ADX / For agent builders
Get vulnerability advisories and world and regional news reports through REST or MCP, with source attribution and dates your agent can check.
Free through September 30, 2026, Eastern time. Ends 2026-10-01T04:00:00Z. No card, wallet, or automatic paid conversion.
Dependency security: reviewed advisory evidence for up to five exact npm, PyPI, or NuGet package/version inputs per request.
World and regional news: reports and events with source citations and publication dates, ready for your agent's briefings and research.
100 successful responses or 10,000,000 logical JSON data bytes per UTC day, whichever is exhausted first. Security and news requests share the account allowance across REST and MCP.
Query stored global, country or regional reports and events through REST, or use the MCP tools regional_news_query and regional_news_coverage. The authenticated news reader uses your activated trial account.
Build briefings and research workflows around news reports with linked sources and report dates. Query world, country or regional editions through the same REST and MCP interfaces your agent uses for dependency security. The example client and sample below demonstrate dependency-security queries.
A deterministic local demonstration. No request, model inference, account creation, or payment occurs here.
{"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}],"limit":5,"offset":0}Read match, sourceUrl, retrievedAt, and snapshotHash. Distinguish an upstream source from ADX normalization.
An unknown needs version review. A missing match is not a safety guarantee. Follow hasMoreCandidates within the bounded query contract.
Sample response explorer
{
"status": 200,
"code": "ok",
"data": {
"generatedAt": "2026-09-21T00:00:00Z",
"schemaVersion": "demo-security-v1",
"serviceLevel": "best-effort",
"coverageNotice": "Synthetic demonstration only. No live lookup occurred. Limited reviewed advisory fields; no match is not proof of safety.",
"packages": [
{
"package": {
"ecosystem": "npm",
"name": "example-package",
"version": "1.0.0"
},
"status": "needs-version-review",
"hasMoreCandidates": false,
"findings": [
{
"advisoryId": "SYNTHETIC-DEMO-ONLY",
"match": "unknown",
"summary": "Illustrative finding: verify the source and version rules before acting.",
"cves": [],
"reportedFixedVersions": [],
"evidence": {
"source": "osv-npm",
"recordId": "SYNTHETIC-DEMO-ONLY",
"snapshotHash": "0000000000000000000000000000000000000000000000000000000000000000",
"sourceUrl": "https://github.com/github/advisory-database",
"retrievedAt": "2026-09-21T00:00:00Z",
"sourceUpdatedAt": null,
"indexedAt": "2026-09-21T00:00:00Z",
"license": "CC-BY-4.0",
"licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
"attribution": "Synthetic shape example; no upstream advisory is reproduced.",
"policyVersion": "synthetic-example",
"licenseEvidenceHash": "0000000000000000000000000000000000000000000000000000000000000000"
}
}
]
}
]
},
"allowance": {
"requestsRemaining": 99,
"dataBytesRemaining": 9998000,
"resetsAt": "2026-09-22T00:00:00Z",
"byteDefinition": "UTF-8 JSON data object only; excludes HTTP/MCP envelopes, headers and errors"
},
"retryAt": null
}Inspect HTTP errors and the structured status/code. For MCP, a successful transport does not imply a successful tool result. Inspect retryAt and remaining allowance. Preserve attribution and license information. Treat sourceUpdatedAt: null as unknown.
A reviewed subset of GitHub Advisory Database records in OSV format for exact npm, PyPI, and NuGet versions. Private CISA, EPSS, and NVD enrichment is outside the offer. Regional news reports and events are a separate product within the same trial account, as described above. Best-effort service; no completeness, latency, or uptime guarantee.
Download the dependency-free Node client and read the REST/MCP recipes. The example reads a key from your environment, refuses redirects, bounds requests and responses, and never logs credentials. It does not activate invitations or accept terms.
node adx-trial-client.mjs rest npm lodash 4.17.20 node adx-trial-client.mjs mcp npm lodash 4.17.20
The client requires a separately activated trial account and ADX_API_KEY in a private process environment. Do not put that value in a URL, command argument, repository, or agent transcript.
Apply → receive automatic approval and an invitation → explicitly accept the trial terms → store your key privately → run your first query.