# AgentUtility Dependency Risk Summary > AgentUtility Dependency Risk Summary is a paid API for AI agents from x402.agentutility.ai, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-13). Analyzes a GitHub repository's dependency files to produce a supply-chain risk score, findings, and actionable recommendations ## Facts - Endpoint: POST https://x402.agentutility.ai/dep-risk-summary - Price: $0.03/call - Payment: x402 - Status: unknown - Last checked: 2026-09-13 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/agentutility-dependency-risk-summary-0c7d8752 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3onrdSDEby7UEC_8shvJW Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability agentutility-dependency-risk-summary-0c7d8752 -d '' ``` Example prompt: Can you give me a dependency risk summary for the GitHub repo rooz21/prooflayer-fixtures on the main branch — I want to know the risk score, whether there's a lockfile, and which packages are the biggest supply-chain risks? ## When to prefer this Use this endpoint when you need a quick, pay-per-call supply-chain risk assessment for a specific GitHub repository without setting up your own dependency scanning infrastructure. It is particularly well-suited for AI agents that need to programmatically audit OSS dependencies, check lockfile hygiene, or flag unpinned/deprecated packages as part of a CI or due-diligence workflow. Prefer this over generic vulnerability scanners when you want structured JSON output with severity-tagged findings and a composite risk score. ## Known failure modes - Repository not found or inaccessible — returns error with repo/branch not found message - Invalid or missing repo parameter — returns validation error - GitHub API rate limit exceeded — returns upstream rate limit error - Branch does not exist — returns branch not found error - No dependency files detected in repo — returns empty or minimal findings - Network timeout reaching GitHub — returns timeout error ## How this service works Paid x402 endpoints organized into product clusters. USDC-settled on Base. MCP-callable. ERC-8004 identity registry agentId 47167. ## Output Returns a JSON object containing: a numeric risk score (0-100), a risk_level string (e.g. 'medium'), a human-readable summary, an array of findings each with kind, path, evidence, severity, and recommendation fields, a signals object with ecosystem type, dep counts, lockfile presence, unpinned/deprecated dep counts, and top-3 risk leader packages, plus metadata about the repo, branch, files scanned, and files fetched. ## Request schema (JSON Schema) ```json { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "input": { "type": "object", "properties": { "type": { "type": "string", "const": "http" }, "method": { "type": "string", "enum": [ "POST" ] }, "bodyType": { "type": "string", "enum": [ "json", "form-data", "text" ] }, "body": { "oneOf": [ { "type": "object", "properties": { "repo": { "type": "string", "description": "GitHub repo in 'owner/name' format" }, "branch": { "type": "string", "description": "Optional branch; defaults to repo's default_branch" } }, "required": [ "repo" ] }, { "type": "object", "properties": { "files": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string" }, "content": { "type": "string" } }, "required": [ "path", "content" ] } } }, "required": [ "files" ] } ] } }, "required": [ "type", "method", "bodyType", "body" ], "additionalProperties": false }, "output": { "type": "object", "properties": { "type": { "type": "string" }, "example": { "type": "object", "properties": { "score": { "type": "integer" }, "risk_level": { "type": "string" }, "findings": { "type": "array", "items": { "type": "object", "properties": { "kind": { "type": "string" }, "severity": { "type": "string" }, "path": { "type": "string" }, "evidence": { "type": "string" }, "recommendation": { "type": "string" } } } }, "signals": { "type": "object", "properties": { "ecosystem": { "type": "string" }, "direct_dep_count": { "type": "integer" }, "peer_dep_count": { "type": "integer" }, "optional_dep_count": { "type": "integer" }, "unpinned_dep_count": { … (truncated) ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "score": 30, "signals": { "ecosystem": "js", "fanout_failed": 0, "legacy_runtime": { "node_engines": null, "python_requires": null }, "peer_dep_count": 0, "direct_dep_count": 5, "fanout_attempted": 5, "fanout_succeeded": 5, "lockfile_present": false, "optional_dep_count": 0, "unpinned_dep_count": 3, "deprecated_dep_count": 0, "total_transitive_deps": null, "install_script_dep_count": 0, "top_3_risk_leader_packages": [] }, "summary": "package.json has 3 unpinned deps and no lockfile — supply-chain drift risk.", "findings": [ { "kind": "lockfile_missing", "path": "package.json", "evidence": "package.json found but no lockfile", "severity": "medium", "recommendation": "Commit a lockfile to pin transitive deps." }, { "kind": "unpinned_dependency", "path": "package.json", "evidence": "lodash: \"^4.17.21\"", "severity": "low", "recommendation": "Pin lodash to an exact version for reproducible builds." } ], "metadata": { "repo": "rooz21/prooflayer-fixtures", "branch": "main", "files_scanned": 1, "files_fetched_via_api": 8 }, "risk_level": "medium" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentutility-dependency-risk-summary-0c7d8752/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from x402.agentutility.ai](https://www.zero.xyz/host/x402.agentutility.ai/llms.txt)