Get package
get_packageGet one package's vulnerability history on cve.now: every advisory naming it (newest first, each with severity, CVSS, KEV, its affected ranges, fix status from the registry's releases and, on npm and crates.io, the share of downloads that were affected versions), whether the latest release is affected, the newest stable release no advisory affects (the version to upgrade to; it doesn't count unplaced advisories and is null when truncated), affected version spans per advisory, and unplaced: advisories whose ranges can't be compared with versions (when only those could affect a release, its affected is null, meaning unknown), and truncated: more than 500 advisories name it, so only the newest are listed and no release is called clean, and weekly downloads and dependents. Pass version to ask whether that version is affected and by which advisories. The page is https://cve.now/packages//. For many packages or a lockfile at once, use check_stack.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"ecosystem": "<ecosystem>",
"name": "<name>"
},
"name": "get_package"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The package name as its registry spells it, e.g. axios, @babel/core, django, org.apache.logging.log4j:log4j-core, github.com/gin-gonic/gin | |
| version | No | A version to check, e.g. 1.7.4 | |
| ecosystem | Yes | The package's ecosystem |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | The package's page on cve.now | |
| name | No | The package name | |
| spans | No | Affected version spans per advisory id, lowest first | |
| latest | No | The latest release, whether it is affected (null when only unplaced advisories could affect it) and by which advisories | |
| version | No | With version: whether it is affected (null when only advisories it can't be compared with could affect it) and by which advisories | |
| unplaced | No | Advisories whose ranges can't be compared with versions, so verdicts leave them out | |
| ecosystem | No | The package's ecosystem | |
| truncated | No | More advisories name the package than cve.now checks (the newest 500 are listed); then no release is called clean | |
| advisories | No | Every advisory naming the package, newest first, with severity, its affected ranges, fixStatus, downloadExposure and whether it affects the latest release (and the version asked for) | |
| dependents | No | Packages depending on it per deps.dev, when cve.now has read them | |
| weeklyDownloads | No | Downloads in the last week, when cve.now has read them | |
| newestUnaffected | No | The highest stable release no advisory affects, not counting unplaced advisories |