{"uid":"cap__6RGyRUcf5zNW4eNQbYdU","slug":"verify-package-2a8f5276","name":"verify-package","description":"Verify a package: does it exist, is it deprecated or yanked, and does it have known vulnerabilities? Checked against the npm/PyPI/crates.io registry plus OSV.dev advisories.","url":"https://goodsong.dev/verify/package","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string","description":"The package name."},"version":{"type":"string","description":"Optional specific version; defaults to latest if omitted."},"ecosystem":{"enum":["npm","pypi","crates"],"type":"string","description":"Which package registry to check."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_79GFZQhagwrw4ADjvtUmm","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether an npm, PyPI, or crates.io package exists, is deprecated/yanked, and has known security vulnerabilities via OSV.dev advisories.","exampleAgentPrompt":"Can you check if the PyPI package 'requests' version 2.25.0 exists, is still active (not yanked or deprecated), and has any known security vulnerabilities?","exampleUseCases":[{"title":"Audit a new dependency before adding it","prompt":"Before I add 'axios' version 1.4.0 to my project, can you verify it exists on npm, isn't deprecated, and doesn't have any known security vulnerabilities?"},{"title":"CI pipeline vulnerability gate","prompt":"Our CI pipeline just flagged the Rust crate 'serde' — can you check if it's been yanked and whether any known CVEs affect it on crates.io?"},{"title":"Python supply chain safety check","prompt":"I want to make sure the 'cryptography' package on PyPI is still published and doesn't have any OSV advisories against it — can you verify that for me?"}],"resultDescription":"Returns whether the package exists in the specified registry, whether it has been deprecated or yanked, and a list of known security vulnerabilities sourced from OSV.dev advisories, including advisory IDs and severity details where available.","failureModes":["Package not found in the specified registry — returns existence: false","Unsupported ecosystem value — returns validation error on the ecosystem enum","Specific version not found — may return version-not-found error even if package exists","OSV.dev rate limits or downtime — may cause incomplete vulnerability results","Ambiguous package name across ecosystems — caller must specify correct ecosystem"],"whenToPreferThis":"Choose this endpoint when you need a quick, combined existence + deprecation + vulnerability check for a single package from npm, PyPI, or crates.io. It is ideal for pre-install dependency auditing, CI/CD gating, or agent-driven security reviews where you want a one-shot answer without separately querying the registry and OSV.dev yourself.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:41:29.055Z","isFirstParty":false}