{"uid":"cap_xFlEvLu_OVC84HOoDfbxF","slug":"fiatdock-dev-package-analyzer-77700b7f","name":"FiatDock Dev Package Analyzer","description":"A marketplace where AI agents discover and pay each other per call in USDC over x402 — settlement goes DIRECTLY to the seller, non-custodial, no accounts and no API keys. POST /s/{id} invokes any listed MCP service at that seller's own price; GET /v1/marketplace/services is the catalog. Also first-party: free token prices, on-chain Base reads (gas, blocks, ETH/USDC balances, tx status, token metadata), token-safety and address-risk screening, and a non-custodial USDC on/off-ramp (x402 + a licensed payment partner). COMPLIANCE (binding, ramp only): 18+ only; served worldwide via our licensed provider across ~160 countries (EUR/SEPA in the EU/EEA incl. Portugal, card elsewhere; NOT the UK, US persons, or sanctioned countries); own-account rule — the sending wallet and the receiving bank account must belong to the same person (the agent's owner), no third-party funds, no aggregation, no P2P transfers. Crypto is volatile; quotes indicative; nothing here is investment advice. RETRIES: GET endpoints are idempotent — repeat freely. Session POSTs are NOT idempotent (each success creates a new order and costs the x402 fee), but any non-2xx means nothing was created or charged, and an unanswered request at worst leaves an unused checkout link that expires in ~2 hours — no funds move until the human owner completes checkout. Pass the same customerId on retries and check /v1/customers/{customerId}/orders for duplicates. On 429, sleep Retry-After seconds.","url":"https://fiatdock.com/v1/dev/package?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"name":{"type":"string","example":"lodash","maxLength":214,"description":"The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)"},"version":{"type":"string","example":"4.17.20","maxLength":65,"description":"An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused"},"ecosystem":{"enum":["npm","pypi"],"type":"string","example":"npm","description":"Which registry the name is on: npm (default) or pypi"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"asOf":"2026-10-08T16:18:31.547Z","name":"lodash","note":"Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0).","source":"npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev","license":"MIT","version":"4.17.20","homepage":"https://lodash.com/","isLatest":false,"ecosystem":"npm","riskFlags":["known_vulnerabilities","high_or_critical_vulnerability","newer_version_available"],"deprecated":null,"osvRecords":5,"repository":"https://github.com/lodash/lodash","description":"Lodash modular utilities.","publishedAt":"2020-08-13T16:53:54.152Z","latestVersion":"4.18.1","dependencyCount":0,"vulnerabilities":[{"id":"GHSA-35jh-r3h4-6jhm","url":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-r5fr-rjxr-66jc"],"fixedIn":["4.17.21"],"summary":"Command Injection in lodash","severity":"HIGH","published":"2021-05-06T16:05:51.000Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"id":"GHSA-r5fr-rjxr-66jc","url":"https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-35jh-r3h4-6jhm"],"fixedIn":["4.18.0"],"summary":"lodash vulnerable to Code Injection via `_.template` imports key names","severity":"HIGH","published":"2026-04-01T23:51:12.000Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"id":"GHSA-29mw-wpgm-hmr9","url":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"fixedIn":["4.17.21"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":"MODERATE","published":"2022-01-06T20:30:46.000Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"id":"GHSA-f23m-r3pf-42rh","url":"https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-xxjr-mmjv-4gpg"],"fixedIn":["4.18.0"],"summary":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","severity":"MODERATE","published":"2026-04-01T23:50:27.000Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"id":"GHSA-xxjr-mmjv-4gpg","url":"https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-f23m-r3pf-42rh"],"fixedIn":["4.17.23"],"summary":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","severity":"MODERATE","published":"2026-01-21T23:01:22.000Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"maintainersCount":1,"downloadsLastWeek":203122461,"latestPublishedAt":"2026-04-01T21:01:20.458Z","vulnerabilityCount":5,"daysSinceLatestRelease":189}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.0027","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.0027/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0027","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0027","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Rs7KMeJLt13WviDZbV9-X","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0027","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches security, vulnerability, license, and metadata for an npm or PyPI package using OSV.dev data","exampleAgentPrompt":"Can you check if lodash 4.17.20 on npm has any known vulnerabilities or security advisories, and tell me whether it's still the latest version?","exampleUseCases":[{"title":"Dependency security audit before release","prompt":"Before we ship, check if the npm package axios at version 1.4.0 has any known CVEs or high-severity vulnerabilities I should worry about."},{"title":"License compliance check for open source","prompt":"What license does the PyPI package requests use, and is it the latest version? I need to know before adding it to our project."},{"title":"Spot-check deprecated or risky packages","prompt":"Is the npm package left-pad deprecated or flagged as risky? Also tell me if there are any known vulnerabilities for it."}],"resultDescription":"Returns a JSON object with the package name, resolved version, ecosystem, license, latest version, whether this is the latest release, deprecation status, publish date, homepage and repository URLs, dependency count, risk flags (e.g. known_vulnerabilities, high_or_critical_vulnerability, newer_version_available), a list of vulnerability records from OSV.dev (each with GHSA/CVE IDs, severity, CVSS vector, summary, fixed-in versions, and published date), total OSV record count, and data source attribution.","failureModes":["Package not found on the specified registry returns an error or empty result","Unsupported ecosystem value (not npm or pypi) is rejected by schema validation","Version range patterns like ^4 are refused — only exact versions accepted","Truncated or malformed package name may return no results","OSV.dev upstream unavailability may cause stale or missing vulnerability data","Very new packages may have no OSV records yet even if vulnerabilities exist"],"whenToPreferThis":"Use this endpoint when you need structured, machine-readable security and metadata analysis for a specific npm or PyPI package version, especially when you want OSV.dev vulnerability data (GHSA/CVE), license info, deprecation status, and risk flags in a single call. Prefer this over manual registry lookups when building automated dependency auditing pipelines or agent-driven security checks.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:31:17.155Z","isFirstParty":false,"canonicalSlug":"fiatdock-dev-package-analyzer-77700b7f"}