{"uid":"cap_r6Kfujke_8QVT82V9hKJg","slug":"ah-package-check-0ff23b9a","name":"ah-package-check","description":"Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist.","url":"https://x402.agentharbor.agency/package-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","maxLength":214,"description":"Package name as published, e.g. requests or @types/node"},"version":{"type":"string","maxLength":100,"description":"Exact version; omit for the latest"},"ecosystem":{"enum":["pypi","npm","go","cargo","maven","nuget","rubygems"],"type":"string","description":"Package registry"}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_j1gISagLwHPKAffGbqkjQ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns vulnerability data, license, latest version, and deprecation status for open-source packages across PyPI, npm, Go, Cargo, Maven, NuGet, and RubyGems before adding or upgrading a dependency.","exampleAgentPrompt":"Before I add it to the project, can you check if the npm package lodash version 4.17.15 has any known vulnerabilities, what license it uses, and whether it's deprecated?","exampleUseCases":[{"title":"Pre-install vulnerability check for Python","prompt":"I'm about to pip install requests version 2.28.0 — can you check if it has any known CVEs or security issues before I add it to my requirements.txt?"},{"title":"License audit before shipping","prompt":"We're about to ship a new feature that uses the npm package axios — can you look up its license and tell me if there are any vulnerabilities or deprecation warnings I should know about?"},{"title":"Safe upgrade path for a Go module","prompt":"I need to upgrade golang.org/x/crypto in my Go project — can you check what the latest version is, whether the version I'm on has any known vulnerabilities, and what version fixes them?"}],"resultDescription":"A structured response containing: list of known vulnerabilities (OSV IDs, CVE aliases, severity ratings, fixed-in versions), the package license, latest published version, publish date, deprecation status, and a one-line human-readable recommendation on whether it is safe to use.","failureModes":["Package or version does not exist — returns a not-found response (no charge)","Ecosystem not supported — request rejected at schema validation","Vulnerability data may lag OSV.dev update cadence","Private or internal packages not discoverable via public registries","Transitive (indirect) dependencies are not analyzed — only the specified package"],"whenToPreferThis":"Use this endpoint when an AI coding agent needs a fast, pre-install safety check on a specific open-source dependency before adding or upgrading it in a project. It is ideal for catching known CVEs, verifying license compatibility, and confirming a package is not deprecated — all in a single call covering seven major ecosystems. Prefer this over raw OSV.dev or deps.dev API calls when you want a combined vulnerability + metadata + recommendation summary without stitching multiple APIs together.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T12:57:10.316Z","isFirstParty":false,"canonicalSlug":"ah-package-check-0ff23b9a"}