{"uid":"cap_QH9mliHhbCP8OCMaY_8Pk","slug":"dependency-trust-package-vulnerability-trust-score-5372c982","name":"Dependency Trust - Package Vulnerability & Trust Score","description":"Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.","url":"https://dep-trust.agent-utils.workers.dev/v1/vulns","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name (npm scoped names allowed; Maven as groupId:artifactId; Go as module path)"},"version":{"type":"string","description":"Optional exact version; omit to list advisories across all versions"},"ecosystem":{"enum":["npm","pypi","cargo","go","maven"],"type":"string","description":"Package ecosystem"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"name":{"type":"string"},"count":{"type":"integer"},"version":{"type":["string","null"]},"ecosystem":{"enum":["npm","pypi","cargo","go","maven"],"type":"string","description":"Package ecosystem"},"vulnCounts":{"type":"object"},"vulnerabilities":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"url":{"type":"string"},"aliases":{"type":"array","items":{"type":"string"}},"fixedIn":{"type":"array","items":{"type":"string"}},"summary":{"type":"string"},"severity":{"enum":["critical","high","medium","low","unknown"],"type":"string"},"cvssScore":{"type":["number","null"]},"published":{"type":["string","null"]}}}}}}}}}},"responseSchema":{"type":"json","example":{"name":"requests","count":2,"version":"2.25.0","ecosystem":"pypi","vulnCounts":{"low":0,"high":0,"medium":2,"unknown":0,"critical":0},"vulnerabilities":[{"id":"GHSA-j8r2-6x86-q33q","url":"https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q","aliases":["CVE-2023-32681"],"fixedIn":["2.31.0"],"summary":"Unintended leak of Proxy-Authorization header in requests","severity":"medium","cvssScore":5,"published":"2023-05-26T00:00:00Z"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_WtZJhlEOTlWMxdA0X8KLT","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns vulnerabilities, license, age, popularity, provenance, typosquat lookalikes, and a trust score for a given package across npm, PyPI, crates.io, Go, and Maven ecosystems.","exampleAgentPrompt":"Before I add it to my project, check the PyPI package 'requests' version 2.25.0 for vulnerabilities, known CVEs, and give me a trust score — I need to know if it's safe to install.","exampleUseCases":[{"title":"Audit npm package before install","prompt":"I'm about to add 'lodash' version 4.17.20 to my Node project — can you check if it has any known vulnerabilities, what its license is, and whether it looks trustworthy before I install it?"},{"title":"Detect typosquat in dependency","prompt":"My colleague just used a package called 'reqeusts' from PyPI in our codebase — can you check if it's a typosquat of a legitimate package and whether it has any security red flags?"},{"title":"Cargo crate security review","prompt":"We're evaluating the 'serde' crate from crates.io for our Rust project — can you pull its vulnerability history, trust score, and provenance details so I can decide if it's safe to ship?"}],"resultDescription":"Returns a JSON object containing the package name, ecosystem, queried version, total vulnerability count, per-severity counts (critical/high/medium/low/unknown), and an array of vulnerability objects each with an OSV ID, URL, CVE aliases, affected versions, fix versions, summary, severity level, CVSS score, and publication date. May also include trust score, license, age, popularity, provenance, and typosquat lookalike signals depending on endpoint variant.","failureModes":["Unknown ecosystem value returns validation error","Package name not found in ecosystem returns empty or 404","Malformed Maven groupId:artifactId format causes lookup failure","Rate limiting or payment failure via x402 returns 402 or 429","Network timeout from upstream OSV API causes delayed or failed response","Omitting required 'ecosystem' or 'name' query params returns 400"],"whenToPreferThis":"Prefer this endpoint when an AI agent or developer needs a comprehensive, single-call security and trust assessment for a package — especially when combining vulnerability data with provenance, typosquat detection, and a trust score matters. Ideal for automated dependency auditing pipelines, pre-install checks in agent workflows, or supply chain security reviews. Works across npm, PyPI, crates.io, Go, and Maven in one unified API with no API key required (pay-per-call via x402).","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:43:15.847Z","isFirstParty":false}