{"uid":"cap_TsH5MgLIWl7mMYdN5j_1R","slug":"package-dependency-risk-scanner-2bad42d3","name":"Package Dependency Risk Scanner","description":"Pay-per-call data and tools for AI agents, $0.002-0.01 per call in USDC via x402 (Base, Polygon or Solana), no account or API key; MAX tiers ($0.05-0.25) run deeper jobs. Agent toolkit: web search, search + read top pages, any page as clean markdown with a prompt-injection check, which-x402-API-to-call recommender, seller check. Data: Google Maps places with contacts, YouTube video data and transcripts, job listings (Indeed, LinkedIn, 13 boards), Google Ads Transparency, TikTok comments, Pinterest, Airbnb, Redfin, AliExpress, app stores, live sports, website and SEO checks, Shopify store tech stacks, and onchain token / address risk checks.","url":"https://agent-data.centorprat.workers.dev/tools/package-dependency-risk-scanner?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"packages":{"type":"array","items":{"type":"string"},"maxItems":5,"description":"e.g. [\"lodash\", \"express@4.18.0\", \"pypi:requests\", \"npm:@babel/core\"]. Prefix with npm: or pypi: to pick the ecosystem (else the default below); add @version (npm) or ==version (PyPI) to check a specific version. One brief per package."},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"Used for package names without an npm:/pypi: prefix."}}},"responseSchema":{"type":"json","example":{"items":[{"name":"lodash","found":true,"query":"lodash","created":"2012-04-23T16:37:11.912Z","license":"MIT","homepage":"https://lodash.com/","ecosystem":"npm","deprecated":false,"lastPublish":"2026-04-01T21:01:20.458Z","maintainers":1,"latestVersion":"4.18.1","checkedVersion":"4.18.1","weeklyDownloads":94515109,"deprecatedReason":null}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_kjqJyu_8RFo6ieoaX7sA4","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans npm and PyPI packages for known security vulnerabilities, staleness, deprecation, and download signals by querying registry metadata and OSV.dev advisories.","exampleAgentPrompt":"Can you scan lodash, express@4.18.0, and pypi:requests for known security vulnerabilities, deprecation, and staleness — I want to know if these are safe to use before I add them to my project?","exampleUseCases":[{"title":"Pre-release dependency audit","prompt":"Before I ship this release, can you check npm packages lodash, axios, and @babel/core for any known CVEs or deprecation issues? I need a risk summary for each one."},{"title":"Python library security vetting","prompt":"I'm about to add pypi:requests and pypi:flask to a new project — can you pull their OSV advisories and tell me if either has known vulnerabilities or looks abandoned?"},{"title":"CI pipeline supply-chain check","prompt":"Scan npm:left-pad, npm:colors, and npm:faker for security advisories, download trends, and staleness so I can decide whether to keep them in our dependency tree."}],"resultDescription":"A risk brief per package including: known CVE/security advisories from OSV.dev, deprecation status, staleness indicators (time since last publish), npm download counts where applicable, and an overall risk signal summarizing whether the package is safe, risky, or flagged for attention.","failureModes":["Package not found in the specified registry — returned as a failed lookup (not charged)","Invalid package name or version format causes lookup error","Ecosystem mismatch (e.g. npm package queried as PyPI) results in not-found","OSV.dev or registry API unavailability may cause incomplete results","Exceeding the 5-package-per-call limit returns a schema validation error"],"whenToPreferThis":"Use this endpoint when you need a quick, keyless security and health check for npm or PyPI packages before adding them to a project, during CI/CD pipeline audits, or when performing supply-chain risk assessments. It combines registry metadata, download signals, and OSV vulnerability data in one call — ideal for agents that need a consolidated risk brief without managing multiple API keys or credentials.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T00:33:39.994Z","isFirstParty":false,"canonicalSlug":"package-dependency-risk-scanner-2bad42d3"}