Open Source Vulnerability Check
Package vulnerability check — check one exact open-source dependency version or purl against OSV, enrich CVE matches with CISA KEV known-exploited signals, and report fixes, severity, and provenance.
Offering
- Provider
- dependency-risk.use.x402atlas.com
- Method
- POST
- Offering type
- Api Endpoint
- Transport type
- http
- Category
- Security
- Delivery
- Not provided
- Pricing model
- Not provided
- x402 version
- 2
Endpoint context
- URL
https://dependency-risk.use.x402atlas.com/package- MIME type
- Not provided
- First seen
- 2026-10-16T01:50:14.534Z
- Last seen
- Tags
- package-vulnerability-check, osv, cve, cisa-kev, software-supply-chain
Payment pricing
x402 payment terms are the authoritative price for calling this endpoint.
- Payment option 1
- 0.005 USDC
Atomic price: 5000 · Network: eip155:8453 · Asset: USDC · Scheme: exact - Payment option 2
- 0.005 USDC
Atomic price: 5000 · Network: eip155:137 · Asset: USDC · Scheme: exact - Payment option 3
- 0.005 USDC
Atomic price: 5000 · Network: eip155:42161 · Asset: USDC · Scheme: exact - Payment option 4
- 0.005 USDC
Atomic price: 5000 · Network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · Asset: USDC · Scheme: exact
Raw x402 terms
[
{
"scheme": "exact",
"network": "eip155:8453",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"amount": "5000",
"payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2"
},
{
"scheme": "exact",
"network": "eip155:137",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"amount": "5000",
"payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2"
},
{
"scheme": "exact",
"network": "eip155:42161",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"amount": "5000",
"payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2"
},
{
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"amount": "5000",
"payTo": "ASt6xvRyQ7ntERsmcYVMdLqZvz1GEN8Fzexzq62tXrNQ"
}
]Observed health
- Status
- Reachable
- Latest latency
- 13 ms
- Average latency
- 13 ms
- HTTP status
- 405
- Last checked
- Reachability
- 100% over 10 checks
Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.
Input schema
{
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"purl": {
"description": "Canonical package URL containing an embedded exact version",
"maxLength": 2048,
"minLength": 1,
"type": "string"
}
},
"required": [
"purl"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
}Output schema
{
"properties": {
"example": {
"additionalProperties": false,
"properties": {
"_atlas": {
"description": "Atlas docs and related routes, added after deployment",
"type": "object"
},
"findings": {
"description": "Normalized OSV findings sorted by id; [] when none",
"items": {
"additionalProperties": false,
"description": "One normalized OSV finding (at most 48 KiB)",
"properties": {
"affected": {
"description": "OSV affected entries {package, ranges[{type, repo, events}], versions, severity} in source order",
"items": {
"type": "object"
},
"type": "array"
},
"aliases": {
"description": "Deduplicated OSV aliases",
"items": {
"type": "string"
},
"type": "array"
},
"fixed_versions": {
"description": "Explicit fixed events for this package; [] means none published, not that no fix exists",
"items": {
"type": "string"
},
"type": "array"
},
"id": {
"description": "OSV record id",
"type": "string"
},
"kev": {
"description": "Exact CISA KEV match {cve_id, vendor_project, product, vulnerability_name, date_added, short_description, required_action, due_date, cwes, known_ransomware_campaign_use, notes}; present only on a match",
"type": "object"
},
"max_severity": {
"description": "From parseable CVSS vectors only",
"enum": [
"unknown",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"modified": {
"description": "OSV modification time",
"type": "string"
},
"published": {
"description": "OSV publication time; absent when unsupplied",
"type": "string"
},
"references": {
"description": "OSV references {type, url}; URLs are untrusted and never fetched",
"items": {
"type": "object"
},
"type": "array"
},
"severity": {
"description": "OSV severity vectors {type, score}",
"items": {
"type": "object"
},
"maxItems": 16,
"type": "array"
},
"summary": {
"description": "OSV summary",
"type": "string"
},
"withdrawn": {
"description": "Withdrawn findings stay listed but are excluded from summary",
"type": "boolean"
},
"withdrawn_at": {
"description": "Present only when withdrawn",
"type": "string"
}
},
"required": [
"id",
"aliases",
"modified",
"withdrawn",
"affected",
"references",
"severity",
"max_severity",
"fixed_versions"
],
"type": "object"
},
"maxItems": 16,
"type": "array"
},
"input": {
"additionalProperties": false,
"description": "Exact package identity",
"properties": {
"ecosystem": {
"description": "purl type, lowercase",
"type": "string"
},
"name": {
"description": "Package name",
"type": "string"
},
"purl": {
"description": "Canonical purl when the caller used purl form",
"type": "string"
},
"version": {
"description": "Queried version",
"type": "string"
}
},
"required": [
"ecosystem",
"name",
"version"
],
"type": "object"
},
"operation": {
"const": "package-check",
"description": "Route operation id",
"type": "string"
},
"retrieved_at": {
"description": "UTC completion time of this response, not an OSV time",
"format": "date-time",
"type": "string"
},
"schema_version": {
"const": "dependency-risk-v1",
"description": "Response contract version",
"type": "string"
},
"source": {
"additionalProperties": false,
"description": "Sources and the exact CISA KEV snapshot used",
"properties": {
"cisa_kev": {
"description": "{name, catalog_version, date_released, retrieved_at} of the KEV snapshot",
"type": "object"
},
"osv": {
"description": "{name: OSV.dev}",
"type": "object"
}
},
"required": [
"osv",
"cisa_kev"
],
"type": "object"
},
"stale": {
"description": "True only when a prior CISA KEV snapshot is served after a refresh failure",
"type": "boolean"
},
"status": {
"description": "no_known_vulnerabilities means no matching active OSV record, not that the dependency is safe",
"enum": [
"no_known_vulnerabilities",
"vulnerabilities_found"
],
"type": "string"
},
"summary": {
"additionalProperties": false,
"description": "Active non-withdrawn findings",
"properties": {
"finding_count": {
"description": "Active findings",
"maximum": 16,
"minimum": 0,
"type": "integer"
},
"kev_count": {
"description": "Active findings with an exact KEV match",
"maximum": 16,
"minimum": 0,
"type": "integer"
},
"max_severity": {
"description": "Among active findings",
"enum": [
"unknown",
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
},
"required": [
"finding_count",
"kev_count",
"max_severity"
],
"type": "object"
},
"warnings": {
"description": "Freshness and interpretation warnings; [] when none",
"items": {
"description": "Warning text",
"type": "string"
},
"type": "array"
}
},
"required": [
"operation",
"schema_version",
"source",
"retrieved_at",
"stale",
"warnings",
"input",
"status",
"summary",
"findings"
],
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}