# SignalDesk AI OSV Batch Vulnerability Lookup

> SignalDesk AI OSV Batch Vulnerability Lookup is a paid API for AI agents from x402-agent.kariguetoazul.workers.dev, paid per call via x402, $0.006/call, status unknown (last checked 2026-10-09).

Batch-queries the OSV (Open Source Vulnerabilities) database to find known CVEs and security advisories for up to 10 package/version/ecosystem combinations in a single call.

## Facts

- Endpoint: POST https://x402-agent.kariguetoazul.workers.dev/api/security/osv-batch?utm_source=zero.xyz
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-09
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/signaldesk-ai-osv-batch-vulnerability-lookup-9dd0be8c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_O0gXdL8gccjKJ-TvTEjma

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability signaldesk-ai-osv-batch-vulnerability-lookup-9dd0be8c -d '<json body>'
```

Example prompt: Check OSV for known vulnerabilities in lodash 4.17.15 on npm, axios 0.21.1 on npm, and requests 2.25.0 on PyPI — I need a list of any GHSA or CVE IDs affecting those versions.

## When to prefer this

Use this endpoint when you need to batch-check multiple packages across different ecosystems for known vulnerabilities in a single API call, rather than making separate requests per package. It is especially useful in CI/CD pipelines, dependency audits, or agent workflows where you need evidence-backed, OSV-sourced security data with minimal round-trips. Prefer this over direct OSV API calls when you need x402 micropayment-gated access with structured response caching.

## Known failure modes

- Missing required fields (package, version, or ecosystem) returns a validation error
- Unsupported ecosystem value outside the allowed enum returns a schema error
- Querying more than 10 packages in a batch exceeds maxItems and is rejected
- Unknown or misspelled package names return an empty vulnerability list (not an error)
- Upstream OSV API unavailability causes a proxy error or timeout
- Payment failure (x402) blocks the request before it reaches OSV

## How this service works

Evidence-backed autonomous AI jobs and paid data tools. Queue/D1/cron run outside the chat; free quotas and bounded execution apply.

## Output

Returns a JSON object with source metadata (provider, fetch time, expiry, source URL) and a results array. Each result maps a package/version/ecosystem tuple to its list of known vulnerabilities, where each vulnerability includes its GHSA/CVE ID and the date it was last modified in the OSV database.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "queries": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "ecosystem",
     "package",
     "version"
    ],
    "properties": {
     "package": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "Package name."
     },
     "version": {
      "type": "string",
      "maxLength": 100,
      "minLength": 1,
      "description": "Exact version."
     },
     "ecosystem": {
      "enum": [
       "npm",
       "PyPI",
       "Maven",
       "crates.io",
       "Go",
       "RubyGems",
       "NuGet"
      ],
      "type": "string",
      "maxLength": 4096,
      "description": "OSV ecosystem."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 10,
   "minItems": 1,
   "description": "Package/version queries."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "source": {
   "provider": "OSV",
   "expires_at": "2026-10-02T10:14:48.075Z",
   "fetched_at": "2026-10-02T09:44:48.075Z",
   "source_url": "https://api.osv.dev/v1/querybatch",
   "transformed": true
  },
  "results": [
   {
    "package": "lodash",
    "version": "4.17.15",
    "ecosystem": "npm",
    "vulnerabilities": [
     {
      "id": "GHSA-29mw-wpgm-hmr9",
      "modified": "2025-09-29T21:12:31.102523Z"
     },
     {
      "id": "GHSA-35jh-r3h4-6jhm",
      "modified": "2026-09-10T03:49:04.067984Z"
     },
     {
      "id": "GHSA-f23m-r3pf-42rh",
      "modified": "2026-09-10T03:50:44.050013Z"
     },
     {
      "id": "GHSA-p6mc-m468-83gw",
      "modified": "2025-08-12T21:56:17.174859Z"
     },
     {
      "id": "GHSA-r5fr-rjxr-66jc",
      "modified": "2026-09-10T03:51:02.970455Z"
     },
     {
      "id": "GHSA-xxjr-mmjv-4gpg",
      "modified": "2026-09-10T03:50:33.722177Z"
     }
    ]
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/signaldesk-ai-osv-batch-vulnerability-lookup-9dd0be8c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-agent.kariguetoazul.workers.dev](https://www.zero.xyz/host/x402-agent.kariguetoazul.workers.dev/llms.txt)