Package risk

Eight ecosystems: npm, PyPI, Go, crates.io, RubyGems, Maven, Packagist, NuGet.

`vulnetix_package_search`

The pre-install gate. Everything you would want before adding a dependency.

Argument	Type	Default
`query`	string, required	none
`ecosystem`	enum	all
`includeVersions`	boolean	`false`
`limit`	1–100	20

Per package:

Field	Contents
`vulnerabilityCount`, `maxSeverity`	Advisory count and worst severity
`exploitationSignals`	CrowdSec sightings, exploit count, CISA and VulnCheck KEV membership
`safeHarbour.recommendedVersions`	The versions to pick
`eolStatus`	End-of-life state
`scorecardScore`	OpenSSF Scorecard
`repositoryUrl`, `vendor`, `ecosystems`	Provenance

Before I add express, what is its risk profile and is there a safe version?

Note A common name matches thousands. express returns 3,328 across ecosystems, and the API pages 101 at a time. The shaped view caps at 20 by default and tells you what it dropped. Pass ecosystem to narrow before raising limit.

`vulnetix_package_vulns`

Maps a package’s versions to the advisory ids affecting them.

Argument	Type	Default
`packageName`	string, required	none
`ecosystem`	enum	resolve by name
`limit`, `offset`	number	none

Returns cveIds, the distinct advisory set and the authoritative answer, plus a sampled per-version breakdown.

Note The per-version list is a sample, not the full cross product. The same advisory ids repeat across nearly every version, so returning all of them is almost entirely duplication: for express that is 305 versions carrying 40 distinct ids. cveIds is the list to work from; the version breakdown is there to show the shape.

Follow up with vulnetix_vuln on the ids that matter, because this endpoint carries no severity or KEV status.

`vulnetix_package_versions`

Every version the database knows about, with the sources that reported each.

Use it when picking an upgrade target, or to check whether a specific version is recognised at all.

An empty ecosystem on an entry means a CVE-affected version that does not map cleanly onto a registry release, which is common for OS packages and vendor builds.

`vulnetix_purl`

Resolve a Package URL to its risk profile: exploitation signals, safe-harbour recommendation, scorecard, EOL status and the advisories affecting that exact version.

pkg:npm/lodash@4.17.21
pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1

Use it when you already have a precise coordinate from an SBOM or a lockfile.

A worked gate

For each dependency this PR adds, call vulnetix_package_search with the right ecosystem. Refuse anything with a KEV-listed vulnerability and no fixed version. For anything else with vulnerabilityCount > 0, report safeHarbour.recommendedVersions and pin to it.

That is roughly what the vulnetix_dep_add_guard prompt does, with the policy thresholds already written. See Skill prompts.