# ah-package-check

> ah-package-check is a paid API for AI agents from x402.agentharbor.agency, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-27).

Returns vulnerability data, license, latest version, and deprecation status for open-source packages across PyPI, npm, Go, Cargo, Maven, NuGet, and RubyGems before adding or upgrading a dependency.

## Facts

- Endpoint: GET https://x402.agentharbor.agency/package-check?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ah-package-check-0ff23b9a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_r6Kfujke_8QVT82V9hKJg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ah-package-check-0ff23b9a
```

Example prompt: Before I add it to the project, can you check if the npm package lodash version 4.17.15 has any known vulnerabilities, what license it uses, and whether it's deprecated?

## When to prefer this

Use this endpoint when an AI coding agent needs a fast, pre-install safety check on a specific open-source dependency before adding or upgrading it in a project. It is ideal for catching known CVEs, verifying license compatibility, and confirming a package is not deprecated — all in a single call covering seven major ecosystems. Prefer this over raw OSV.dev or deps.dev API calls when you want a combined vulnerability + metadata + recommendation summary without stitching multiple APIs together.

## Known failure modes

- Package or version does not exist — returns a not-found response (no charge)
- Ecosystem not supported — request rejected at schema validation
- Vulnerability data may lag OSV.dev update cadence
- Private or internal packages not discoverable via public registries
- Transitive (indirect) dependencies are not analyzed — only the specified package

## How this service works

Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist.

## Output

A structured response containing: list of known vulnerabilities (OSV IDs, CVE aliases, severity ratings, fixed-in versions), the package license, latest published version, publish date, deprecation status, and a one-line human-readable recommendation on whether it is safe to use.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "maxLength": 214,
       "description": "Package name as published, e.g. requests or @types/node"
      },
      "version": {
       "type": "string",
       "maxLength": 100,
       "description": "Exact version; omit for the latest"
      },
      "ecosystem": {
       "enum": [
        "pypi",
        "npm",
        "go",
        "cargo",
        "maven",
        "nuget",
        "rubygems"
       ],
       "type": "string",
       "description": "Package registry"
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ah-package-check-0ff23b9a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.agentharbor.agency](https://www.zero.xyz/host/x402.agentharbor.agency/llms.txt)