x402 Package Advisories

dev.workers.microtools-x402.x402-package-advisoriesPublished by x402-package-advisories.microtools-x402.workers.devOfficial publisherv0.1.0Updated Nov 3, 2026

Package vuln advisories from OSV.dev: CVEs, severity, fixes, manifest audit. Pay per call via x402.

VerifiedStreamable HTTPWeb executable

Overview

x402 Package Advisories's hosted MCP server (x402-package-advisories.microtools-x402.workers.dev), published by x402-package-advisories.microtools-x402.workers.dev; no sign-in required; Streamable HTTP; 5 tools.

No AI overview yet: these facts come from the registry entry and the server itself.

Publisher
x402-package-advisories.microtools-x402.workers.dev
Endpoint
x402-package-advisories.microtools-x402.workers.dev
Last checked

Installation

In SourceWeft

  1. Open x402 Package Advisories in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.microtools-x402.x402-package-advisories%2Fpackage-advisories/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "x402-package-advisories": {
      "type": "http",
      "url": "https://x402-package-advisories.microtools-x402.workers.dev/mcp"
    }
  }
}

Tools

5

package_advisories

Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, counts by severity, recommended upgrade version re-checked against OSV, latest stable version and whether it is affected) plus every advisory: OSV/GHSA id, CVE aliases, summary, severity label, CVSS v3 score (computed from the vector) and v4 vector, affected ranges, fixed versions, the fix for this version, published/modified dates and references. Duplicate records (GHSA vs PYSEC/GO ids with the same CVE) are merged. Also returns the version's licenses, publish date, deprecation and dependency counts from deps.dev. Omit version to check the latest stable release. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown packages/versions, bad input and upstream errors are not charged. Costs $0.003 USDC per call via x402.

Parametersnamerequiredversionecosystemrequiredinclude_withdrawn

manifest_audit

Audit up to 50 dependencies in one call (OSV.dev querybatch). Input: items [{ecosystem,name,version}], or packages "npm:[email protected],PyPI:[email protected]", or a manifest: package.json text (dependencies, devDependencies, optionalDependencies; range minimum used) or requirements.txt text (name==version lines). You can also POST the raw package.json or requirements.txt as the body. Returns per-package vulnerable flag, vuln count, max severity, max CVSS v3, recommended upgrade and advisory list (id, CVE, severity, score, summary, fix), plus totals by severity, unique vulns and skipped entries. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Bad input and upstream errors are not charged. Costs $0.01 USDC per call via x402.

Parametersitemsmanifestpackages

vuln_details

Full OSV record for one vulnerability id (GHSA-..., CVE-..., PYSEC-..., GO-..., RUSTSEC-..., OSV-...): details, aliases, related ids, every affected package with ranges and versions, references, credits, database_specific fields, plus a normalized severity label and computed CVSS v3 score. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown ids and upstream errors are not charged. Costs $0.001 USDC per call via x402.

Parametersidrequired

ping

Paid connectivity test: returns ok and a server timestamp. Use it to check that your x402 payment flow works end to end. Costs $0.001 USDC per call via x402.

Takes no parameters.

health

Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.

Takes no parameters.

Version history

1
  1. v0.1.0LatestNov 3, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.