{"uid":"cap_l6VGxX_N0_b4HvUw6ABzf","slug":"mesh-agentdiet-dev-github-repository-supply-chain-security-license-66fed36d","name":"GitHub Repository Supply-Chain Security & License Auditor","description":"Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain security before code execution. (Live x402 v2, IETF MPP & MCP endpoint at https://mesh.agentdiet.dev/v1/repo-supply-chain-scan)","url":"https://mesh.agentdiet.dev/v1/repo-supply-chain-scan?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","required":["repo"],"properties":{"repo":{"type":"string","minLength":1,"description":"GitHub repository in owner/name format (e.g. modelcontextprotocol/servers or langchain-ai/langgraph)"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":[],"displayCostAmount":"0.01","displayCostAsset":"USD","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"mpp","network":"tempo","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_vh5AGx1D3h-CvFPcKt8Q4","protocol":"mpp","methodType":"crypto","chain":"tempo","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":"mesh.agentdiet.dev","brandSlug":"mesh-agentdiet-dev-mpp","brandBaseUrl":"https://mesh.agentdiet.dev","brandDocsUrl":null,"whatItDoes":"Scans a GitHub repository for license risk, maintenance health, popularity signals, and dependency supply-chain vulnerabilities before integrating or executing its code.","exampleAgentPrompt":"Can you audit the langchain-ai/langgraph GitHub repo for me — I want to know its license risk, how actively it's maintained, how popular it is, and whether there are any supply-chain security concerns before I add it as a dependency?","exampleUseCases":[{"title":"Pre-integration dependency vetting","prompt":"Before I add huggingface/transformers as a dependency to our production system, can you check its GitHub repo for license compatibility, maintenance activity, and any supply-chain security red flags?"},{"title":"Open-source license compliance check","prompt":"We're building a commercial product and want to use code from the facebook/react repo — can you audit its license risk and tell me if it's safe for commercial use?"},{"title":"Evaluating an unfamiliar project before execution","prompt":"I found a tool called karpathy/nanoGPT on GitHub that I want to run locally — can you scan it for supply-chain vulnerabilities and check how well-maintained and trustworthy the repo is?"}],"resultDescription":"Returns a structured security report for the specified GitHub repository including: license type and commercial-use risk level, maintenance velocity indicators (commit frequency, last activity), community signals (stars, forks), and supply-chain security findings such as dependency vulnerabilities or suspicious package patterns.","failureModes":["Invalid repo format (not owner/name) returns a validation error","Private or non-existent repositories return a not-found or access-denied error","GitHub API rate limiting may cause intermittent failures or degraded data","Repositories with no declared license return ambiguous license risk results","Very new repos with minimal history may yield incomplete maintenance velocity signals"],"whenToPreferThis":"Choose this endpoint when an agent or developer needs to programmatically vet a GitHub repository before adopting it as a dependency, running its code, or recommending it — specifically when license risk, supply-chain security, and maintenance health are all needed in a single call. Prefer this over manual GitHub inspection or generic web search when structured, machine-readable security signal is required for automated decision-making in CI pipelines, coding agents, or procurement workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T12:50:15.969Z","isFirstParty":false,"canonicalSlug":"mesh-agentdiet-dev-github-repository-supply-chain-security-license-66fed36d"}