{"uid":"cap_6QiCFf27EsAIrPT5buQk1","slug":"package-provenance-checker-3d52d8c3","name":"Package Provenance Checker","description":"Does a package version carry build provenance (SLSA/sigstore attestations)? Signals a verifiable build, not safety.","url":"https://package-health.x402tookit.com/package-provenance?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["system","name"],"properties":{"name":{"type":"string","description":"Package name"},"system":{"type":"string","description":"npm, pypi, go, maven, cargo or nuget"},"version":{"type":"string","description":"Version; default is the registry's default version"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"asOf":{"type":["null","string"]},"name":{"type":["null","string"]},"source":{"type":["null","string"]},"system":{"type":["null","string"]},"reasons":{"type":["array","null"],"items":{"type":"string"}},"summary":{"type":["null","string"]},"verdict":{"type":["null","string"]},"version":{"type":["null","string"]},"degraded":{"type":["boolean","null"]},"sourceUrl":{"type":["null","string"]},"disclaimer":{"type":["null","string"]},"notChecked":{"type":["array","null"],"items":{"type":"string"}},"publishedAt":{"type":["null","string"]},"attestations":{"type":["null","number"]},"relatedProjects":{"type":["array","null"],"items":{"type":"string"}},"slsaProvenances":{"type":["null","number"]}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_PQ1SMCfXmh-Wtvb5PL9kU","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a package version has SLSA or sigstore build attestations, signaling a verifiable build provenance.","exampleAgentPrompt":"Does the npm package 'lodash' version 4.17.21 have any SLSA or sigstore build attestations — is its build provenance verifiable?","exampleUseCases":[{"title":"CI gate for supply chain integrity","prompt":"Before we publish our app, check whether the npm package 'esbuild' version 0.20.0 has SLSA provenance attestations — we only want to use packages with verifiable builds."},{"title":"Security audit of a Python dependency","prompt":"We're auditing our Python dependencies — does the PyPI package 'cryptography' version 42.0.5 have any sigstore attestations or SLSA provenances?"},{"title":"Go module provenance verification","prompt":"Can you check if the Go module 'github.com/gin-gonic/gin' at version 1.9.1 carries any build attestations or SLSA provenance records?"}],"resultDescription":"Returns a verdict (e.g. 'attested' or 'unattested'), the number of sigstore attestations and SLSA provenances found, a human-readable summary, reasons supporting the verdict, the source registry URL, publication timestamp, and a disclaimer about what provenance signals do and don't mean for safety.","failureModes":["Package name or system not recognized — returns null fields or error","Version not found in registry — returns null version fields","Registry API unavailable — degraded flag set to true","System enum value not one of npm/pypi/go/maven/cargo/nuget — request rejected","No attestation data available — verdict returned as unattested with zero counts"],"whenToPreferThis":"Use this endpoint when you specifically need to know whether a package version was built with a verifiable, tamper-evident pipeline (SLSA/sigstore) rather than general health, safety, or license concerns. Prefer it over broader package health checks when the question is about supply chain integrity and build provenance traceability. It is the right choice for CI/CD gates enforcing SLSA policy or auditing dependencies for cryptographic build attestations.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:18:49.262Z","isFirstParty":false,"canonicalSlug":"package-provenance-checker-3d52d8c3"}