{"uid":"cap_2eKkctjBNgYXJTlP_7e-8","slug":"dependency-gate-package-security-license-policy-check-c4faead2","name":"Dependency Gate – Package Security & License Policy Check","description":"Free need-to-tool routing plus pay-per-call npm docs and TypeScript API signatures, npm breaking-change diffs, JavaScript-rendered browser snapshots and deterministic coding-agent checks via AgentCash/x402.","url":"https://x402-canary.nicolas-x402-16f380a7.workers.dev/v1/agent/dependency-gate","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"policy":{"type":"object","properties":{"denied_licenses":{"type":"array","items":{"type":"string"},"maxItems":20},"fail_on_deprecated":{"type":"boolean","default":false},"block_on_any_direct_vulnerability":{"type":"boolean","default":true}},"additionalProperties":false},"packages":{"type":"array","items":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","maxLength":214},"version":{"type":"string","maxLength":100},"ecosystem":{"enum":["npm","pypi"],"type":"string"}},"additionalProperties":false},"example":[{"name":"hono","version":"4.13.2","ecosystem":"npm"}],"maxItems":5,"minItems":1}}},"responseSchema":{"type":"json","example":{"data":{"decision":"ALLOW","packages":[{"name":"hono","decision":"ALLOW","ecosystem":"npm","resolved_version":"4.13.2","vulnerability_count":0}],"provenance":["deps.dev v3","OSV.dev v1"],"package_count":1,"install_allowed":true},"meta":{"engine":"dependency-gate"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.015","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.015/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.015","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.015","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TY5JE8kbSOuiKdSxM-Arv","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.015","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates npm and PyPI packages against vulnerability databases and license policies, returning an ALLOW/DENY decision for each package and the set as a whole.","exampleAgentPrompt":"Before I add these packages to my project, check whether hono@4.13.2 (npm) is safe to install — block it if it has any direct vulnerabilities and deny anything with a GPL or AGPL license.","exampleUseCases":[{"title":"CI gate before npm install","prompt":"I'm about to install express@4.18.2 and lodash@4.17.21 from npm — can you run them through the dependency gate and block the install if either has known vulnerabilities?"},{"title":"License compliance for enterprise repo","prompt":"Check react@18.2.0 and next@14.0.0 on npm against our policy: deny any GPL, LGPL, or AGPL licenses and block if there are any direct vulnerabilities — tell me if we're clear to install."},{"title":"PyPI package audit before deployment","prompt":"Before we deploy, validate that requests@2.31.0 and cryptography@41.0.4 from PyPI are safe — flag anything deprecated and block if any direct security vulnerabilities are found."}],"resultDescription":"Returns a top-level ALLOW or DENY decision, an install_allowed boolean, and per-package details including resolved version, vulnerability count, and individual ALLOW/DENY decisions, sourced from deps.dev and OSV.dev.","failureModes":["Package not found in registry – returns error or DENY for that package","Version string not resolvable – unrecognized version may cause lookup failure","Exceeds maxItems limit (5 packages per call) – request rejected with validation error","Unsupported ecosystem value – must be 'npm' or 'pypi'","Upstream deps.dev or OSV.dev unavailable – may return degraded or error response","Payment not included or insufficient – x402 payment required at $0.015 USDC per call"],"whenToPreferThis":"Use this endpoint when a coding agent needs a deterministic, policy-enforceable ALLOW/DENY decision on npm or PyPI packages backed by live vulnerability (OSV.dev) and metadata (deps.dev) data. Prefer it over manual npm audit or Snyk when you need a structured JSON gate result within an automated agent workflow, especially when license policy enforcement is also required.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:44:15.959Z","isFirstParty":false}