# Annalist Package Watch

> Annalist Package Watch is a paid API for AI agents from api.annalist.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-21).

Monitors the top 8,000 packages on npm, PyPI, crates.io, and Go for supply-chain risk events such as new publisher releases, maintainer changes, install scripts added, provenance dropped, and retractions over a configurable time window.

## Facts

- Endpoint: GET https://api.annalist.dev/v1/packages/watch?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/annalist-package-watch-2c9cec4d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_q1BCvODgXsG-Fy3BG1VUY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability annalist-package-watch-2c9cec4d
```

Example prompt: Pull the Annalist package watch feed for npm over the last 14 days and show me any packages that had maintainer changes, new publisher releases, or install scripts added.

## When to prefer this

Use this endpoint when you need a broad, curated watch over the most-used packages across one or all major ecosystems for supply-chain risk signals. Prefer it over manual package registry polling because it covers the top 8,000 packages per ecosystem, delivers signed data suitable for agent pipelines, and aggregates multiple risk event types (maintainer changes, provenance drops, install scripts, retractions) in one call. Ideal for security agents running daily or weekly briefings, CI/CD pipelines checking for new risks in dependencies, or any system that needs tamper-evident supply-chain intelligence.

## Known failure modes

- Invalid 'days' value outside 1–30 range returns an error
- Invalid 'ecosystem' enum value returns a validation error
- Payment failure via x402 protocol blocks the response
- Upstream data lag may cause recent events (last few hours) to be missing
- Rate limiting if many calls are made in rapid succession

## How this service works

Supply-chain watch across the 8,000 most-used packages on each of npm, PyPI, crates.io and Go, newest first: releases by a new publisher account, maintainer and owner changes, install scripts added, provenance dropped, source repositories moved, retractions, deprecations and yanks, with counts, for the last 1 to 30 days (days=, default 7), for one ecosystem or all. Signed.

## Output

A signed JSON response listing supply-chain risk events for the top 8,000 packages on the requested ecosystem(s), newest first. Each event includes the package name, event type (e.g. new publisher, maintainer change, install script added, provenance dropped, repo moved, retraction, deprecation, yank), and counts, scoped to the requested day window (1–30 days, default 7). Response is cryptographically signed for agent verification.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "days": {
       "type": "string",
       "description": "1 to 30 (default 7)"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "crates",
        "go"
       ],
       "type": "string"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/annalist-package-watch-2c9cec4d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.annalist.dev](https://www.zero.xyz/host/api.annalist.dev/llms.txt)