{"uid":"cap_VCf71MjT8Dm-VrXITtiL4","slug":"pkg-oracle-package-safety-verifier-ac740789","name":"pkg-oracle Package Safety Verifier","description":"Verify an npm/PyPI package before installing it: existence, known CVEs (OSV.dev), OpenSSF Scorecard, and typosquat/slopsquat similarity. Returns an ALLOW/WARN/BLOCK verdict.","url":"https://mcp-snowy-dew-9447.fly.dev/verify?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"ecosystem":{"enum":["npm","pypi","crates.io"],"type":"string"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_sSi-Fgp388Pr9LDdmnijG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies an npm or PyPI package by checking existence, known CVEs via OSV.dev, OpenSSF Scorecard, and typosquat/slopsquat similarity, returning an ALLOW/WARN/BLOCK verdict.","exampleAgentPrompt":"Before I install it, can you check if the npm package 'colors' version 1.4.0 is safe — look for known CVEs, its OpenSSF scorecard, and whether it might be a typosquat of something popular?","exampleUseCases":[{"title":"CI pipeline dependency gate","prompt":"We're about to add 'request' version 2.88.2 from npm to our build — can you run a full safety check on it and tell me if it's safe to install, has any CVEs, or looks like a typosquat?"},{"title":"Catching AI-hallucinated package names","prompt":"My code assistant suggested I install a PyPI package called 'openai-utils' — can you verify it's a real, safe package and not a typosquat or slopsquat invented by an AI?"},{"title":"Auditing a new Python library","prompt":"I'm about to add 'cryptography' version 41.0.3 from PyPI to my project — can you check its security score, any known vulnerabilities, and whether the name looks suspicious?"}],"resultDescription":"Returns a verdict of ALLOW, WARN, or BLOCK for the specified package, along with details on known CVEs sourced from OSV.dev, an OpenSSF Scorecard rating, typosquat/slopsquat similarity analysis against popular packages, and confirmation of whether the package exists in the specified ecosystem.","failureModes":["Package not found in the specified ecosystem — returns existence failure","OSV.dev or OpenSSF Scorecard upstream unavailability causing incomplete results","Ambiguous package name with no clear match leading to inconclusive verdict","Invalid ecosystem value (not npm or pypi) causing schema validation error","Version string malformed or not found for the given package"],"whenToPreferThis":"Choose this endpoint when you need a fast, opinionated ALLOW/WARN/BLOCK safety verdict on an npm or PyPI package before installing it — especially useful in CI/CD pipelines, agentic coding workflows, or when evaluating AI-suggested packages that may be hallucinated (slopsquat). It combines CVE lookup, scorecard analysis, and typosquat detection in a single call, making it more comprehensive than querying OSV.dev or OpenSSF alone.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T06:35:23.055Z","isFirstParty":false,"canonicalSlug":"pkg-oracle-package-safety-verifier-ac740789"}