x402 Package Advisories

dev.workers.microtools-x402.x402-package-advisories/package-advisoriesVersion 0.1.0

Package vuln advisories from OSV.dev: CVEs, severity, fixes, manifest audit. Pay per call via x402.

Status

Responds865 msNov 14, 2026, 14:28 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:28 UTC
Latency: 865 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://x402-package-advisories.microtools-x402.workers.dev/mcpResponds865 msNov 14, 2026, 14:28 UTC

No sign-in

Claude Code

claude mcp add --transport http package-advisories https://x402-package-advisories.microtools-x402.workers.dev/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: package-advisories
Remote MCP server URL: https://x402-package-advisories.microtools-x402.workers.dev/mcp

Cursor

{
  "mcpServers": {
    "package-advisories": {
      "url": "https://x402-package-advisories.microtools-x402.workers.dev/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"package-advisories","type":"http","url":"https://x402-package-advisories.microtools-x402.workers.dev/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

5 tools

Tools of x402 Package Advisories
	Description		Read-only	Idempotent	Open world
`health`Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.	Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.	Not declared	Not declared	Not declared	Not declared
`manifest_audit`Audit up to 50 dependencies in one call (OSV.dev querybatch). Input: items [{ecosystem,name,version}], or packages "npm:lodash@4.17.15,PyPI:django@3.2.0", or a manifest: package.json text (dependencies, devDependencies, optionalDependencies; range minimum used) or requirements.txt text (name==version lines). You can also POST the raw package.json or requirements.txt as the body. Returns per-package vulnerable flag, vuln count, max severity, max CVSS v3, recommended upgrade and advisory list (id, CVE, severity, score, summary, fix), plus totals by severity, unique vulns and skipped entries. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Bad input and upstream errors are not charged. Costs $0.01 USDC per call via x402.	Audit up to 50 dependencies in one call (OSV.dev querybatch). Input: items [{ecosystem,name,version}], or packages "npm:lodash@4.17.15,PyPI:django@3.2.0", or a manifest: package.json text (dependencies, devDependencies, optionalDependencies; range minimum used) or requirements.txt text (name==version lines). You can also POST the raw package.json or requirements.txt as the body. Returns per-package vulnerable flag, vuln count, max severity, max CVSS v3, recommended upgrade and advisory list (id, CVE, severity, score, summary, fix), plus totals by severity, unique vulns and skipped entries. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Bad input and upstream errors are not charged. Costs $0.01 USDC per call via x402.	Not declared	Not declared	Not declared	Not declared
`package_advisories`Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, counts by severity, recommended upgrade version re-checked against OSV, latest stable version and whether it is affected) plus every advisory: OSV/GHSA id, CVE aliases, summary, severity label, CVSS v3 score (computed from the vector) and v4 vector, affected ranges, fixed versions, the fix for this version, published/modified dates and references. Duplicate records (GHSA vs PYSEC/GO ids with the same CVE) are merged. Also returns the version's licenses, publish date, deprecation and dependency counts from deps.dev. Omit version to check the latest stable release. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown packages/versions, bad input and upstream errors are not charged. Costs $0.003 USDC per call via x402.	Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, counts by severity, recommended upgrade version re-checked against OSV, latest stable version and whether it is affected) plus every advisory: OSV/GHSA id, CVE aliases, summary, severity label, CVSS v3 score (computed from the vector) and v4 vector, affected ranges, fixed versions, the fix for this version, published/modified dates and references. Duplicate records (GHSA vs PYSEC/GO ids with the same CVE) are merged. Also returns the version's licenses, publish date, deprecation and dependency counts from deps.dev. Omit version to check the latest stable release. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown packages/versions, bad input and upstream errors are not charged. Costs $0.003 USDC per call via x402.	Not declared	Not declared	Not declared	Not declared
`ping`Paid connectivity test: returns ok and a server timestamp. Use it to check that your x402 payment flow works end to end. Costs $0.001 USDC per call via x402.	Paid connectivity test: returns ok and a server timestamp. Use it to check that your x402 payment flow works end to end. Costs $0.001 USDC per call via x402.	Not declared	Not declared	Not declared	Not declared
`vuln_details`Full OSV record for one vulnerability id (GHSA-..., CVE-..., PYSEC-..., GO-..., RUSTSEC-..., OSV-...): details, aliases, related ids, every affected package with ranges and versions, references, credits, database_specific fields, plus a normalized severity label and computed CVSS v3 score. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown ids and upstream errors are not charged. Costs $0.001 USDC per call via x402.	Full OSV record for one vulnerability id (GHSA-..., CVE-..., PYSEC-..., GO-..., RUSTSEC-..., OSV-...): details, aliases, related ids, every affected package with ranges and versions, references, credits, database_specific fields, plus a normalized severity label and computed CVSS v3 score. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown ids and upstream errors are not charged. Costs $0.001 USDC per call via x402.	Not declared	Not declared	Not declared	Not declared

Details

Registry status: Active
Published: Nov 3, 2026
Updated: Nov 3, 2026
Website: https://x402-package-advisories.microtools-x402.workers.dev/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing