Package Vulnerability Lookup | Strale

The final charge is based on confirmed usage. Unused reserved credits return to your available balance.

Strale

Look up vulnerabilities by package and version

Provide a software package name and version to look up known vulnerabilities. You can also specify the package ecosystem, such as npm or PyPI.

You receive

Get vulnerability information for the package version you supply. Your Agent can turn the returned findings into a review list, keeping any CVE identifiers, severity assessments and fixed-version information together. Use the details actually supplied to decide which advisories or upgrade options to examine next.

Start with your task

Check whether the software [Lodash], version [4.17.21], has any known security issues. If the name or version is missing, ask me in simple words before checking. Summarize only what the lookup returns; mention a version to update to only if the result provides one.

What to know

The available details depend on the lookup response. Missing severity or fixed-version information should stay unspecified. An absence of returned findings does not prove that the package is safe, and a listed fix does not confirm that your installation has been patched.

Inputs & outputs

Inspect the current inputs, availability, and maximum charge before starting.

Input schema

Input schema
Field / Path	Type	Requirement	Meaning
queryParams`queryParams`	`object`	Required	Required fields `package_name, version`
Package version`queryParams.version`	`string`	Required	The version of that package to check, supplied as text. Provide the actual version you want to look up rather than assuming the latest. No version format or default is defined.
Package ecosystem`queryParams.ecosystem`	`string`	Optional	Optional text identifying the package ecosystem. The description lists npm, pypi, maven, go, cargo and nuget. It is not an enum restriction, and no default is defined when this field is omitted.
Package name`queryParams.package_name`	`string`	Required	The name of the software package to check, supplied as text together with its version. Use the package name from its ecosystem. The input definition does not prescribe a naming format.

View raw JSON

{
  "type": "object",
  "required": [
    "queryParams"
  ],
  "properties": {
    "queryParams": {
      "type": "object",
      "required": [
        "package_name",
        "version"
      ],
      "properties": {
        "version": {
          "type": "string"
        },
        "ecosystem": {
          "type": "string",
          "description": "Package ecosystem: npm, pypi, maven, go, cargo or nuget."
        },
        "package_name": {
          "type": "string"
        }
      }
    }
  },
  "additionalProperties": false
}

Result schema

Output fields have not been documented yet.

Additional notes

Request details

The input definition for this Tool requires a package name and version as text. The optional ecosystem description lists npm, pypi, maven, go, cargo and nuget; it does not define an enum or a default. No package-name or version format is specified. A CVE identifier does not replace the required package and version. Replace the bracketed placeholders in the example with your own package details before asking your Agent to call it.

Find the software name and version
Use the software name and version number you want to check. For example, [Lodash] and [4.17.21]. If you are not sure where to find them, ask the assistant to explain before checking.
Get connected
Ask the assistant to check
Paste the name and version in the task box above. For example, [Lodash] version [4.17.21]. If a detail is unclear, ask the assistant before continuing.
Check whether the software [Lodash], version [4.17.21], has any known security issues. If the name or version is missing, ask me in simple words before checking. Summarize only what the lookup returns; mention a version to update to only if the result provides one.
Review the result
Review any security issues and update version the lookup actually returns. No issues returned does not prove the software is safe, and a suggested version does not mean it has already been installed.