{"uid":"cap_oYoESJyz_PcacCqrFeJuV","slug":"safe-upgrade-decision-api-cf8e7a48","name":"Safe Upgrade Decision API","description":"Evidence-backed npm package upgrade decisions for coding agents.","url":"https://x402-safe-upgrade-api.onrender.com/v1/package-risk","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"version":{"type":"string","description":"Exact version to analyze; omit for latest."},"packageName":{"type":"string","description":"Exact npm package name."}}},"responseSchema":{"type":"json","example":{"risk":{"score":55,"signals":[{"id":"install-scripts","detail":"Runs code at install time via postinstall.","weight":25}],"verdict":"medium"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__17g63pLGYLUbAMMI0ROJ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes an npm package (and optional version) for security and supply-chain risk signals, returning a scored verdict to help coding agents decide whether to approve an upgrade.","exampleAgentPrompt":"Before we merge this PR, can you check the risk score for upgrading to `axios` version 1.7.2 on npm — I want to know if it runs install scripts or has any other supply chain red flags?","exampleUseCases":[{"title":"CI gate for dependency upgrades","prompt":"We have a Dependabot PR bumping `minimist` to 1.2.8 — can you run a risk check on that exact version and tell me if it's safe to auto-merge or if there are supply chain concerns I should review?"},{"title":"Vetting a new third-party library","prompt":"I'm about to add `node-fetch` version 3.3.2 to our project — can you give me its risk score and flag anything suspicious like postinstall scripts or known malicious signals before I approve it?"},{"title":"Automated security triage in agent pipeline","prompt":"For each npm package in this upgrade list, starting with `chalk` version 5.3.0, pull a risk score and verdict so our agent can decide which ones need a human security review."}],"resultDescription":"Returns a JSON object containing a numeric risk score (0–100), a verdict string (e.g. 'low', 'medium', 'high'), and an array of risk signals each with an ID, human-readable detail, and a numeric weight indicating how much it contributed to the score.","failureModes":["Unknown or misspelled package name returns an error or empty result","Requesting a non-existent version may return a 404 or error response","Payment failure (insufficient USDC balance) blocks the request with a 402 status","Rate limiting or service unavailability on the hosted Render instance may cause timeouts","Packages with no registry metadata may produce incomplete signal sets"],"whenToPreferThis":"Choose this endpoint when a coding agent or CI/CD pipeline needs a fast, evidence-backed go/no-go signal on an npm package upgrade, especially when supply chain attacks (e.g. malicious postinstall scripts, typosquatting) are a concern. Prefer it over manual npm audit or Snyk when you need a lightweight, pay-per-call risk score that integrates directly into an automated agent workflow without requiring OAuth or subscription setup.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T17:29:12.676Z","isFirstParty":false}