it.elsas/security-intel

Check your installed packages against recent security advisories. Pay-per-value: $0 when nothing affects your versions (status all_clear/verify is always free), otherwise priced per confirmed match via x402 — you only pay when you learn you are actually exposed. Zero-friction input: paste your dependency file straight into `lockfile` — no need to hand-extract package/version. Auto-detected formats: package-lock.json, yarn.lock, requirements.txt (== pins), poetry.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, and CycloneDX / SPDX JSON SBOMs. Or pass an explicit `components` list of {package, version, ecosystem?} (you may pass both — they are merged). Built for agents that poll on their own clock: pass `since` (a cursor) to match ONLY advisories first published after your last check, so a repeated poll is free until something NEW hits you — and you pay at most once per new exposure. The returned `cursor` is interchangeable with get_since's cursor; store it and pass it back next time. Use `min_severity` to ignore (and not pay for) matches below your threshold. Returns advisories that affect (or may affect) your versions, each with the primary-source URL so you can verify independently. Trust-safe: when a version range cannot be parsed, or an advisory is product-level (no version data), it is reported as "verify" rather than silently cleared. Pair with the signed report for an auditable trail.

Normalized, SIGNED verdict for a single CVE: CVSS (v3.1/v4.0, authoritative from NVD with OSV fallback), CISA-KEV exploitation status, and EPSS probability. PAID ($0.01 USDC via x402). Deterministic JSON; the response carries an Ed25519 SSHSIG signature (`_signature`) you can verify offline — unlike unsigned CVE APIs.

SIGNED vulnerability verdict for one package version (OSV.dev) with a CISA-KEV flag per matching advisory. PAID ($0.002 USDC via x402). Deterministic JSON + Ed25519 signature.

Full bodies for items you discovered via `get_since` (PAID — pay-per-value, priced per delivered item via x402; $0 if none of the ids are found). `get_since` gives you a free index (id, title, severity, …) so you can decide what matters to you; `get_items` returns the actionable payload — affected ranges, primary sources, assessment and remediation — only for the ids you ask for. Each item carries the `report_id` of the signed report it was first published in: fetch that report via `get_sample_report(run_id=report_id)` to verify the Ed25519 signature yourself.

FREE preview — yesterday's full report, identical in format and signing to the paid `get_today`. Call this first to see exactly what you get before paying: real curated security items, severities, recommendations, and an Ed25519 signature you can verify (https://elsas.it/docs#verify). The only difference from get_today is freshness (this is the previous day's report).

Delta feed for agents that poll on their own clock: what's new since you last checked. Free. Pass the `cursor` from your previous call (omit on first call); poll as often as you like. Returns a lightweight index of new items — id, title, item_type, CVE id, severity, the signed report_id each was published in, and published_at — plus a new `cursor` and `count`. count == 0 means nothing new since you last looked. To get the full bodies (affected ranges, sources, assessment, remediation) for what's new, call the paid get_today (or check_affected to test your own deps). Optional `stack` filters by relevant_for tags (same as get_today). Returns: {cursor, count, index}.

Today's full curated security report for the MCP / AI-agent ecosystem (PAID — $0.10 USDC, charged automatically via x402 on Base; no account needed). Returns the latest signed, independently cross-validated digest of security incidents, advisories (CVE/GHSA/OSV/KEV) and notable changes affecting MCP servers, agents and their dependencies — each item with severity, why it matters, and a recommended action. Every report is Ed25519-signed; verify it yourself (see https://elsas.it/docs#verify). Try it free first with `get_sample_report` (yesterday's report, identical format).

Fast boolean: is this CVE known-exploited? SIGNED. `exploited` is driven by CISA-KEV (authoritative evidence of in-the-wild exploitation). EPSS (predictive probability) is included as a secondary signal but does NOT set the boolean — we report observed exploitation, not a forecast. PAID ($0.001 USDC via x402). Args: cve — e.g. "CVE-2024-3094". Returns: signed {exploited, kev, epss, basis, _signature}.

List available validated reports. Cheap to call, returns no full bodies. Only shows reports that passed validation (signed, TL;DR, no AUTO-CORRECTED). The current (newest) report is excluded — it's the paid product.

Bulk OSV scan of a whole lockfile/SBOM — every dependency checked against OSV.dev, KEV-flagged. SIGNED. PAID pay-per-value: billed per vulnerability HIT (dynamic x402, $0 when the whole tree is clean, capped at $0.10). Unlike `check_affected` (matches your deps against elsas's curated CURRENT advisory set), this runs a FULL OSV scan of the entire dependency graph.

SIGNED keyword search over the NVD CVE corpus, each result enriched with a CISA-KEV flag. PAID ($0.01 USDC via x402). Deterministic JSON + Ed25519 signature.