# Agent Trust API – npm Package Trust & Risk Score

> Agent Trust API – npm Package Trust & Risk Score is a paid API for AI agents from agent-trust-api-496e.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Returns a composite trust/risk score for an npm package by aggregating registry age, download volume, GitHub signals, and known OSV.dev vulnerabilities.

## Facts

- Endpoint: GET https://agent-trust-api-496e.onrender.com/api/trust-check
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-trust-api-npm-package-trust-risk-score-292c820e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KRmpwFYz-7k3Y9ugqwzGr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-trust-api-npm-package-trust-risk-score-292c820e
```

Example prompt: Can you check the trust score for the npm package 'left-pad' — I want to know if it's safe to add as a dependency, including any known vulnerabilities and how popular it is?

## When to prefer this

Choose this endpoint when you need a quick, multi-signal trust summary for a specific npm package without building your own aggregation pipeline. It combines npm registry metadata, GitHub reputation signals, and OSV vulnerability data into a single scored verdict — ideal for CI gates, dependency vetting workflows, or supply-chain risk dashboards. Prefer it over raw OSV.dev queries when you also need download popularity and registry age context alongside security findings.

## Known failure modes

- Unknown or misspelled package name returns an error or zero-score result
- Private/scoped packages not published on the public npm registry may not resolve
- GitHub repository not linked to the npm package results in missing GitHub signals
- OSV.dev API downtime may cause vulnerability data to be incomplete or absent
- Rate limiting or cold-start latency on the Render-hosted service may cause timeouts

## How this service works

Trust/risk score for an npm package: registry age, downloads, GitHub signals, and OSV.dev vulnerabilities.

## Output

A JSON object containing a numeric trust score (0–100), the package name, a human-readable verdict (e.g. 'reasonable', 'risky'), and a signals breakdown: npm signals (age in days, latest version, weekly downloads), GitHub signals (org, star count, creation date), and vulnerability data (list of OSV IDs and total count).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "score": 72,
  "package": "left-pad",
  "signals": {
   "npm": {
    "ageInDays": 3200,
    "latestVersion": "1.3.0",
    "weeklyDownloads": 1500000
   },
   "github": {
    "org": "left-pad",
    "isOrg": false,
    "stars": 400,
    "createdAt": "2014-01-01"
   },
   "vulnerabilities": {
    "ids": [],
    "count": 0
   }
  },
  "verdict": "reasonable"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-trust-api-npm-package-trust-risk-score-292c820e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-trust-api-496e.onrender.com](https://www.zero.xyz/host/agent-trust-api-496e.onrender.com/llms.txt)