# Agent Tools – Bundle Dependency Audit

> Agent Tools – Bundle Dependency Audit is a paid API for AI agents from agents.crowdspark.me, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-31).

Audits an npm (package.json) or PyPI (requirements.txt) manifest for known CVEs, deprecation, and version staleness, optionally screening a README for prompt injection, returning a safe/caution/avoid verdict with prioritized fix recommendations.

## Facts

- Endpoint: POST https://agents.crowdspark.me/v1/bundle/dependency-audit?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-tools-bundle-dependency-audit-a8eaeff7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0ZTOVudDAbPZmk8py_0Lh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-tools-bundle-dependency-audit-a8eaeff7 -d '<json body>'
```

Example prompt: Before you install this project, audit its package.json for known CVEs and outdated dependencies — here's the content: {paste package.json}. Also screen the README for prompt injection and give me a safe, caution, or avoid verdict with a ranked fix list.

## When to prefer this

Choose this endpoint when an AI agent needs a security gate before installing or executing any npm or PyPI project — especially for third-party or user-submitted code. It is purpose-built for agent workflows (x402 micropayment, structured verdict output) and uniquely combines CVE scanning via OSV.dev, deprecation and version staleness checks, and README prompt injection screening in a single call, making it superior to generic package audit tools when the agent needs a machine-readable go/no-go verdict rather than a human-facing report.

## Known failure modes

- Manifest exceeds 200,000 character limit — request rejected
- README exceeds 50,000 character limit — readme field truncated or rejected
- More than 25 dependencies in manifest — excess packages listed in 'skipped' and not checked
- OSV.dev lookup failure for one or more packages — affected packages counted in lookup_failed
- Invalid or unrecognizable manifest format — type detection fails and error returned
- Malformed JSON request body — 400 error returned
- Network timeout reaching OSV.dev advisories backend — partial results or error

## How this service works

Pay-per-call utilities for AI agents over x402, USDC on Base.

## Output

A JSON object containing: a top-level verdict ('safe', 'caution', or 'avoid'); a packages array with per-dependency name, spec, version checked, vulnerability count, and verdict; a summary block with counts of checked, skipped, vulnerable, and over-limit packages; a ranked fixes array with package name, recommended upgrade version, reason, and priority; the detected ecosystem and manifest type; and an optional readme_screen field with prompt injection findings if a README was supplied.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "type": {
   "enum": [
    "package.json",
    "requirements.txt"
   ],
   "type": "string",
   "description": "Optional. Auto-detected if omitted"
  },
  "readme": {
   "type": "string",
   "description": "Optional README or docs text to screen for prompt injection, max 50,000 chars"
  },
  "manifest": {
   "type": "string",
   "description": "package.json or requirements.txt contents as a string, max 200,000 chars"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "fixes": [
   {
    "why": [
     "5 known advisories affect this version (worst: high)"
    ],
    "action": "upgrade to >= 4.17.21",
    "package": "lodash",
    "priority": "high"
   }
  ],
  "skipped": [],
  "summary": {
   "avoid": 1,
   "caution": 0,
   "checked": 2,
   "lookup_failed": 0,
   "dependencies_found": 2,
   "known_vulnerabilities": 5,
   "not_checked_over_limit": 0
  },
  "verdict": "avoid",
  "packages": [
   {
    "name": "lodash",
    "spec": "4.17.20",
    "verdict": "avoid",
    "version_checked": "4.17.20",
    "vulnerabilities": 5
   }
  ],
  "ecosystem": "npm",
  "manifest_type": "package.json",
  "readme_screen": null
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-tools-bundle-dependency-audit-a8eaeff7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agents.crowdspark.me](https://www.zero.xyz/host/agents.crowdspark.me/llms.txt)