# Tech Version, CVE & Security-Header Check (Passive) (`centorprat/tech-version-cve-check`) Actor

For a URL and a technology, passively detects the tech and its version (headers, meta generator, script URLs - read-only, no probing), looks that version up in public CVE databases (OSV/NVD), and reports known CVEs plus a security-header posture. For assets you own or are authorized to test.

- **URL**: https://apify.com/centorprat/tech-version-cve-check.md
- **Developed by:** [Centor Prat](https://apify.com/centorprat) (community)
- **Categories:** Developer tools, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $17.00 / 1,000 technology checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Tech Version, CVE & Security-Header Check (Passive)

**Check software you run for known problems — passively.** Give a URL and a technology; it reads only what
the page already serves (response headers, `<meta generator>`, `<script src>` URLs — the same bytes a
browser receives), identifies whether that technology is present and at which **version**, looks that
version up in public CVE databases (**OSV.dev** for libraries, **NVD** for server/CMS software), and
reports the known CVEs — plus a passive **security-header posture**. Built to answer *"is the version I'm
running affected by anything, and are my hardening headers set?"*

> 🔒 **Passive and authorized-use only.** It performs a normal read-only GET of the page — **no payloads,
> no probing, no exploitation, no scanning** of hidden paths or ports. Run it on assets you **own or are
> authorized to test**. A CVE affecting a version does **not** mean the target is exploitable (it may be
> patched, back-ported or mitigated); no CVEs does **not** mean it's secure. This is a version/known-vuln
> check, not a penetration test.

### ⚡ What it does

| Step | How (passive) |
|---|---|
| **Detect tech + version** | Response headers (`Server`, `X-Powered-By`), `<meta generator>`, versioned `<script src>` URLs |
| **Look up CVEs** | OSV.dev (npm/PyPI libraries) + NVD (CPE match) for the detected/provided version |
| **Security-header posture** | Which of HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy + cookie flags the response sets (OWASP A05-flavored) |

Known technologies: `jquery, bootstrap, lodash, vue, react, angular, axios, moment, wordpress, drupal,
joomla, nginx, apache, php` (others are attempted generically). Pass `version` to CVE-check a version you
already know.

### 📥 Input

```json
{
  "urls": ["https://your-site.com"],
  "technologies": ["wordpress", "nginx", "jquery"],
  "includeSecurityHeaders": true
}
```

### 📤 Example output (real run, trimmed)

```json
{ "check": "security-headers", "url": "https://wordpress.org/", "posture": "weak-headers",
  "presentHeaders": ["HSTS", "X-Frame-Options"],
  "missingHeaders": ["Content-Security-Policy", "X-Content-Type-Options", "Referrer-Policy", "Permissions-Policy"],
  "serverHeader": "nginx" }
```

```json
{ "technology": "jquery", "technologyDetected": true, "detectedVersion": "3.4.1",
  "signal": "known-cves-for-version--review", "cveCount": 2,
  "cves": [ {"id": "CVE-2020-11022", "severity": "CVSS:3.1/...", "summary": "Potential XSS vulnerability in jQuery", "source": "OSV.dev"} ] }
```

Signals: `known-cves-for-version--review`, `no-known-cves-for-version`, `version-not-identified`,
`technology-not-detected`.

### 💰 Pricing (pay-per-event)

- **Tech checked — $0.02** per URL × technology checked. The security-header posture is included free.

### 💡 Use cases

- **Developers / site owners:** confirm the library/CMS/server version you run and its known CVEs, plus whether your security headers are set.
- **Security / platform teams:** a fast, passive version-and-CVE read across assets you own.
- **Agents / CI:** callable as an MCP tool for an authorized, non-intrusive check.

### 🔑 Keyless & agent-callable

No API keys, no accounts, no paid child Actors — just a read-only page fetch plus public OSV.dev and NVD.

### 🚀 Ready-made tasks (one click)

- [Website CVE Check - Outdated Software Versions](https://apify.com/centorprat/tech-version-cve-check/examples/website-cve-check)

### 🤖 For AI agents (MCP)

```
https://mcp.apify.com/?tools=actors,docs,centorprat/tech-version-cve-check
```

Loads as `centorprat--tech-version-cve-check`. Claude Code:

```
claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/tech-version-cve-check
```

# Actor input Schema

## `urls` (type: `array`):

Pages to check, e.g. \["https://your-site.com"]. The Actor only performs a normal read-only GET of each page - no probing or exploitation. Only use it on assets you own or have permission to test.

## `technologies` (type: `array`):

Technologies to look for, e.g. \["jquery"], \["wordpress", "nginx", "php"]. Known: jquery, bootstrap, lodash, vue, react, angular, axios, moment, wordpress, drupal, joomla, nginx, apache, php (others are attempted generically).

## `version` (type: `string`):

If you already know the version running on your asset, set it to CVE-check it directly (used for every technology above).

## `webhookUrl` (type: `string`):

If set, results are POSTed here as JSON when the run finishes.

## `includeSecurityHeaders` (type: `boolean`):

Also report which standard security headers (HSTS, CSP, X-Frame-Options, ...) and cookie flags the page sends - a passive OWASP A05-flavored hardening read from the same response. No extra requests.

## Actor input object example

```json
{
  "urls": [
    "https://wordpress.org/"
  ],
  "technologies": [
    "wordpress",
    "nginx"
  ],
  "includeSecurityHeaders": true
}
```

# Actor output Schema

## `results` (type: `string`):

One row per URL x technology: whether the technology was detected and at which version, the passive evidence, a signal, and - when a version is known - the known CVEs from OSV.dev/NVD (id, severity, summary, source) or 'no known CVEs for this version'. Read-only, passive; verify every finding against the source.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://wordpress.org/"
    ],
    "technologies": [
        "wordpress",
        "nginx"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("centorprat/tech-version-cve-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": ["https://wordpress.org/"],
    "technologies": [
        "wordpress",
        "nginx",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("centorprat/tech-version-cve-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://wordpress.org/"
  ],
  "technologies": [
    "wordpress",
    "nginx"
  ]
}' |
apify call centorprat/tech-version-cve-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,centorprat/tech-version-cve-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/WhehMw5vfw72GAscH/builds/1IBMcJfVPcYGQYn1C/openapi.json