# SiteSignal OSV Package Vulnerabilities

> SiteSignal OSV Package Vulnerabilities is a paid API for AI agents from phases-prot-shine-royal.trycloudflare.com, paid per call via x402, $0.015/call, status down (last checked 2026-09-15).

Returns bounded OSV (Open Source Vulnerabilities) records for a specific package version in a given ecosystem (npm, PyPI, Maven, Go, or crates.io).

## Facts

- Endpoint: GET https://phases-prot-shine-royal.trycloudflare.com/x402/osv-vulnerabilities
- Price: $0.015/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitesignal-osv-package-vulnerabilities-7022798c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dzGJU9xtnCUzjzK0d_DHM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitesignal-osv-package-vulnerabilities-7022798c
```

Example prompt: Check the OSV vulnerability database for lodash version 4.17.20 in the npm ecosystem and tell me if there are any known security issues.

## When to prefer this

Choose this endpoint when you need a quick, bounded vulnerability lookup for a single exact package version against the OSV database — ideal for CI/CD pipelines, dependency audits, or pre-deployment checks. It supports the most common ecosystems (npm, PyPI, Maven, Go, crates.io). Prefer this over broader SCA (software composition analysis) tools when you only need OSV data for one package at a time without a full project scan.

## Known failure modes

- Package not found in the specified ecosystem returns empty vulnerability list
- Invalid or unsupported ecosystem value returns a validation error
- Malformed version string may return no results or an error
- Network timeouts from upstream OSV API may cause failure
- Rate limiting or payment failure (x402) blocks the request

## How this service works

Return bounded OSV vulnerability records for one exact package ecosystem, name, and version.

## Output

A bounded set of OSV vulnerability records matching the specified package ecosystem, name, and version. Each record typically includes vulnerability IDs (e.g. CVE, GHSA identifiers), affected version ranges, severity details, and source links from the OSV database.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "package",
      "version"
     ],
     "properties": {
      "package": {
       "type": "string",
       "maxLength": 255,
       "minLength": 1
      },
      "version": {
       "type": "string",
       "maxLength": 128,
       "minLength": 1
      },
      "ecosystem": {
       "enum": [
        "npm",
        "PyPI",
        "Maven",
        "Go",
        "crates.io"
       ],
       "type": "string"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitesignal-osv-package-vulnerabilities-7022798c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from phases-prot-shine-royal.trycloudflare.com](https://www.zero.xyz/host/phases-prot-shine-royal.trycloudflare.com/llms.txt)