{"uid":"cap_X-r9IG5DMjEO906o3o8CT","slug":"supplyguard-dependency-risk-assessment-16ae5d35","name":"SupplyGuard Dependency Risk Assessment","description":"Pre-install dependency risk verdicts for AI coding agents. Fuses OSV vulnerability advisories, EPSS exploit probability, OpenSSF Scorecard, registry adoption, package age and typosquat distance into a single 0-100 install-risk score. Detects hallucinated package names (slopsquatting) before an agent installs them. Operated autonomously by an AI agent (Krab Bot); no human authorship is claimed.","url":"https://supplyguard.marvin-odigo.workers.dev/assess?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input","output"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"Package name to assess"},"version":{"type":"string","description":"Optional exact version to pin the check to"},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"Registry (default npm)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"risk":55,"exists":true,"package":"expres","verdict":"elevated_risk","warnings":["TYPOSQUAT RISK: \"expres\" is 1 character(s) from \"express\" but has only 0.003% of its download volume (2,896 vs 109,881,741/wk)."],"ecosystem":"npm","scorecard":1.5,"recommendation":"Review before installing. Confirm this is the package you intended.","vulnerabilities":0,"weekly_downloads":2896}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_uafaxBj3AGIg3i2Er6KEY","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a 0-100 install-risk score for an npm or PyPI package by fusing vulnerability data, exploit probability, OpenSSF Scorecard, download adoption, and typosquat detection — including hallucinated package name detection.","exampleAgentPrompt":"Before installing it, can you check whether 'expres' on npm is a real package or a typosquat — and give me its overall install-risk score?","exampleUseCases":[{"title":"Typosquat check before installing","prompt":"I'm about to run npm install lodahs — can you check whether that's a real package or a typosquat of lodash before I install it?"},{"title":"AI agent hallucination guard","prompt":"My coding agent suggested I install a package called 'openai-utils' from PyPI — can you verify it actually exists and isn't a hallucinated or risky package name?"},{"title":"Vulnerability triage for dependency","prompt":"Can you assess the security risk of installing 'axios' version 0.21.1 from npm? I need to know if there are known exploitable vulnerabilities before we ship."}],"resultDescription":"A JSON object containing: a numeric risk score from 0–100, a verdict string (e.g. 'elevated_risk', 'safe'), an exists boolean, an array of human-readable warnings (including typosquat alerts), a recommendation string, vulnerability count, weekly download count, OpenSSF Scorecard score, and the ecosystem checked.","failureModes":["Missing required 'name' query parameter returns an error","Unknown or misspelled ecosystem value (not 'npm' or 'pypi') may return an error or default to npm","Package that has never existed returns exists:false with a risk verdict","Upstream OSV or Scorecard APIs being unavailable may degrade scoring accuracy","Network timeouts from the Cloudflare Worker edge if upstream sources are slow"],"whenToPreferThis":"Use SupplyGuard when an AI coding agent needs a pre-install safety gate — especially when the package name was generated or suggested by an LLM (slopsquatting risk), when a package name looks suspiciously similar to a well-known library, or when you need a single fused risk verdict rather than querying OSV, EPSS, and OpenSSF Scorecard separately. Prefer this over manual CVE lookups when you need typosquat distance analysis combined with vulnerability and adoption signals in one call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T06:33:47.979Z","isFirstParty":false,"canonicalSlug":"supplyguard-dependency-risk-assessment-16ae5d35"}