.",
  "ecosystem": "npm",
  "upgrade_to": "4.18.0",
  "version_checked": "4.17.15",
  "vulnerabilities": [
   {
    "id": "GHSA-p6mc-m468-83gw",
    "aliases": [
     "CVE-2020-8203"
    ],
    "summary": "Prototype Pollution in lodash",
    "fixed_in": "4.17.19",
    "severity": "high",
    "cvss_score": 7.4
   }
  ],
  "latest_clears_all": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkgpulse-vulnerability-check-1be88b20/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pkgpulse.letom1176.workers.dev](https://www.zero.xyz/host/pkgpulse.letom1176.workers.dev/llms.txt)