Paid services on Base matching “osv”

NPM package info API: package registry lookup for npm, PyPI and Cargo with latest version, age, license, deprecation, weekly downloads and OSV vulnerabilities. Dependency check before install.

Audit a whole dependency manifest in one call before installing or upgrading. Send a package.json, a requirements.txt, or npm and PyPI package lists (up to 50 packages). Per dependency: latest version and publish date, whether your pin is behind, license, deprecation or yanked status, weekly npm downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no

CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachab

Check an open-source package for known vulnerabilities via the OSV database (Google Open Source Vulnerabilities). Pass package name, ecosystem (npm, PyPI, Go, crates.io, Maven, RubyGems, etc.) and optional version. Returns vulnerability IDs, summaries, severity and fixed versions. Essential pre-install check for coding agents.

Package vulnerability check — check one exact open-source dependency version or purl against OSV, enrich CVE matches with CISA KEV known-exploited signals, and report fixes, severity, and provenance.

Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.

Pre-install scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill, MCP server or tool list, or inline content. Matches OSV and OpenSSF malicious-package advisories, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and MCP tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 of the input and an Ed25519-si

CISA Known Exploited Vulnerabilities catalog (keyless). POST {} or {cve_id?}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Disclose adjacency: hashlookup-circl / openssf-scorecard / osv-vuln-lookup / nvd-cve-lookup / crt-sh-ct-lookup (≠ those products).

OpenSSF Scorecard repo supply-chain health (keyless). POST {platform}/{org}/{repo} required. Empty -> 400 not charged. osv-vuln-query/nist-nvd-cve-lookup adjacency disclosed.

FIRST.org EPSS exploit-prediction (keyless). POST {cve|cves}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Soft disclose cisa-kev / osv-vuln-query / nist-nvd-cve-lookup / openssf-scorecard.

Google deps.dev / Open Source Insights package metadata (keyless). POST {system, name|package}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Disclose adjacency: packagist-package / nuget-package / osv-vuln-query / openssf-scorecard (≠ those products; deps.dev supply-chain lane).

Given a company website domain, returns a compact company card: the business name and the page element it came from, a generic role contact address (info@, sales@, support@ ...) only if the site publishes one, never a personal address, and the names of up to 10 technology platforms the site runs. Same scrape and evidence check as /scrape, without the evidence detail, at half the price. Free prompt

Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.

MCP security checks and feedback for users and developers. Choose paid access without reports, or ongoing free access within limits: POST /v1/client-token; 1 check/24h + 1 for a previous-use report. Check URL/DNS, metadata/schema/auth, OSV/CVE risk and catalog drift before connecting. Verified owners can read consented weekly reports. ALLOW/BLOCK/UNKNOWN uses caller-confirmed versions. No tool exe

OSV.dev vulnerability query (keyless). POST {package:{name,ecosystem},version?}/{commit?}. Empty -> 400 not charged. nist-nvd-cve-lookup adjacency. Native POST api.osv.dev/v1/query (GET 405).