Attestd vs VulnCheck

VulnCheck's Package URL endpoint and Attestd's /v1/check look similar from the outside: one call with a package identifier returns vulnerability data. The differences that matter for developers are access (enterprise contract vs self-serve) and output shape (CVE list vs synthesized verdict).

Access: enterprise contract vs self-serve

VulnCheck's free Community tier covers VulnCheck KEV, NVD++ (an NVD/CVElist mirror), VulnCheck XDB, and Alerts. Package URL Detections (PURL and CPE querying, plus malicious, abandoned, hijackable, and typosquat research attributes) are documented under VulnCheck's paid Exploit & Vulnerability Intelligence product. That SKU is sold as an annual enterprise contract. On AWS Marketplace, Exploit & Vulnerability Intelligence lists at $259,200 per year. There is no public self-serve paid tier between Community and that contract.

Attestd is self-serve from the first call. Free tier: 1,000 calls per month. Solo: $19.99 per month for 10,000 calls. No sales conversation required to query nginx, Redis, or a PyPI package.

Product docs: VulnCheck Community · Package URL Detections · AWS Marketplace EVI listing.

Output type: synthesized verdict vs CVE list

Even with an EVI license, GET /v3/purl returns a CVE ID list and optional research attributes. There is no risk_state field. A program or agent must interpret that list before it can decide whether to block a deploy.

Active exploitation status is not in the PURL response. Licensed customers query a second endpoint:

curl "https://api.vulncheck.com/v3/index/exploits?cve=CVE-2018-20301" \
  -H "Authorization: Bearer $VULNCHECK_TOKEN"

Attestd returns risk_state, actively_exploited, and supply_chain.compromised in one call. Frozen v1 semantics. Branch with an if statement.

{
  "data": {
    "cves": ["CVE-2018-20301"],
    "vulnerabilities": [
      { "detection": "CVE-2018-20301", "fixed_version": "0.5.2" }
    ],
    "research_attributes": {}
  }
}

{
  "risk_state": "high",
  "actively_exploited": false,
  "patch_available": true,
  "fixed_version": "2.1.0",
  "supply_chain": {
    "compromised": false
  }
}

Infrastructure coverage

VulnCheck PURL support covers language ecosystems (npm, PyPI, Maven, Cargo, and others) and OS package managers (Debian, Ubuntu, RHEL, Alpine, and others). Infrastructure products such as nginx, Redis, and PostgreSQL are not queried as product@version. They require a CPE string via /v3/cpe.

Attestd uses the same product@version pattern for all 356 covered products: language packages and infrastructure alike. One query shape for CI, agents, and scripts.

Supply chain coverage

VulnCheck can return is_malicious (and related research attributes) in the PURL response for gem, npm, nuget, and pypi. That capability is part of the paid EVI product, not Community. It is a separate key from the CVE list, not a unified verdict field.

Attestd returns supply_chain.compromised in the same /v1/check call as CVE risk_state, on a self-serve plan. Same schema, same version semantics. One call, both signals.

What you get from each

Pricing

Attestd Solo is $19.99 per month for 10,000 calls with self-serve signup. VulnCheck Package URL Detections sits under Exploit & Vulnerability Intelligence, sold as an annual enterprise contract (example: $259,200 per year for that SKU on AWS Marketplace). VulnCheck Community is free for KEV, NVD++, and XDB. It does not include PURL package queries. Contract figure per AWS Marketplace.

When VulnCheck is the right choice

VulnCheck fits enterprise security teams with budget and a sales relationship who need exploit intelligence across hundreds of advisory indexes, initial-access rules, IP or botnet threat data, and deep CVE enrichment for SOC or CSIRT workflows.

When attestd is the right choice

• →You need a deterministic risk_state today without a sales conversation
• →You query infrastructure products (nginx, Redis, PostgreSQL) with the same product@version pattern as language packages
• →You need CVE risk, active exploitation, and supply chain compromise in one call
• →You are building a CI gate or AI agent tool that branches on a boolean or enum, not a CVE list

Try it in 30 seconds

Get a free API key at the developer portal, then connect Attestd to your coding assistant via the setup docs.

curl "https://api.attestd.io/v1/check?product=nginx&version=1.20.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"