# SYNTHORA OSV.dev Batch Vulnerability Query

> SYNTHORA OSV.dev Batch Vulnerability Query is a paid API for AI agents from osv-vuln-querybatch.hergertsynthora.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Batch-queries OSV.dev to return known vulnerability IDs for an array of package+version pairs in a single API call, enabling whole-lockfile or SBOM audits in one round-trip.

## Facts

- Endpoint: POST https://osv-vuln-querybatch.hergertsynthora.com/service
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthora-osv-dev-batch-vulnerability-query-8d73a0cc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y79CXDECpPppfotaEHgZy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthora-osv-dev-batch-vulnerability-query-8d73a0cc -d '<json body>'
```

Example prompt: Scan all the packages in my requirements.txt for known vulnerabilities using OSV — send them all in one batch and tell me which ones have CVEs or known security issues.

## When to prefer this

Choose this endpoint when you need to audit multiple packages in a single network call — for example, scanning an entire lockfile, requirements.txt, or SBOM in one round-trip rather than issuing N individual queries. It is purpose-built for CI/CD pipelines and agent-to-agent workflows where latency and call count matter. If you only need to check a single package, a direct OSV.dev single-query endpoint may be simpler; if you need full vulnerability detail (not just IDs), you will need a follow-up enrichment step.

## Known failure modes

- Empty or malformed 'queries' array returns an empty vulnerabilities list with ok:true but no useful data
- Package ecosystem or version string not recognized by OSV returns an empty vulnerability list for that entry (silent miss)
- OSV.dev upstream API downtime causes the proxy to fail or return an error
- Rate limiting or oversized batch arrays may cause timeouts or partial results
- Payment failure (x402 USDC) will block the call before it reaches OSV

## How this service works

POST an array of package+version queries to keyless OSV.dev and get vulnerability id lists for each in a single call — built for scanning a whole lockfile at once. Lets autonomous agents and agent-to-agent CI pipelines audit an entire SBOM in one round-trip instead of N. Ranking surface for bulk supply-chain risk. First 3 calls FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.

## Output

Returns a JSON object with an 'ok' status flag and a 'result' object containing a 'vulnerabilities' array — one entry per queried package — each listing the OSV vulnerability IDs (e.g. CVE, GHSA identifiers) associated with that package version. Also includes provenance metadata pointing back to the upstream OSV.dev batch API.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "queries": {
   "type": "array",
   "description": "queries"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "niche": "osv-vuln-querybatch",
  "result": {
   "vulnerabilities": []
  },
  "provenance": {
   "url": "https://api.osv.dev/v1/querybatch",
   "source": "OSV.dev Batch Vulnerability Query"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthora-osv-dev-batch-vulnerability-query-8d73a0cc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from osv-vuln-querybatch.hergertsynthora.com](https://www.zero.xyz/host/osv-vuln-querybatch.hergertsynthora.com/llms.txt)