Known Vulnerabilities Lookup

Find reported vulnerabilities for a package version in OSV. Returns vulnerability identifiers, available severity and affected or fixed versions.

Pay by wallet (x402) cve-lookup

Example

Example answer

{
  "version": "test_value",
  "ecosystem": "npm",
  "package_name": "test_value",
  "recommendation": "No known vulnerabilities for this version.",
  "vulnerabilities": [],
  "highest_severity": "none",
  "total_vulnerabilities": 0
}

Inputs

Field	Type	Required	What it is
`version`	string	Yes	—
`ecosystem`	string	No	npm/pypi/maven/go/cargo/nuget
`package_name`	string	Yes	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`recommendation`	string	Always (present in every successful answer)
`vulnerabilities`	array	Always (present in every successful answer)
`highest_severity`	string	Always (present in every successful answer)
`total_vulnerabilities`	integer	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "cve-lookup",
    "inputs": {
      "version": "4.17.20",
      "package_name": "lodash"
    },
    "max_price_cents": 5
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "cve-lookup",
    "inputs": {
      "version": "4.17.20",
      "package_name": "lodash"
    },
    "max_price_cents": 5
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "cve-lookup",
  inputs: {
    "version": "4.17.20",
    "package_name": "lodash"
  },
  max_price_cents: 5,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="cve-lookup",
    inputs={
        "version": "4.17.20",
        "package_name": "lodash",
    },
    max_price_cents=5,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/cve-lookup?version=4.17.20&package_name=lodash'

Limitations

New vulnerabilities and updated scores can lag
Uses OSV database — newly published CVEs may take hours to appear and severity scores may be updated after initial publication
What to do instead: For zero-day awareness, supplement with the NVD RSS feed and vendor security advisories