{"uid":"cap_oxi-XLTWCd2bsds5oKp5B","slug":"bounty-engineer-release-sentinel-evidence-9d07ad29","name":"Bounty Engineer Release Sentinel Evidence","description":"Machine-buyable infrastructure for autonomous agents: API cost routing, margin optimization, funding-rate data, webpage extraction, result verification, spend controls, retry planning, state, tender search and GitHub bounty intelligence.","url":"https://bounty-engineer-x402-prod.onrender.com/v1/release-sentinel-evidence?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string","maxLength":214,"minLength":1},"policy":{"type":"object","properties":{"block_install_scripts":{"type":"boolean"},"block_on_vulnerability":{"type":"boolean"},"require_provenance_signal":{"type":"boolean"},"require_registry_signature":{"type":"boolean"}}},"version":{"type":"string","maxLength":100,"minLength":5},"expected_integrity":{"type":"string","description":"Optional pinned npm sha512 SRI from lockfile"}}},"responseSchema":{"type":"json","example":{"ok":true,"mode":"release_sentinel_example","name":"lodash","version":"4.17.21","warning":"Worked schema example, not live npm or OSV verification. Paid fulfillment runs independent source checks.","decision":"illustrative_only","not_live":true,"example_only":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.049","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.049/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.049","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.049","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_6dg8i5G9Yw4pSwQrv7UVt","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.049","costPer":"request","priority":0,"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates an npm package release by checking its name, version, and optional integrity hash against policy controls for vulnerability blocking, provenance, and registry signature requirements.","exampleAgentPrompt":"Before we install lodash version 4.17.21, can you run a release sentinel check on it with vulnerability blocking and provenance signal required, and verify its integrity hash sha512-v2NU0D/v2NU0D==?","exampleUseCases":[{"title":"Pre-install vulnerability gate in CI","prompt":"We're about to install express version 4.18.2 in our pipeline — can you check it against the release sentinel with block_on_vulnerability and require_provenance_signal both enabled before we proceed?"},{"title":"Lockfile integrity pinning check","prompt":"Verify that react version 18.2.0 matches the expected SRI integrity hash sha512-abc123XYZ== from our lockfile, and flag it if the registry signature is missing."},{"title":"Agent dependency safety audit","prompt":"My autonomous agent is about to pull in axios version 1.4.0 as a dependency — run it through the release sentinel with all policy checks enabled so I know it's safe to use."}],"resultDescription":"Returns a JSON object indicating whether the package passed validation, the evaluation mode, the package name and version checked, the policy decision outcome, and any warnings. In example mode the response is illustrative only; paid fulfillment runs independent npm and OSV source checks for live verification.","failureModes":["Package name or version fails schema validation (minLength/maxLength constraints)","OSV or npm registry unreachable during live verification","Integrity hash mismatch triggers policy block","Missing provenance signal causes rejection when require_provenance_signal is true","Unknown or unlisted package version returns indeterminate decision","Response may be example/illustrative-only rather than live-verified depending on fulfillment mode"],"whenToPreferThis":"Choose this endpoint when an autonomous agent or CI pipeline needs a paid, policy-enforced safety gate before installing an npm package — especially when you need to combine vulnerability blocking, provenance attestation, registry signature verification, and optional SRI integrity pinning in a single call. Prefer it over manual npm audit or OSV queries when you need a structured decision signal with configurable policy controls that an agent can act on autonomously.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:47:55.827Z","isFirstParty":false,"canonicalSlug":"bounty-engineer-release-sentinel-evidence-9d07ad29"}