# Vulnerability Intelligence – Package Version CVE Lookup

> Vulnerability Intelligence – Package Version CVE Lookup is a paid API for AI agents from vuln-intel.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-21).

Returns known vulnerabilities, fixed versions, severity, and exploited-in-the-wild status for an exact package version across major ecosystems.

## Facts

- Endpoint: GET https://vuln-intel.x402tookit.com/vuln-package?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vulnerability-intelligence-package-version-cve-lookup-c60ad6c7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_9M1NOB_M-h2mX9eFUAG1h

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vulnerability-intelligence-package-version-cve-lookup-c60ad6c7
```

Example prompt: Check if lodash version 4.17.15 on npm has any known vulnerabilities — I need the CVE IDs, severity, fixed versions, and whether any of them are being actively exploited in the wild.

## When to prefer this

Use this endpoint when you need vulnerability data for a single, precisely known package name and version in a supported ecosystem (npm, PyPI, Go, Maven, NuGet, etc.). It is ideal for per-dependency checks in CI/CD pipelines, security audits, or incident triage where you already know the exact version pinned. Prefer the batch endpoint (up to 10 packages at once) for scanning full dependency lists. Use the GHSA/CVE advisory lookup sibling if you already have a specific advisory ID rather than a package version.

## Known failure modes

- Unknown ecosystem value returns an error or empty result
- Exact version string mismatch causes no advisories found even if vulnerability exists
- Package name typo returns empty result with no advisories
- Upstream vulnerability database temporarily unavailable may return degraded=true with partial results
- Very new or obscure packages may have no advisory data available
- Non-exact version strings (ranges, wildcards) may not be supported

## How this service works

Known vulnerabilities for an exact package version (npm, PyPI, Go, Maven...): fixed version, exploited-in-the-wild flag.

## Output

Returns a structured vulnerability report including: list of advisories with CVE IDs, severity levels, published dates, fix versions, and summary; an overall verdict and worst-severity rating; an upgrade-to-at-least recommendation; an exploited-in-the-wild indicator; total advisory count; data source and timestamp; and any ecosystems or checks that could not be completed (degraded/notChecked flags).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name",
      "version"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name, e.g. lodash"
      },
      "version": {
       "type": "string",
       "description": "Exact version, e.g. 4.17.15"
      },
      "ecosystem": {
       "type": "string",
       "description": "npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Pub or Hex"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "top": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "object",
        "properties": {
         "id": {
          "type": [
           "null",
           "string"
          ]
         },
         "cves": {
          "type": [
           "array",
           "null"
          ],
          "items": {
           "type": "string"
          }
         },
         "fixedIn": {
          "type": [
           "array",
           "null"
          ],
          "items": {
           "type": "string"
          }
         },
         "summary": {
          "type": [
           "null",
           "string"
          ]
         },
         "severity": {
          "type": [
           "null",
           "string"
          ]
         },
         "published": {
          "type": [
           "null",
           "string"
          ]
         }
        }
       }
      },
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "package": {
       "type": [
        "null",
        "string"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "summary": {
       "type": [
        "null",
        "string"
 
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vulnerability-intelligence-package-version-cve-lookup-c60ad6c7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from vuln-intel.x402tookit.com](https://www.zero.xyz/host/vuln-intel.x402tookit.com/llms.txt)