# Sicher CVE Check — Package Vulnerability Scanner

> Sicher CVE Check — Package Vulnerability Scanner is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-11).

Queries OSV.dev for vulnerabilities across multiple package ecosystems and returns CVE identifiers, severity, summaries, and the minimum fixed version for each affected package.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/cve-check?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sicher-cve-check-package-vulnerability-scanner-deed6825
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1dWqyvW0O3ctSiwAsNhNh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sicher-cve-check-package-vulnerability-scanner-deed6825 -d '<json body>'
```

Example prompt: Check if lodash version 4.17.20 on npm has any known CVEs and tell me the lowest version I should upgrade to in order to fix all of them.

## When to prefer this

Choose this endpoint when you need to check specific package versions against known CVEs across multiple ecosystems (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Linux distros) and want a single actionable 'minimum fixed version' output, rather than a full SBOM scan or licence audit. It is ideal for spot-checking individual dependencies in CI pipelines or agent-driven security workflows.

## Known failure modes

- Package not found in the specified ecosystem — returns empty vulnerability list
- Unknown or malformed ecosystem name — returns validation error
- OSV.dev upstream unavailable — returns gateway or timeout error
- Invalid package version format — returns parse error
- Rate limiting or payment failure — returns 402 or 429 status

## How this service works

Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities found with their identifiers, severity and summary, and the single figure that decides what to do next: the lowest version that fixes all of them, derived from the fixed-version events in the affected ranges.

## Output

Returns a list of vulnerabilities for each queried package, including CVE/OSV identifiers, severity ratings, human-readable summaries, and the single lowest package version that resolves all identified vulnerabilities, derived from fixed-version events in the affected ranges.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "packages": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "name",
     "version"
    ],
    "properties": {
     "name": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Package name as the ecosystem spells it."
     },
     "version": {
      "type": "string",
      "maxLength": 60,
      "minLength": 1,
      "description": "Exact installed version."
     },
     "ecosystem": {
      "type": "string",
      "maxLength": 30,
      "description": "Ecosystem, e.g. npm, PyPI, Go. Defaults to the top-level value."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 100,
   "minItems": 1,
   "description": "The packages to check."
  },
  "ecosystem": {
   "type": "string",
   "default": "npm",
   "maxLength": 30,
   "description": "Default ecosystem for entries that do not name one."
  },
  "min_severity": {
   "enum": [
    "low",
    "medium",
    "high",
    "critical"
   ],
   "type": "string",
   "description": "Only report findings at or above this severity."
  },
  "include_details": {
   "type": "boolean",
   "default": true,
   "description": "Fetch summary and severity per finding. Off is faster but returns ids only."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sicher-cve-check-package-vulnerability-scanner-deed6825/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)