# relay402 Package Vulnerability Checker

> relay402 Package Vulnerability Checker is a paid API for AI agents from relay402.georgespring.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Checks a named package in a specified ecosystem (npm, PyPI, Go, etc.) for known security vulnerabilities and risk signals, returning a vulnerability assessment.

## Facts

- Endpoint: GET https://relay402.georgespring.workers.dev/api/package-vulns
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relay402-package-vulnerability-checker-4455937b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_LjeRrKkIDL_ATsIBp6E54

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relay402-package-vulnerability-checker-4455937b
```

Example prompt: Before I add it to our project, can you check whether the npm package 'axios' version '1.6.0' has any known vulnerabilities?

## When to prefer this

Choose this endpoint when an AI agent needs a quick, pay-per-call vulnerability check on a specific package without managing API keys or subscriptions. It covers all major ecosystems (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist) in one interface. Prefer this over OSV or Snyk integrations when you need zero-setup auth via x402 micropayment, or when running in an autonomous agent context where credential management is impractical.

## Known failure modes

- Package name not found in the specified ecosystem — returns 404 or empty result
- Invalid ecosystem value — schema enforces enum, returns validation error
- Version string malformed or too long — schema enforces maxLength:64
- Payment not provided or insufficient — returns HTTP 402 requiring USDC payment on Base
- Network or upstream vulnerability database unavailable — returns 5xx error
- Package exists but has no vulnerability data — returns empty findings, not an error

## How this service works

Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Returns advisories with CVE aliases, severity, summary, fixed versions and reference links. Optional version narrows results to vulnerabilities affecting that exact version. Built for coding agents that install dependencies autonomously.

## Output

Returns a vulnerability assessment for the specified package including risk score, risk level (e.g. low/medium/high/critical), and details of any known CVEs or security advisories found in the package version. May include counts of vulnerabilities by severity.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "maxLength": 214,
       "minLength": 1
      },
      "version": {
       "type": "string",
       "maxLength": 64
      },
      "ecosystem": {
       "enum": [
        "npm",
        "PyPI",
        "Go",
        "Maven",
        "crates.io",
        "RubyGems",
        "NuGet",
        "Packagist"
       ],
       "type": "string"
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relay402-package-vulnerability-checker-4455937b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from relay402.georgespring.workers.dev](https://www.zero.xyz/host/relay402.georgespring.workers.dev/llms.txt)