{"uid":"cap_rdQYN1K22J-zcsd4P-trS","slug":"freshdep-github-dependency-age-scanner-e4c7d85f","name":"FreshDep GitHub Dependency Age Scanner","description":"Decision-grade security/due-diligence outcome reports ($20-$100) plus deterministic paid utilities ($0.001+) for software agents and automated workflows.","url":"https://api.bakhour.ca/freshdep/scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"ref":{"type":"string","description":"Optional branch/tag to check out instead of the default branch."},"repo_url":{"type":"string","description":"Full https://github.com/<owner>/<repo> URL to scan."},"threshold_days":{"type":"number","description":"Flag anything published more recently than this many days ago. Defaults to 7."}}},"responseSchema":{"type":"json","example":{"errors":[],"flagged":[{"name":"some-package","flagged":true,"version":"3.1.4","age_days":0.6,"ecosystem":"pypi"}],"repo_url":"https://github.com/octocat/Hello-World","flagged_count":1,"threshold_days":7,"lockfiles_checked":["requirements.txt"],"dependencies_checked":42,"dependencies_truncated":false}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"25","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$25/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"25","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"25","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Qy2yTWX9q4mDm5uioqGYf","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"25","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a GitHub repository's lockfiles for recently-published dependencies that may indicate a supply-chain or freshness risk, flagging any package published within a configurable number of days.","exampleAgentPrompt":"Can you scan https://github.com/acme/backend-api for any dependencies published in the last 7 days — I want to know if anything suspiciously fresh snuck into the lockfiles?","exampleUseCases":[{"title":"Pre-merge supply chain check","prompt":"Before we merge this PR, can you scan https://github.com/myorg/payments-service and flag any packages published within the last 3 days? I want to catch any freshly released dependencies that could be risky."},{"title":"CI due diligence on new open source dependency","prompt":"We're about to add a third-party library to our project at https://github.com/myorg/data-pipeline — can you check whether any of the existing dependencies in that repo were released super recently, say within the last 14 days?"},{"title":"Nightly freshness audit for security team","prompt":"Run a dependency freshness scan on https://github.com/myorg/api-gateway using the main branch and flag anything published in the last 7 days — I need a summary for our security review tomorrow."}],"resultDescription":"Returns a JSON object listing all flagged dependencies (those published more recently than the threshold), including each package's name, version, ecosystem, and age in days, plus summary counts of how many lockfiles and total dependencies were checked and whether results were truncated.","failureModes":["Repository not found or inaccessible (private repo without credentials)","No lockfile detected in the repository (no supported dependency files found)","Invalid or malformed GitHub URL supplied","Network timeout fetching repository contents","Package registry lookup failure preventing age determination","Repository has no dependencies to check"],"whenToPreferThis":"Choose this endpoint when you need a fast, automated signal on whether a GitHub repository's declared dependencies include suspiciously fresh package releases — particularly useful in CI pipelines, pre-merge security gates, or vendor due-diligence workflows where detecting supply chain attacks via newly hijacked or malicious package versions matters. Prefer it over general vulnerability scanners (e.g. Snyk, Dependabot) when the specific concern is recency/freshness rather than known CVEs.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:41:53.941Z","isFirstParty":false}