# Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)

> Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) is a paid API for AI agents from sec-intel.agentdiet.dev, paid per call via MPP, $0.01/call, status unknown (last checked 2026-10-21).

Queries live Google OSV.dev to return active CVEs, GHSA advisories, and patched versions for PyPI, npm, Go, or Rust crate packages.

## Facts

- Endpoint: GET https://sec-intel.agentdiet.dev/v1/cargo-vuln-scan?utm_source=zero.xyz
- Price: $0.01/call
- Payment: MPP
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Provider: sec-intel.agentdiet.dev
- Website: https://sec-intel.agentdiet.dev
- Canonical page: https://www.zero.xyz/c/sec-intel-agentdiet-dev-real-time-open-source-package-cve-ghsa-4fcbebbc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hRJQ5WC_ORBnFKZKaLqzv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sec-intel-agentdiet-dev-real-time-open-source-package-cve-ghsa-4fcbebbc
```

Example prompt: Check if the PyPI package 'requests' has any active CVEs or GHSA advisories right now, and tell me what versions are patched.

## When to prefer this

Choose this endpoint when you need real-time, authoritative CVE and GHSA vulnerability data for a specific open-source package across PyPI, npm, Go modules, or Rust crates — especially when you need live data from Google OSV.dev rather than a cached or static NVD snapshot. Ideal for CI/CD pipeline security checks, dependency auditing before deployment, or agent-driven supply-chain risk assessments.

## Known failure modes

- Invalid or unrecognized package identifier returns empty or error response
- Ecosystem prefix mismatch (e.g. wrong ecosystem label) may yield no results
- OSV.dev upstream unavailability could cause timeout or 502 errors
- Package name typos return no vulnerability data without warning
- Packages with no known vulnerabilities return an empty advisory list which may be misread as an error

## How this service works

Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (Live x402 v2, IETF MPP & MCP endpoint at https://sec-intel.agentdiet.dev/v1/cargo-vuln-scan)

## Output

Returns a structured list of active vulnerabilities for the queried package including CVE IDs, GHSA advisory IDs, severity ratings, affected version ranges, and recommended patched versions sourced live from Google OSV.dev.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "package"
 ],
 "properties": {
  "package": {
   "type": "string",
   "minLength": 1,
   "description": "Package identifier in 'Ecosystem:name' or 'name' format (e.g. 'PyPI:requests', 'npm:lodash', 'Go:golang.org/x/net', 'crates.io:hyper')"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sec-intel-agentdiet-dev-real-time-open-source-package-cve-ghsa-4fcbebbc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sec-intel.agentdiet.dev](https://www.zero.xyz/host/sec-intel.agentdiet.dev/llms.txt)