{"uid":"cap_1s8WANz6huoNAEatj3dOs","slug":"stack-facts-lockfile-diff-security-audit-f4c1c08c","name":"Stack Facts Lockfile Diff Security Audit","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/lockfile/diff?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"to":{"type":"array","items":{"anyOf":[{"type":"string","maxLength":300},{"type":"object","required":["purl"],"properties":{"purl":{"type":"string","maxLength":300},"integrity":{"type":["string","null"]}},"additionalProperties":false}]},"maxItems":20,"minItems":0},"from":{"type":"array","items":{"anyOf":[{"type":"string","maxLength":300},{"type":"object","required":["purl"],"properties":{"purl":{"type":"string","maxLength":300},"integrity":{"type":["string","null"]}},"additionalProperties":false}]},"maxItems":20,"minItems":0},"to_lockfile":{"type":"string","maxLength":1048576},"from_lockfile":{"type":"string","maxLength":1048576}}},"responseSchema":{"type":"json","example":{"data":{"counts":{"go":0,"added":0,"no_go":0,"review":1,"changed":1,"removed":0,"unchanged":0,"not_judged":0,"hash_mismatch":0},"decision":"review","packages":[{"to":{},"from":{},"judged":true,"status":"changed","package":{},"reasons":[{}],"decision":"review","direction":"upgrade","advisories":{},"major_change":false,"licence_change":{},"requires_change":{},"kev_cves_removed":[],"kev_cves_remaining":[],"kev_catalog_version":"2026.10.10"}],"kev_catalog_version":"2026.10.10"},"meta":{"stale":false,"notice":"Normalised (modified) from the …","dataset":"preflight","datasets":{"kev":{},"osv":{},"license":{},"package":{}},"licences":"/licences"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_fYtF0jAfqiXkWLOntm-8N","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Compares two package lockfiles or dependency lists to surface security risks (malware, CVEs, CISA KEV), end-of-life status, and license changes for added/changed/removed packages, returning a signed go/no-go decision.","exampleAgentPrompt":"Before I merge this PR, can you compare my current package-lock.json to the updated one and tell me if any of the new or changed packages have exploited CVEs, malware, or are end-of-life — and give me a go or no-go verdict?","exampleUseCases":[{"title":"PR dependency security gate","prompt":"I have a pull request that updates several npm packages. Can you diff the old lockfile against the new one and flag any packages that have known exploited vulnerabilities (CISA KEV), malware, or end-of-life issues — I need a clear go/review/no-go before I approve the merge?"},{"title":"Spot-check a single upgrade","prompt":"I'm about to upgrade requests from 2.28.0 to 2.31.0 in my Python project. Can you check if this specific change introduces any new CVEs, exploited vulnerabilities, or license changes I should know about?"},{"title":"Automated CI security audit","prompt":"As part of our CI pipeline, compare yesterday's production lockfile to today's proposed lockfile and tell me exactly which packages changed, whether any newly introduced ones appear in CISA's known-exploited-vulnerabilities catalog, and whether we should block the deployment."}],"resultDescription":"Returns a top-level decision (go, review, or no_go), per-package status (added, removed, changed, unchanged), per-package security decisions with reasons, OSV vulnerability advisories, CISA KEV exploited CVE lists (remaining and removed), upgrade/downgrade direction, license change details, and aggregate counts — all cryptographically signed, sourced from OSV and CISA KEV datasets with dataset freshness metadata.","failureModes":["Invalid or unparseable lockfile content returns a parse error","Exceeds 20-package limit per array — request must be split","Unsupported package ecosystem PURL format rejected","Payment not received or insufficient USDC results in HTTP 402","Integrity hash mismatch flagged per package with hash_mismatch status","Stale dataset indicated via meta.stale flag in response"],"whenToPreferThis":"Choose this endpoint when you need to compare two states of a dependency graph (before/after a lockfile change) rather than auditing a single package in isolation. It is ideal for CI/CD pipeline gates, PR review automation, and deployment checks where you want a holistic go/no-go verdict across all changed packages at once, with CISA KEV exploitability data and signed responses — without needing an API key or account.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-19T06:38:38.203Z","isFirstParty":false,"canonicalSlug":"stack-facts-lockfile-diff-security-audit-f4c1c08c"}