{"uid":"cap_k1jEvRohdShBryYoJ5E-S","slug":"mesh-agentdiet-dev-github-repository-license-dependency-supply-chain-f4c48825","name":"GitHub Repository License, Dependency & Supply-Chain Security Auditor","description":"Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain security before code execution. (Live x402 v2, IETF MPP & MCP endpoint at https://mesh.agentdiet.dev/v1/sbom-auditor)","url":"https://mesh.agentdiet.dev/v1/sbom-auditor?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","required":["repo"],"properties":{"repo":{"type":"string","minLength":1,"description":"GitHub repository in owner/name format (e.g. modelcontextprotocol/servers or langchain-ai/langgraph)"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":[],"displayCostAmount":"0.01","displayCostAsset":"USD","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_tWT3BkmamVS6WcH9InJg_","protocol":"mpp","methodType":"crypto","chain":"tempo","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":"mesh.agentdiet.dev","brandSlug":"mesh-agentdiet-dev-mpp","brandBaseUrl":"https://mesh.agentdiet.dev","brandDocsUrl":null,"whatItDoes":"Audits a GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain/dependency security before integrating or executing its code.","exampleAgentPrompt":"Before I add langchain-ai/langgraph as a dependency, can you audit its GitHub repo for license risks, maintenance health, and any supply-chain security issues?","exampleUseCases":[{"title":"Pre-integration OSS license check","prompt":"I'm about to integrate modelcontextprotocol/servers into our product — can you audit that GitHub repo for any license risks or legal red flags I should know about?"},{"title":"Agentic code execution safety gate","prompt":"Before running any code from the huggingface/transformers repo, audit it for supply-chain security issues, suspicious dependencies, and maintenance signals like stars and recent commit velocity."},{"title":"Evaluating an unfamiliar open-source library","prompt":"I found this GitHub project called 'pallets/flask' and want to know if it's well-maintained, has a permissive license, and doesn't have any known supply-chain vulnerabilities — can you give me a security audit?"}],"resultDescription":"Returns a structured audit report covering the repository's detected license and associated risk level, maintenance velocity indicators (recent commits, last activity), community signals (star and fork counts), and supply-chain/dependency security findings — giving an agent or developer a clear go/no-go signal before adopting or executing the repo's code.","failureModes":["Invalid or non-existent repo format returns an error (repo must be in owner/name format)","Private repositories that the service cannot access will fail or return incomplete data","Rate limiting or GitHub API quota exhaustion may cause timeouts","Repos with no dependency manifest may return limited supply-chain data","Network errors connecting to GitHub or OSV data sources return 5xx responses"],"whenToPreferThis":"Choose this endpoint when an AI agent or developer needs a quick, automated pre-flight check on a GitHub repository before integrating it as a dependency or executing its code — especially for license compliance (copyleft vs permissive), supply-chain risk, or maintenance health signals. Prefer it over manual GitHub browsing or generic CVE scanners when you want a single call that combines license, maintenance velocity, community signals, and dependency security in one report.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-23T06:31:01.737Z","isFirstParty":false,"canonicalSlug":"mesh-agentdiet-dev-github-repository-license-dependency-supply-chain-c0ac81bb"}