{"uid":"cap_ZgHRGrk5hvfj2zrkaqORD","slug":"tolca-package-security-check-05bf2288","name":"Tolca Package Security Check","description":"Pay-per-call services for AI agents over x402 (USDC on Base).","url":"https://tolca.tonbot.ca/v1/pkg-check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["name","ecosystem"],"properties":{"name":{"type":"string","description":"Package name as published"},"version":{"type":"string","description":"Optional exact version; defaults to latest"},"ecosystem":{"enum":["npm","PyPI"],"type":"string"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"facts":{"license":"MIT","latest_version":"4.17.21","weekly_downloads":50000000},"score":55,"reasons":["1 high/critical known vulnerability affecting this version","a newer version exists (4.17.21)"],"verdict":"caution","recommendation":"Upgrade to 4.17.21 before installing.","vulnerabilities":[{"id":"GHSA-p6mc-m468-83gw","summary":"Prototype pollution in lodash","fixed_in":"4.17.19","severity":"HIGH"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_EKdJl4U-qqyt-6EpEIM7O","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an npm or PyPI package for known vulnerabilities, license info, and version freshness, returning a scored safety verdict.","exampleAgentPrompt":"Can you check if lodash version 4.17.20 on npm is safe to use — I need to know about any vulnerabilities and whether I should upgrade before adding it to my project?","exampleUseCases":[{"title":"Pre-install dependency security audit","prompt":"Before I add requests 2.28.0 from PyPI to my app, can you check if it has any known vulnerabilities or if there's a newer version I should use instead?"},{"title":"CI pipeline package gating","prompt":"Check whether the npm package minimist at version 1.2.5 is safe enough to ship — give me the security score and any critical issues I should know about."},{"title":"Open source license compliance check","prompt":"I need to know the license and security status of the PyPI package numpy latest version — is it safe and what license does it use?"}],"resultDescription":"Returns a numeric security score (0-100), a verdict (e.g. 'safe', 'caution', 'unsafe'), a list of reasons, a recommendation string, known vulnerabilities with IDs/severities/fix versions, and package facts including license, latest version, and weekly downloads.","failureModes":["Package not found in the specified ecosystem — returns error or empty result","Unsupported ecosystem value (only 'npm' and 'PyPI' are accepted)","Invalid or malformed package name — request rejected","Specified version does not exist — may fall back to latest or return error","Vulnerability database temporarily unavailable — score may be incomplete","Payment failure over x402 — call not processed"],"whenToPreferThis":"Use this endpoint when an AI agent needs to programmatically vet a specific npm or PyPI package before installation, in a CI/CD pipeline, or during dependency auditing workflows. It is preferable over manual CVE searches when you need a machine-readable score and verdict in a single call, and when you want both vulnerability data and license/version freshness combined. Best suited for agents automating software supply chain decisions at $0.02 per check.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:30:09.967Z","isFirstParty":false,"canonicalSlug":"tolca-package-security-check-05bf2288"}