# Synthr Cyber Dependency Audit

> Synthr Cyber Dependency Audit is a paid API for AI agents from synthr.online, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Audits a list of software dependencies for known vulnerabilities using OSV, EPSS, and KEV data, detecting malicious packages and returning prioritized findings with agent-actionable recommendations.

## Facts

- Endpoint: POST https://synthr.online/v1/cyber/audit-deps
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthr-cyber-dependency-audit-9a6ce439
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_S3ivdElnbV1IxRrodyf_z

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthr-cyber-dependency-audit-9a6ce439 -d '<json body>'
```

Example prompt: Audit these dependencies for vulnerabilities and malicious packages — ['lodash@4.17.20', 'axios@0.21.1', 'log4j@2.14.1', 'numpy@1.21.0'] — and include malicious package detection so I know if anything in my stack is a supply chain risk.

## When to prefer this

Choose this endpoint when you need machine-readable, prioritized vulnerability data for a known list of packages — especially when you want EPSS exploit probability and CISA KEV catalog cross-referencing alongside OSV CVE data. Ideal for autonomous CI/CD agents, security harnesses, or builder tools that need actionable output rather than raw NVD dumps.

## Known failure modes

- Empty or malformed dependencies array returns validation error
- Unrecognized package name format may yield zero findings without error
- Payment not included or insufficient USDC results in 402 response
- OSV/EPSS/KEV upstream data sources may be temporarily unavailable causing degraded results
- Very large dependency arrays may time out or return partial results

## How this service works

Agent-native cybersecurity intelligence. Real OSV + EPSS + KEV data. Stack briefs, dep audits, advice, web reconnaissance. Prioritized for autonomous builders and harnesses.

## Output

Returns a structured report with a list of vulnerability findings per package (including EPSS scores, KEV status, and severity), count of packages analyzed, number of malicious packages detected, a confidence score for the analysis, data source attribution, and a set of concrete agent-actionable remediation steps.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "dependencies"
 ],
 "properties": {
  "dependencies": {
   "type": "array"
  },
  "includeMalicious": {
   "type": "boolean"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "asOf": {
   "type": "string"
  },
  "queryId": {
   "type": "string"
  },
  "sources": {
   "type": "array"
  },
  "findings": {
   "type": "array"
  },
  "confidence": {
   "type": "number"
  },
  "agentActions": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "packagesAnalyzed": {
   "type": "integer"
  },
  "maliciousPackagesDetected": {
   "type": "integer"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthr-cyber-dependency-audit-9a6ce439/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from synthr.online](https://www.zero.xyz/host/synthr.online/llms.txt)