{"uid":"cap_3onrdSDEby7UEC_8shvJW","slug":"agentutility-dependency-risk-summary-0c7d8752","name":"AgentUtility Dependency Risk Summary","description":"Paid x402 endpoints organized into product clusters. USDC-settled on Base. MCP-callable. ERC-8004 identity registry agentId 47167.","url":"https://x402.agentutility.ai/dep-risk-summary","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"oneOf":[{"type":"object","required":["repo"],"properties":{"repo":{"type":"string","description":"GitHub repo in 'owner/name' format"},"branch":{"type":"string","description":"Optional branch; defaults to repo's default_branch"}}},{"type":"object","required":["files"],"properties":{"files":{"type":"array","items":{"type":"object","required":["path","content"],"properties":{"path":{"type":"string"},"content":{"type":"string"}}}}}}]},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"score":{"type":"integer"},"signals":{"type":"object","properties":{"ecosystem":{"type":"string"},"fanout_failed":{"type":"integer"},"legacy_runtime":{"type":"object","properties":{"node_engines":{"type":"null"},"python_requires":{"type":"null"}}},"peer_dep_count":{"type":"integer"},"direct_dep_count":{"type":"integer"},"fanout_attempted":{"type":"integer"},"fanout_succeeded":{"type":"integer"},"lockfile_present":{"type":"boolean"},"optional_dep_count":{"type":"integer"},"unpinned_dep_count":{"type":"integer"},"deprecated_dep_count":{"type":"integer"},"total_transitive_deps":{"type":"null"},"install_script_dep_count":{"type":"integer"},"top_3_risk_leader_packages":{"type":"array"}}},"summary":{"type":"string"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"path":{"type":"string"},"evidence":{"type":"string"},"severity":{"type":"string"},"recommendation":{"type":"string"}}}},"metadata":{"type":"object","properties":{"repo":{"type":"string"},"branch":{"type":"string"},"files_scanned":{"type":"integer"},"files_fetched_via_api":{"type":"integer"}}},"risk_level":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"score":30,"signals":{"ecosystem":"js","fanout_failed":0,"legacy_runtime":{"node_engines":null,"python_requires":null},"peer_dep_count":0,"direct_dep_count":5,"fanout_attempted":5,"fanout_succeeded":5,"lockfile_present":false,"optional_dep_count":0,"unpinned_dep_count":3,"deprecated_dep_count":0,"total_transitive_deps":null,"install_script_dep_count":0,"top_3_risk_leader_packages":[]},"summary":"package.json has 3 unpinned deps and no lockfile — supply-chain drift risk.","findings":[{"kind":"lockfile_missing","path":"package.json","evidence":"package.json found but no lockfile","severity":"medium","recommendation":"Commit a lockfile to pin transitive deps."},{"kind":"unpinned_dependency","path":"package.json","evidence":"lodash: \"^4.17.21\"","severity":"low","recommendation":"Pin lodash to an exact version for reproducible builds."}],"metadata":{"repo":"rooz21/prooflayer-fixtures","branch":"main","files_scanned":1,"files_fetched_via_api":8},"risk_level":"medium"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_AUipbiZg9lGVNUvNHZW5r","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a GitHub repository's dependency files to produce a supply-chain risk score, findings, and actionable recommendations","exampleAgentPrompt":"Can you give me a dependency risk summary for the GitHub repo rooz21/prooflayer-fixtures on the main branch — I want to know the risk score, whether there's a lockfile, and which packages are the biggest supply-chain risks?","exampleUseCases":null,"resultDescription":"Returns a JSON object containing: a numeric risk score (0-100), a risk_level string (e.g. 'medium'), a human-readable summary, an array of findings each with kind, path, evidence, severity, and recommendation fields, a signals object with ecosystem type, dep counts, lockfile presence, unpinned/deprecated dep counts, and top-3 risk leader packages, plus metadata about the repo, branch, files scanned, and files fetched.","failureModes":["Repository not found or inaccessible — returns error with repo/branch not found message","Invalid or missing repo parameter — returns validation error","GitHub API rate limit exceeded — returns upstream rate limit error","Branch does not exist — returns branch not found error","No dependency files detected in repo — returns empty or minimal findings","Network timeout reaching GitHub — returns timeout error"],"whenToPreferThis":"Use this endpoint when you need a quick, pay-per-call supply-chain risk assessment for a specific GitHub repository without setting up your own dependency scanning infrastructure. It is particularly well-suited for AI agents that need to programmatically audit OSS dependencies, check lockfile hygiene, or flag unpinned/deprecated packages as part of a CI or due-diligence workflow. Prefer this over generic vulnerability scanners when you want structured JSON output with severity-tagged findings and a composite risk score.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T13:00:53.830Z","isFirstParty":false}