# SYNTHORA OSV.dev Package Vulnerability Query

> SYNTHORA OSV.dev Package Vulnerability Query is a paid API for AI agents from osv-vuln-query.hergertsynthora.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Queries the OSV.dev database for known open-source vulnerabilities affecting a given package name, ecosystem, and version, returning matching CVEs with summaries, severity, and affected version ranges.

## Facts

- Endpoint: POST https://osv-vuln-query.hergertsynthora.com/service
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthora-osv-dev-package-vulnerability-query-45510e9b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_4K8O67dovFjnkCqAslt6K

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthora-osv-dev-package-vulnerability-query-45510e9b -d '<json body>'
```

Example prompt: Check OSV.dev for any known vulnerabilities in lodash version 4.17.20 in the npm ecosystem — I need the CVE summaries, severity levels, and affected version ranges before I approve this dependency.

## When to prefer this

Prefer this endpoint when you need a fast, keyless, pay-per-call supply-chain vulnerability scan against the OSV.dev database without managing API credentials. Ideal for autonomous agents, CI security gates, and agent-to-agent workflows that need to decide whether a dependency is safe to install. Use it when you want structured OSV data with severity and affected version ranges in a single call, without setting up a full SCA (Software Composition Analysis) platform.

## Known failure modes

- Package not found in the specified ecosystem returns an empty result set with ok:true
- Invalid or unrecognized ecosystem name may return an error or empty result
- Malformed version string may fail to match any vulnerability records
- OSV.dev upstream unavailability causes service errors
- Missing required fields (package, ecosystem, or version) returns a validation error
- Network timeout if OSV.dev upstream is slow

## How this service works

POST a package name+ecosystem+version to keyless OSV.dev and get all matching open-source vulnerabilities with summary, details, severity, and affected version ranges. The core supply-chain scan primitive for autonomous agents and agent-to-agent CI gates deciding whether a dependency is safe to install. Ranking surface for vulnerability count and severity. First 3 calls FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.

## Output

A JSON object containing an 'ok' boolean and a 'result' payload with all OSV.dev vulnerability records matching the queried package/ecosystem/version combination, including vulnerability IDs, human-readable summaries, detailed descriptions, CVSS severity scores, and the full set of affected version ranges.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "package": {
   "type": "object",
   "description": "package"
  },
  "version": {
   "type": "string",
   "description": "version"
  },
  "ecosystem": {
   "type": "string",
   "description": "ecosystem"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "niche": "osv-vuln-query",
  "result": {}
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthora-osv-dev-package-vulnerability-query-45510e9b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from osv-vuln-query.hergertsynthora.com](https://www.zero.xyz/host/osv-vuln-query.hergertsynthora.com/llms.txt)