{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T18:26:07.779Z","url":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories","markdownUrl":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories.md","server":{"slug":"dev-workers-microtools-x402-x402-package-advisories-package-advisories","name":"x402 Package Advisories","registryName":"dev.workers.microtools-x402.x402-package-advisories/package-advisories","description":"Package vuln advisories from OSV.dev: CVEs, severity, fixes, manifest audit. Pay per call via x402.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"x402-package-advisories","type":"remote","identifier":"https://x402-package-advisories.microtools-x402.workers.dev/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories","version":"0.1.0","transport":null,"scoredAt":"2026-11-05T06:26:21.526Z"},"score":{"total":60,"tier":"medium","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":60},{"date":"2026-11-04","total":59},{"date":"2026-11-03","total":59}]},"categories":[{"name":"Endpoint Security","score":46,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.","HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement.","HSTS check failed: the Strict-Transport-Security header is absent.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.none_undeclared","args":{"undeclared_tools":"5"}},{"code":"https.inconclusive","args":{"reason":"plaintext_status","status":"406"}},{"code":"headers.hsts_absent","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":70,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 862 tokens (~172/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"172","items":"5","tools":"5","tokens":"862","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":7,"verdict":"partial","reasons":["Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"2"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"5"}},{"code":"toolsafety.manipulation_clean","args":{"units":"5","judged":"5"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.","HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement."],"malware":[],"components":[{"slug":"x402-package-advisories","type":"remote","identifier":"https://x402-package-advisories.microtools-x402.workers.dev/mcp","withdrawn":false,"score":60,"current":true,"url":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories","markdownUrl":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories.md"}],"facts":[{"label":"Endpoint","value":"https://x402-package-advisories.microtools-x402.workers.dev/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"none"},{"label":"Version","value":"0.1.0"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"package_advisories","title":null,"description":"Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, counts by severity, recommended upgrade version re-checked against OSV, latest stable version and whether it is affected) plus every advisory: OSV/GHSA id, CVE aliases, summary, severity label, CVSS v3 score (computed from the vector) and v4 vector, affected ranges, fixed versions, the fix for this version, published/modified dates and references. Duplicate records (GHSA vs PYSEC/GO ids with the same CVE) are merged. Also returns the version's licenses, publish date, deprecation and dependency counts from deps.dev. Omit version to check the latest stable release. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown packages/versions, bad input and upstream errors are not charged. Costs $0.003 USDC per call via x402.","inputs":[{"name":"ecosystem","type":"string","required":true,"description":"Package ecosystem: npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex, CRAN, Hackage, SwiftURL, ConanCenter (aliases like pip, cargo, gem, composer accepted)"},{"name":"include_withdrawn","type":"boolean","required":false,"description":"Include withdrawn advisories (default false)"},{"name":"name","type":"string","required":true,"description":"Package name, e.g. lodash, django, golang.org/x/net, org.apache.logging.log4j:log4j-core"},{"name":"version","type":"string","required":false,"description":"Exact version, e.g. 4.17.15 (default: latest stable)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":380},{"name":"manifest_audit","title":null,"description":"Audit up to 50 dependencies in one call (OSV.dev querybatch). Input: items [{ecosystem,name,version}], or packages \"npm:lodash@4.17.15,PyPI:django@3.2.0\", or a manifest: package.json text (dependencies, devDependencies, optionalDependencies; range minimum used) or requirements.txt text (name==version lines). You can also POST the raw package.json or requirements.txt as the body. Returns per-package vulnerable flag, vuln count, max severity, max CVSS v3, recommended upgrade and advisory list (id, CVE, severity, score, summary, fix), plus totals by severity, unique vulns and skipped entries. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Bad input and upstream errors are not charged. Costs $0.01 USDC per call via x402.","inputs":[{"name":"items","type":"array","required":false,"description":"Array of {ecosystem, name, version} (max 50)"},{"name":"manifest","type":"string","required":false,"description":"package.json or requirements.txt text"},{"name":"packages","type":"string","required":false,"description":"Comma list Ecosystem:name@version, e.g. npm:lodash@4.17.15,PyPI:django@3.2.0"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":270},{"name":"vuln_details","title":null,"description":"Full OSV record for one vulnerability id (GHSA-..., CVE-..., PYSEC-..., GO-..., RUSTSEC-..., OSV-...): details, aliases, related ids, every affected package with ranges and versions, references, credits, database_specific fields, plus a normalized severity label and computed CVSS v3 score. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown ids and upstream errors are not charged. Costs $0.001 USDC per call via x402.","inputs":[{"name":"id","type":"string","required":true,"description":"OSV id or CVE alias"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":136},{"name":"ping","title":null,"description":"Paid connectivity test: returns ok and a server timestamp. Use it to check that your x402 payment flow works end to end. Costs $0.001 USDC per call via x402.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":46},{"name":"health","title":null,"description":"Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":30}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T06:26:21.000Z","track":"remote","endpoint":"https://x402-package-advisories.microtools-x402.workers.dev/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=microtools-x402.workers.dev","issuer":"CN=YE2,O=Let's Encrypt,C=US","notBefore":"2026-10-17T03:23:04Z","notAfter":"2027-01-15T03:23:03Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=YE2,O=Let's Encrypt,C=US","issuer":"CN=Root YE,O=ISRG,C=US","notBefore":"2025-09-03T00:00:00Z","notAfter":"2028-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true},{"subject":"CN=Root YE,O=ISRG,C=US","issuer":"CN=ISRG Root X2,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true},{"subject":"CN=ISRG Root X2,O=Internet Security Research Group,C=US","issuer":"CN=ISRG Root X1,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"x402-package-advisories.microtools-x402.workers.dev.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"dev.","outcome":"verified","label":"Verified"},{"zone":"workers.dev.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"none","label":"No authorisation required","gate":null,"gateLabel":null,"status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"inconclusive","label":"Inconclusive","status":406},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-11-03","recent":[{"id":"chg_01a1aa63-10e4-7e56-bee9-ee60beb7f388","kind":"score.total_changed","summary":"Trust score (59 → 60)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories#chg-chg_01a1aa63-10e4-7e56-bee9-ee60beb7f388"},{"id":"chg_01a1a538-ac28-7c30-a4e9-2351ed21d6f5","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories#chg-chg_01a1a538-ac28-7c30-a4e9-2351ed21d6f5"},{"id":"chg_01a1a0b8-e540-7d17-8b76-aaff82c04175","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories#chg-chg_01a1a0b8-e540-7d17-8b76-aaff82c04175"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories/changelog.json"},"links":{"html":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories","markdown":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories.md","changelogJson":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories/changelog.json","changelogRss":"https://verifymcp.io/servers/dev-workers-microtools-x402-x402-package-advisories-package-advisories/x402-package-advisories.xml","external":[{"label":"Remote endpoint","href":"https://x402-package-advisories.microtools-x402.workers.dev/mcp"},{"label":"Website","href":"https://x402-package-advisories.microtools-x402.workers.dev/"}]}}