All projects matching “vulnerability”

Package vulnerability check — check one exact open-source dependency version or purl against OSV, enrich CVE matches with CISA KEV known-exploited signals, and report fixes, severity, and provenance.

Secret scan for exposed API keys, tokens, passwords, and credentials in text — returns redacted output without exposing matched secret values. Ideal for agent pre-flight checks before sharing config or logs.

New vulnerabilities in one place: CISA Known Exploited Vulnerabilities from the last 14 days (due dates, ransomware use), CVEs published in the last 24 hours (CVSS, severity, CWE, vendor/product), and reviewed GitHub advisories (ecosystem, package, vulnerable and patched versions). Rebuilt every hour. $0.01 per call, no account. Free 24h-delayed sample: GET https://ioswarm.io/api/v1/feeds/security

Check an open-source package for known vulnerabilities via the OSV database (Google Open Source Vulnerabilities). Pass package name, ecosystem (npm, PyPI, Go, crates.io, Maven, RubyGems, etc.) and optional version. Returns vulnerability IDs, summaries, severity and fixed versions. Essential pre-install check for coding agents.

Security advisories: Known exploited vulnerabilities (CISA KEV) enriched with daily FIRST EPSS exploit probability. Use when a user asks whether a CVE is actively exploited, which vulnerabilities in a vendor or product to patch first, whether it is used in ransomware campaigns, or needs CISA KEV due dates, required actions and FIRST EPSS exploit probability in one call.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (https://cve-intel.agentdiet.dev/v1/cve-intel)

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

NPM package info API: package registry lookup for npm, PyPI and Cargo with latest version, age, license, deprecation, weekly downloads and OSV vulnerabilities. Dependency check before install.

npm package safety gate: vulnerabilities, malware advisories, typosquatting, install-script risk.

Audit a whole dependency manifest in one call before installing or upgrading. Send a package.json, a requirements.txt, or npm and PyPI package lists (up to 50 packages). Per dependency: latest version and publish date, whether your pin is behind, license, deprecation or yanked status, weekly npm downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no

3ilm vulnerability pattern search — 1032 exact-reconciled findings from 10 Sherlock contests

Check an exact npm or PyPI package version immediately before installation using current registry, vulnerability, malicious-package, withdrawal/deprecation, and verified provenance evidence. Returns ALLOW, REVIEW, BLOCK, or UNKNOWN with machine-readable reasons.

Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.

Password - CASA Cybersecurity Assessment - Consolidates evidence on secure communications, including certificate validity, hostname matching, protocol and cipher strength, forward secrecy, and TLS vulnerabilities. It determines whether the service uses a secure, authentic, and correctly configured transport channel.

Call before installing or updating an npm or PyPI dependency. Returns a verdict (ok, caution, avoid, unknown) plus evidence signals: install script added, maintainer or publisher change, very recent publish, build provenance dropped, known malware and vulnerability advisories. A clean result is not a guarantee of safety.

Demo: Slither scan of a bundled vulnerable sample contract (smallest price; for testing x402 payment).

ScriptDocs paid MCP tool call (docs_check_vulnerabilities, docs_get_readme): $0.009 USDC per call via x402 v2 exact on Base.

Autonomous smart contract security auditor — 20+ vulnerability classes, PoC exploits

CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachab