x402 Package Advisories MCP Server

by workers-microtools-x402-x402-package-advisories Your server? Claim it

not responding

x402 Package Advisories is listed as active in the registry but did not answer our last check. It exposes 5 tools.

Package vuln advisories from OSV.dev: CVEs, severity, fixes, manifest audit. Pay per call via x402.

Uptime history 8 days of history · worst day 59%

8 days agonow

70.7%

Uptime 24h

65 of 92 checks

Tools

read from the server

976 ms

Response time

average over 24h

open, no key

Access

streamable-http

x402 Package Advisories does not always answer

Over the last week it answered 72.0% of our checks. We check every 15 minutes, so you hear about the next outage within the hour — not from your users.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 0 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add package-advisories --transport http https://x402-package-advisories.microtools-x402.workers.dev/mcp

Settings → Connectors → Add custom connector, then paste this address

https://x402-package-advisories.microtools-x402.workers.dev/mcp

~/.codex/config.toml

[mcp_servers.package-advisories]
url = "https://x402-package-advisories.microtools-x402.workers.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "package-advisories": {
      "url": "https://x402-package-advisories.microtools-x402.workers.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "package-advisories": {
      "type": "http",
      "url": "https://x402-package-advisories.microtools-x402.workers.dev/mcp"
    }
  }
}

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

health

health

Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.

manifest

manifest_audit

Audit up to 50 dependencies in one call (OSV.dev querybatch). Input: items [{ecosystem,name,version}], or packages "npm:[email protected],PyPI:[email protected]", or a manifest: package.json text (dependencies, devDependencies, optionalDependencies; range minimum used) or requirements.txt text (name==version lines). You can also POST the raw package.json or requirements.txt as the body. Returns per-package vulnerable flag, vuln count, max severity, max CVSS v3, recommended upgrade and advisory list (id, CVE, severity, score, summary, fix), plus totals by severity, unique vulns and skipped entries. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Bad input and upstream errors are not charged. Costs $0.01 USDC per call via x402.

package

package_advisories

Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, counts by severity, recommended upgrade version re-checked against OSV, latest stable version and whether it is affected) plus every advisory: OSV/GHSA id, CVE aliases, summary, severity label, CVSS v3 score (computed from the vector) and v4 vector, affected ranges, fixed versions, the fix for this version, published/modified dates and references. Duplicate records (GHSA vs PYSEC/GO ids with the same CVE) are merged. Also returns the version's licenses, publish date, deprecation and dependency counts from deps.dev. Omit version to check the latest stable release. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown packages/versions, bad input and upstream errors are not charged. Costs $0.003 USDC per call via x402.

ping

ping

Paid connectivity test: returns ok and a server timestamp. Use it to check that your x402 payment flow works end to end. Costs $0.001 USDC per call via x402.

vuln

vuln_details

Full OSV record for one vulnerability id (GHSA-..., CVE-..., PYSEC-..., GO-..., RUSTSEC-..., OSV-...): details, aliases, related ids, every affected package with ranges and versions, references, credits, database_specific fields, plus a normalized severity label and computed CVSS v3 score. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown ids and upstream errors are not charged. Costs $0.001 USDC per call via x402.

Endpoints

URL	Transport	State	Latency	Checked
https://x402-package-advisories.microtools-x402.workers.dev/mcp	streamable-http	answering	1487 ms	0 min ago

Alternatives to x402 Package Advisories

same job, measured the same way

Depcheck

by kaneky

Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.

1 tools answering

Dependency Vulnerability Tracker — package security advisories ($0.01/query)

by a2awire

Dependency vulns & malicious-package advisories. Be born in one call — free testnet funds.

21 tools answering

YRUZ x402 tools

by xzntexe

Pay-per-call x402 tools: package advisories, EU tenders, Wikidata facts, promo board, web, crypto

56 tools answering

Dependency Vulnerability Check (OSV)

by brunckel

Known vulnerabilities and fixed versions for npm, PyPI, Go, Maven packages from OSV.dev via Apify.

answering

Osv Advisory MCP Server

by cyanheads

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

413 installs/wk 5 tools answering

AI Agent Hub

by justuncase1210-del

Pay-per-call APIs for AI agents: queries, storage, ads. Billed in USDC via x402.

19 tools answering

FIRST EPSS CVE Exploit Score & OSV Vulnerability Audit

by ceadigital

Real-time FIRST.org EPSS 30-day CVE exploit probability scoring and OSV package security audit.

28 tools answering

Sovereign Engine

by invertedhoologan

15 paid AI agent primitives via x402 (USDC on Base). Pay-per-call MCP server.

answering

x402 Package Advisories — questions

Answers built from our own checks of this server.

What can x402 Package Advisories do?

It exposes 5 tools, read directly from the server on our last check. Among them: health, manifest_audit, package_advisories, ping, vuln_details. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is x402 Package Advisories working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 65 of 92 checks got a reply (70.7%), average response time 976 ms. The bar chart above shows every period we have measured.

The registry lists x402 Package Advisories as active — why does it not respond?

The official MCP registry stores what the author submitted; it does not verify that the server still runs. We check the endpoint ourselves, and this one does not answer. Catalogues that copy the registry without checking will show it as working.

How do I connect x402 Package Advisories?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does x402 Package Advisories need an API key?

No. x402 Package Advisories completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is x402 Package Advisories?

It answers our handshake in 976 ms on average, which is faster than 5% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.