{"uid":"cap_YU9eS6XzPOz5dAWn3EVL0","slug":"package-risk-checker-9c4fc8b7","name":"Package Risk Checker","description":"Deterministic dependency risk data for agents: maintenance, licence, and known advisories for one package, resolved against the version an installer would actually get today. No model calls, no personal data.","url":"https://x402-package-risk.x402-package-risk.workers.dev/v1/package/risk?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","required":["name","system"],"properties":{"name":{"type":"string"},"system":{"enum":["npm","pypi","go","maven","cargo","nuget"],"type":"string"},"version":{"type":"string"}}},"responseSchema":{"licence":{"class":"permissive","licence":"MIT","commercialSafe":true},"package":{"name":"express","system":"npm"},"sources":["deps.dev","osv.dev","registry.npmjs.org"],"verdict":"ok","advisories":[],"maintenance":{"ageDays":93,"deprecated":false,"lastPublish":"2026-05-11T18:50:00.007Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_nuMWNP6VNZPiSkqziaszG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns deterministic dependency risk data for a single package — including licence classification, maintenance status, and known security advisories — resolved to the version an installer would actually get today.","exampleAgentPrompt":"Check the risk profile of the npm package 'express' — I need to know its licence, whether it's still maintained, and if there are any known security advisories against the version I'd get if I installed it today.","exampleUseCases":[{"title":"Pre-merge dependency audit","prompt":"Before I merge this PR, check if the npm package 'lodash' is safe to add — is the licence commercially permissive, is it still actively maintained, and are there any open security advisories?"},{"title":"Python package compliance check","prompt":"We're evaluating 'requests' on PyPI for use in our commercial product — can you check its licence class, whether it's deprecated, and if there are any known vulnerabilities?"},{"title":"CI pipeline risk gate","prompt":"As part of our build, check the risk verdict for the npm package 'left-pad' — flag it if the licence isn't permissive, it hasn't been published to in over a year, or if there are any active advisories."}],"resultDescription":"A structured JSON object containing: the resolved package name and ecosystem, a licence object with class (e.g. permissive), SPDX identifier, and commercial safety flag, a maintenance object with days since last publish, deprecated flag, and last publish timestamp, an array of security advisories, an overall verdict (e.g. 'ok'), and the data sources used (deps.dev, osv.dev, and the relevant registry).","failureModes":["Package not found in the specified ecosystem — returns an error or empty result","Invalid or unsupported ecosystem/system value","Version string that doesn't resolve to a published release","Network or upstream source (deps.dev, osv.dev) unavailability causing partial or failed data","Ambiguous package names that exist in multiple ecosystems if system is not specified"],"whenToPreferThis":"Choose this endpoint when you need deterministic, structured, non-AI-hallucinated risk data about a specific open source package before adding it to a project or shipping code. It is ideal for CI/CD pipeline gates, automated dependency audits, licence compliance checks, or any agent workflow that needs to programmatically decide whether a package is safe to use based on maintenance health, licence type, and known CVEs — without requiring a model to reason about package safety from training data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T00:33:07.054Z","isFirstParty":false,"canonicalSlug":"package-risk-checker-9c4fc8b7"}