npm and PyPI dependency vulnerability audit API
Check up to 10 public dependencies, optionally pinned to exact versions, for advisory IDs, OSV affected/fixed ranges and dated FIRST EPSS CVE estimates. Scoped npm names supported. Detail and subrequest caps apply; omitted details and incomplete coverage are explicit. Missing evidence is unknown, not zero risk. Automated signals, not a safety guarantee. See the buying guide for limits. Use before installing or upgrading dependencies.
When to use it
- Check up to 10 dependencies for known advisories at their exact versions
- Get the fixed version for each advisory
- Let a coding agent vet packages before installing them
Inputs
| Name | Type | Description |
|---|---|---|
packages (required) | string | Comma-separated ecosystem:name items, optionally name@exact-version; max 10. For scoped npm, use npm:@scope/name@version. |
Request
Over HTTP, with a card key from /credits:
curl -H "Authorization: Bearer adt_…" "https://tools.funwords.eu/package-audit?packages=npm%3Alodash%404.17.20%2Cpypi%3Arequests%402.31.0%2Cnpm%3A%40types%2Fnode%4022.0.0"Or one of your 25 free calls, no key:
curl "https://tools.funwords.eu/package-audit?packages=npm%3Alodash%404.17.20%2Cpypi%3Arequests%402.31.0%2Cnpm%3A%40types%2Fnode%4022.0.0&trial=1"Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum or Solana over x402; Base or Tempo over MPP) and retries.
Example result
{
"checked": 1,
"notFound": 0,
"lookupFailed": 0,
"versionNotFound": 0,
"versionAdvisoryLookupIncomplete": 0,
"epssLookup": {
"source": "FIRST EPSS",
"status": "complete",
"sourceStatus": "available",
"retrievedAt": "2026-10-14T12:00:00.000Z",
"requestedCves": 1,
"queriedCves": 1,
"returnedScores": 1,
"omittedCves": 0,
"uninspectedAdvisoryDetails": 0,
"malformedRows": 0,
"note": "FIRST EPSS estimates 30-day exploitation probability, not package safety."
},
"summary": "All 1 package(s) exist. Review each verdict and flags before installing.",
"results": [
{
"ecosystem": "npm",
"name": "minimist",
"exists": true,
"version": "1.2.5",
"versionExists": true,
"verdict": "caution",
"flags": [
"known-vulnerabilities"
],
"weeklyDownloads": null,
"weeklyDownloadsStatus": "not-fetched-subrequest-budget",
"knownVulnerabilities": 1,
"advisoryIds": [
"GHSA-xvch-5gv4-984h"
],
"knownVulnerabilityCountSources": [
"deps.dev",
"OSV"
],
"advisoryDetailsStatus": "not-fetched-subrequest-budget",
"advisoryDetailsOmitted": 1,
"advisoryDetailsUnavailable": 0,
"advisories": [],
"source": "deps.dev",
"retrievedAt": "2026-10-14T12:00:00.000Z",
"versionAdvisories": {
"source": "OSV",
"status": "complete",
"retrievedAt": "2026-10-14T12:00:00.000Z",
"advisoryCount": 1,
"vulnerabilities": [
{
"id": "GHSA-xvch-5gv4-984h",
"source": "OSV",
"sourceUrl": "https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h",
"retrievedAt": "2026-10-14T12:00:00.000Z",
"detailStatus": "available",
"modified": "2026-03-13T22:11:59.523514Z",
"published": "2022-03-18T00:01:09Z",
"aliases": [
"CVE-2021-44906"
],
"summary": "Prototype Pollution in minimist",
"rangeStatus": "reported",
"fixedVersionRanges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.2.6"
}
],
"fixedVersions": [
"1.2.6"
]
},
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.4"
}
],
"fixedVersions": [
"0.2.4"
]
}
],
"epss": {
"source": "FIRST EPSS",
"status": "complete",
"sourceStatus": "available",
"retrievedAt": "2026-10-14T12:00:00.000Z",
"scores": [
{
"cve": "CVE-2021-44906",
"status": "available",
"score": 0.04581,
"percentile": 0.91484,
"date": "2026-10-14"
}
],
"note": "EPSS estimates 30-day exploitation probability for CVE aliases; it is not a package-safety guarantee. Null scores are unknown, not zero."
}
}
],
"note": "OSV advisories are matched to this exact package version."
}
}
],
"source": "deps.dev"
}From an AI agent (MCP)
Add the MCP server to Claude, Cursor or any MCP client. This tool is package_audit, and the first 25 successful calls are free:
https://tools.funwords.eu/mcpDetails and limits
Audit up to 10 ecosystem:name items, optionally pinned to exact versions; scoped npm names are supported. npm downloads are not queried, unversioned deps.dev detail is capped at one advisory per package, pinned deps.dev detail is skipped, and OSV detail is capped at 15 per request. Batch advisory IDs/counts remain available; omitted details and EPSS coverage are reported. Exact versions add OSV ranges and dated FIRST EPSS estimates for CVE aliases (up to 50 CVEs). EPSS is not a safety guarantee; missing scores are unknown, not zero. Verdicts are bounded signals. Example timestamps are illustrative; bad input is not charged.
Questions
Which ecosystems?
npm and PyPI packages with exact versions.
How do I pay?
Each successful call costs $0.01; failed calls are not charged. The first 25 calls are free. Then pay with card credits (from $1; the key goes in an Authorization header or, for clients that can only fetch a URL, as api_key= in the URL) or per call in USDC over x402 or MPP. No account is needed.