# SYNTHORA Packagist Composer Security Advisories

> SYNTHORA Packagist Composer Security Advisories is a paid API for AI agents from packagist-security-advisories.hergertsynthora.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Queries Packagist for all known security advisories (CVEs, GHSAs, affected version constraints) for a list of PHP Composer packages

## Facts

- Endpoint: POST https://packagist-security-advisories.hergertsynthora.com/service
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthora-packagist-composer-security-advisories-9672b700
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wv0H7YwkjSkoqEZCmNCnR

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthora-packagist-composer-security-advisories-9672b700 -d '<json body>'
```

Example prompt: Can you check these Composer packages for known security vulnerabilities: symfony/http-foundation, laravel/framework, guzzlehttp/guzzle — give me all CVEs and GHSA advisories with affected version ranges?

## When to prefer this

Choose this endpoint when you need PHP-specific Composer/Packagist vulnerability data with CVE and GHSA identifiers for autonomous CI auditing, agent-to-agent security gates, or supply-chain risk ranking. Prefer this over generic vulnerability databases when working exclusively in the PHP/Composer ecosystem and needing structured, per-package advisory detail with version constraints directly from Packagist's authoritative source.

## Known failure modes

- Empty advisories array returned when no known vulnerabilities exist for submitted packages (not an error)
- Malformed package name strings may cause Packagist to return no results without explicit error
- Network or upstream Packagist.org outage may cause service unavailability
- Packages not listed on Packagist.org will silently return no advisories
- Rate limiting or payment failure returns non-200 HTTP status

## How this service works

POST/GET a list of PHP Composer packages to keyless packagist.org and get all known security advisories (advisoryId, CVE, GHSA remoteId, affected version constraints, title) per package. The core PHP supply-chain audit primitive for autonomous agents and agent-to-agent CI gates. Ranking surface for Composer vulnerability exposure. First 3 calls FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.

## Output

Returns a JSON object with an 'ok' status flag, a 'result' object containing an 'advisories' array keyed by package name — each advisory includes advisoryId, CVE identifier, GHSA remoteId, affected version constraints, and vulnerability title — plus provenance metadata indicating the upstream Packagist source URL.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "packages": {
   "type": "string",
   "description": "packages"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "niche": "packagist-security-advisories",
  "result": {
   "advisories": []
  },
  "provenance": {
   "url": "https://packagist.org/api/security-advisories/?packages[]=symfony/symfony",
   "source": "Packagist Composer Security Advisories"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthora-packagist-composer-security-advisories-9672b700/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from packagist-security-advisories.hergertsynthora.com](https://www.zero.xyz/host/packagist-security-advisories.hergertsynthora.com/llms.txt)