{"uid":"cap_I88YVEJPWPXUzhUG5PYOc","slug":"orphan-patch-score-457afa12","name":"orphan-patch-score","description":"Ranks packages with disclosed advisories, silent maintainers, and many dependents as orphan-patch candidates, deterministically, from public inputs alone.","url":"https://market.561.group/v1/orphan-patch/score?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"advisories":{"type":"array","description":"{id, package, ecosystem, severity, published, fixedVersion} rows; fixedVersion is null when no fix is known."},"dependents":{"type":"array","description":"{package, ecosystem, dependentCount} rows."},"maintenance":{"type":"array","description":"{package, ecosystem, lastReleaseDaysAgo, openIssueResponseDaysMedian} rows; openIssueResponseDaysMedian is null when no issue response was ever recorded."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_IOZJmN0Tc1BEJddV1Fz7E","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Ranks open-source packages as orphan-patch candidates by scoring them on disclosed advisories, maintainer silence, and dependent count using only public, deterministic inputs.","exampleAgentPrompt":"Score these npm and PyPI packages for orphan-patch candidacy — I have advisory data with severity and fixedVersion, dependent counts, and maintenance stats like days since last release and median issue response time. Tell me which ones to prioritize for writing community patches.","exampleUseCases":[{"title":"Triage unpatched npm vulnerabilities","prompt":"I have a list of npm advisories — some with no known fix — along with how many packages depend on each one and how long it's been since maintainers responded to issues. Can you score them and tell me which ones are the best candidates for an orphan patch?"},{"title":"Prioritize PyPI packages for security team","prompt":"Our security team needs to decide where to spend effort writing community patches for PyPI packages. I've got advisory records with severity levels, dependent counts, and last-release ages — can you rank them by orphan-patch urgency?"},{"title":"Supply chain risk audit for enterprise dependencies","prompt":"We're auditing our software supply chain and want to find packages across npm and Maven that have disclosed advisories with no fix, silent maintainers, and lots of downstream dependents. Score each one so we know which orphan patches to write first."}],"resultDescription":"A ranked list of packages scored as orphan-patch candidates, computed deterministically from the supplied advisory, dependency, and maintenance data. Each entry reflects how urgently a community patch is warranted based on vulnerability severity, absence of an official fix, maintainer inactivity, and downstream blast radius.","failureModes":["Missing or malformed advisory rows (null package or ecosystem fields) may cause scoring errors","fixedVersion nulls must be explicit — omitting the field may skew scoring toward false negatives","Empty dependents or maintenance arrays result in partial scores with reduced ranking confidence","Unsupported ecosystem values may be ignored or cause validation failures","Sending packages with no advisory data produces a zero-risk score that may not surface real risks"],"whenToPreferThis":"Choose this endpoint when you need a reproducible, transparent, public-input-only prioritization of which packages deserve orphan patches — particularly when you already have structured advisory, dependent, and maintenance data and need a scored ranking rather than a raw list. It is preferable over manual triage or general vulnerability scanners when the goal is specifically to identify high-impact, unmaintained packages that the community should patch independently.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T12:42:20.400Z","isFirstParty":false,"canonicalSlug":"orphan-patch-score-457afa12"}