{ "openapi": "3.1.1", "info": { "title": "Dependency Vulnerability Explorer API", "version": "1.0.0", "summary": "Known vulnerabilities in your dependencies, and the version that fixes each one.", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://dependencyvulnerabilityexplorer.usefulweb.site" } ], "paths": { "/api/v1/calculate": { "post": { "operationId": "calculate", "summary": "Known vulnerabilities in your dependencies, and the version that fixes each one.", "description": "Reads npm (package.json, package-lock.json), Python (requirements.txt), Go (go.mod), Rust (Cargo.lock) and PHP (composer.lock) manifests, or lines like npm:lodash@4.17.20, and checks every exact package version against OSV.dev, the open vulnerability database that aggregates GitHub Security Advisories, PyPA, RustSec, Go and more. For each finding: severity, aliases (CVE/GHSA), and the nearest fixed version. You can also look up a single advisory ID.\n\nMethodology:\n- Exact versions come from lockfiles and == pins; for version ranges (^1.2.0, >=2.0) the lower bound is checked and the package is marked exact=false.\n- Each package@version is sent to the OSV.dev querybatch API; details for up to 60 distinct advisories are fetched from /v1/vulns/{id}.\n- Severity is the advisory database rating (GHSA: LOW/MODERATE/HIGH/CRITICAL); the CVSS vector is shown when published. fixedIn = the lowest fixed release above your version for that package; upgradeTo = the highest of those across a package's advisories.\n- Advisories are matched by OSV's version ranges; withdrawn advisories are not returned by OSV.", "tags": [ "security" ], "x-mcp-tool": "dependency_vulnerability_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DependencyVulnerabilityExplorerInput" }, "examples": { "example1": { "summary": "Two outdated packages", "value": { "manifest": "npm:lodash@4.17.20\npypi:requests@2.19.0" } }, "example2": { "summary": "Look up an advisory", "value": { "vulnId": "GHSA-35jh-r3h4-6jhm" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DependencyVulnerabilityExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tool": { "get": { "operationId": "getToolDefinition", "summary": "Inputs, output schema and examples for this tool", "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "DependencyVulnerabilityExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "manifest": { "title": "Manifest, lockfile or package list", "type": "string", "maxLength": 5000000 }, "vulnId": { "title": "Or: look up one advisory ID", "type": "string", "maxLength": 60 } }, "required": [] }, "DependencyVulnerabilityExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "manifestKind", "packagesChecked", "skipped", "vulnerablePackages", "counts", "findings", "advisory" ], "properties": { "manifestKind": { "type": [ "string", "null" ] }, "packagesChecked": { "type": "integer" }, "skipped": { "type": "array", "items": { "type": "string" } }, "vulnerablePackages": { "type": "integer" }, "counts": { "type": "object", "additionalProperties": false, "required": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ], "properties": { "CRITICAL": { "type": "integer" }, "HIGH": { "type": "integer" }, "MODERATE": { "type": "integer" }, "LOW": { "type": "integer" }, "UNKNOWN": { "type": "integer" } } }, "findings": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "ecosystem", "name", "version", "exact", "upgradeTo", "vulnerabilities" ], "properties": { "ecosystem": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" }, "exact": { "type": "boolean" }, "upgradeTo": { "type": [ "string", "null" ] }, "vulnerabilities": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "aliases", "summary", "severity", "cvss", "published", "fixedIn", "url" ], "properties": { "id": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "summary": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvss": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ] }, "fixedIn": { "type": [ "string", "null" ] }, "url": { "type": "string" } } } } } } }, "advisory": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "id", "aliases", "summary", "severity", "cvss", "published", "fixedIn", "url", "affectedPackages" ], "properties": { "id": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "summary": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvss": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ] }, "fixedIn": { "type": [ "string", "null" ] }, "url": { "type": "string" }, "affectedPackages": { "type": "array", "items": { "type": "string" } } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }