# TokenGuard Dev Vulnerabilities Endpoint

> TokenGuard Dev Vulnerabilities Endpoint is a paid API for AI agents from eltociear-tokenguard.hf.space, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Checks a software package for known security vulnerabilities by name and ecosystem, returning CVE/GHSA IDs, severity scores, and fix versions.

## Facts

- Endpoint: POST https://eltociear-tokenguard.hf.space/dev/vulns
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tokenguard-dev-vulnerabilities-endpoint-7a1826d3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RtA-X4SXlWVVbl_QKUKv1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tokenguard-dev-vulnerabilities-endpoint-7a1826d3 -d '<json body>'
```

Example prompt: Can you check if the npm package lodash has any known security vulnerabilities, and if so, tell me which versions fix them and how severe they are?

## When to prefer this

Use this endpoint when you need fast, per-package vulnerability lookups with CVE/GHSA detail and fix-version information, paid via x402 micropayments on Base at $0.005/call. Prefer it over broader SAST tools when you need lightweight, programmatic advisory data for a specific package name and ecosystem without maintaining a local vulnerability database.

## Known failure modes

- Package not found in the specified ecosystem — returns count 0 or error
- Unknown ecosystem identifier causes validation error
- Network timeout to upstream advisory database
- x402 micropayment failure ($0.005 USDC on Base) results in 402 response before data is returned
- Malformed package name returns 4xx error

## How this service works

Known vulnerabilities for a package (OSV.dev — aggregate of GHSA, PyPA, RustSec, Go and more) or a free-text CVE search (NVD), with severity and fixed versions

## Output

A JSON object with the package name, ecosystem, a boolean 'vulnerable' flag, a count of vulnerabilities found, and an array of vulnerability objects each containing a GHSA ID, CVE aliases, fixed-in version list, and a CVSS severity string.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "description": "Package name"
  },
  "query": {
   "type": "string",
   "description": "Free-text CVE search instead of a package"
  },
  "version": {
   "type": "string",
   "description": "Pin to one version (optional)"
  },
  "ecosystem": {
   "type": "string",
   "description": "npm | PyPI | crates.io | Go | Maven | RubyGems (default npm)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 1,
  "package": "lodash",
  "ecosystem": "npm",
  "vulnerable": true,
  "vulnerabilities": [
   {
    "id": "GHSA-29mw-wpgm-hmr9",
    "aliases": [
     "CVE-2020-28500"
    ],
    "fixed_in": [
     "4.17.21"
    ],
    "severity": "CVSS:3.1/…"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tokenguard-dev-vulnerabilities-endpoint-7a1826d3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-tokenguard.hf.space](https://www.zero.xyz/host/eltociear-tokenguard.hf.space/llms.txt)