Audit up to 10 dependencies, with exact-version advisories and fixes

$0.20 per call · failed calls are never charged · no account or API key needed

Check up to 10 public dependencies, optionally pinned to exact versions, for advisory IDs, OSV affected/fixed ranges and dated FIRST EPSS CVE estimates. Scoped npm names supported. Detail and subrequest caps apply; omitted details and incomplete coverage are explicit. Missing evidence is unknown, not zero risk. Automated signals, not a safety guarantee. See the buying guide for limits. Use before installing or upgrading dependencies.

Run it free (25 free calls) Buy credits by card (from $5) Example result (JSON)

Inputs

Name	Type	Description
`packages` (required)	string	Comma-separated ecosystem:name items, optionally name@exact-version; max 10. For scoped npm, use npm:@scope/name@version.

Request

Over HTTP, with a card key from /credits:

curl -H "Authorization: Bearer adt_…" "https://agent-data-tools.revmesh2074.workers.dev/package-audit?packages=npm%3Alodash%404.17.20%2Cpypi%3Arequests%402.31.0%2Cnpm%3A%40types%2Fnode%4022.0.0"

Or one of your 25 free calls, no key:

curl "https://agent-data-tools.revmesh2074.workers.dev/package-audit?packages=npm%3Alodash%404.17.20%2Cpypi%3Arequests%402.31.0%2Cnpm%3A%40types%2Fnode%4022.0.0&trial=1"

Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum, Monad, World Chain or Tempo) and retries.

Example result

{
  "checked": 1,
  "notFound": 0,
  "lookupFailed": 0,
  "versionNotFound": 0,
  "versionAdvisoryLookupIncomplete": 0,
  "epssLookup": {
    "source": "FIRST EPSS",
    "status": "complete",
    "sourceStatus": "available",
    "retrievedAt": "2026-10-14T12:00:00.000Z",
    "requestedCves": 1,
    "queriedCves": 1,
    "returnedScores": 1,
    "omittedCves": 0,
    "uninspectedAdvisoryDetails": 0,
    "malformedRows": 0,
    "note": "FIRST EPSS estimates 30-day exploitation probability, not package safety."
  },
  "summary": "All 1 package(s) exist. Review each verdict and flags before installing.",
  "results": [
    {
      "ecosystem": "npm",
      "name": "minimist",
      "exists": true,
      "version": "1.2.5",
      "versionExists": true,
      "verdict": "caution",
      "flags": [
        "known-vulnerabilities"
      ],
      "weeklyDownloads": null,
      "weeklyDownloadsStatus": "not-fetched-subrequest-budget",
      "knownVulnerabilities": 1,
      "advisoryIds": [
        "GHSA-xvch-5gv4-984h"
      ],
      "knownVulnerabilityCountSources": [
        "deps.dev",
        "OSV"
      ],
      "advisoryDetailsStatus": "not-fetched-subrequest-budget",
      "advisoryDetailsOmitted": 1,
      "advisoryDetailsUnavailable": 0,
      "advisories": [],
      "source": "deps.dev",
      "retrievedAt": "2026-10-14T12:00:00.000Z",
      "versionAdvisories": {
        "source": "OSV",
        "status": "complete",
        "retrievedAt": "2026-10-14T12:00:00.000Z",
        "advisoryCount": 1,
        "vulnerabilities": [
          {
            "id": "GHSA-xvch-5gv4-984h",
            "source": "OSV",
            "sourceUrl": "https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h",
            "retrievedAt": "2026-10-14T12:00:00.000Z",
            "detailStatus": "available",
            "modified": "2026-03-13T22:11:59.523514Z",
            "published": "2022-03-18T00:01:09Z",
            "aliases": [
              "CVE-2021-44906"
            ],
            "summary": "Prototype Pollution in minimist",
            "rangeStatus": "reported",
            "fixedVersionRanges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "1.0.0"
                  },
                  {
                    "fixed": "1.2.6"
                  }
                ],
                "fixedVersions": [
                  "1.2.6"
                ]
              },
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "0.2.4"
                  }
                ],
                "fixedVersions": [
                  "0.2.4"
                ]
              }
            ],
            "epss": {
              "source": "FIRST EPSS",
              "status": "complete",
              "sourceStatus": "available",
              "retrievedAt": "2026-10-14T12:00:00.000Z",
              "scores": [
                {
                  "cve": "CVE-2021-44906",
                  "status": "available",
                  "score": 0.04581,
                  "percentile": 0.91484,
                  "date": "2026-10-14"
                }
              ],
              "note": "EPSS estimates 30-day exploitation probability for CVE aliases; it is not a package-safety guarantee. Null scores are unknown, not zero."
            }
          }
        ],
        "note": "OSV advisories are matched to this exact package version."
      }
    }
  ],
  "source": "deps.dev"
}

From an AI agent (MCP)

Add the MCP server to Claude, Cursor or any MCP client. This tool is package_audit, and the first 25 successful calls are free:

https://agent-data-tools.revmesh2074.workers.dev/mcp

Details and limits

Audit up to 10 ecosystem:name items, optionally pinned to exact versions; scoped npm names are supported. npm downloads are not queried, unversioned deps.dev detail is capped at one advisory per package, pinned deps.dev detail is skipped, and OSV detail is capped at 15 per request. Batch advisory IDs/counts remain available; omitted details and EPSS coverage are reported. Exact versions add OSV ranges and dated FIRST EPSS estimates for CVE aliases (up to 50 CVEs). EPSS is not a safety guarantee; missing scores are unknown, not zero. Verdicts are bounded signals. Example timestamps are illustrative; bad input is not charged.