# Bounty Engineer Release Sentinel Evidence

> Bounty Engineer Release Sentinel Evidence is a paid API for AI agents from bounty-engineer-x402-prod.onrender.com, paid per call via x402, $0.049/call, status unknown (last checked 2026-10-12).

Validates an npm package release by checking its name, version, and optional integrity hash against policy controls for vulnerability blocking, provenance, and registry signature requirements.

## Facts

- Endpoint: POST https://bounty-engineer-x402-prod.onrender.com/v1/release-sentinel-evidence?utm_source=zero.xyz
- Price: $0.049/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/bounty-engineer-release-sentinel-evidence-9d07ad29
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_oxi-XLTWCd2bsds5oKp5B

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability bounty-engineer-release-sentinel-evidence-9d07ad29 -d '<json body>'
```

Example prompt: Before we install lodash version 4.17.21, can you run a release sentinel check on it with vulnerability blocking and provenance signal required, and verify its integrity hash sha512-v2NU0D/v2NU0D==?

## When to prefer this

Choose this endpoint when an autonomous agent or CI pipeline needs a paid, policy-enforced safety gate before installing an npm package — especially when you need to combine vulnerability blocking, provenance attestation, registry signature verification, and optional SRI integrity pinning in a single call. Prefer it over manual npm audit or OSV queries when you need a structured decision signal with configurable policy controls that an agent can act on autonomously.

## Known failure modes

- Package name or version fails schema validation (minLength/maxLength constraints)
- OSV or npm registry unreachable during live verification
- Integrity hash mismatch triggers policy block
- Missing provenance signal causes rejection when require_provenance_signal is true
- Unknown or unlisted package version returns indeterminate decision
- Response may be example/illustrative-only rather than live-verified depending on fulfillment mode

## How this service works

Machine-buyable infrastructure for autonomous agents: API cost routing, margin optimization, funding-rate data, webpage extraction, result verification, spend controls, retry planning, state, tender search and GitHub bounty intelligence.

## Output

Returns a JSON object indicating whether the package passed validation, the evaluation mode, the package name and version checked, the policy decision outcome, and any warnings. In example mode the response is illustrative only; paid fulfillment runs independent npm and OSV source checks for live verification.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "maxLength": 214,
   "minLength": 1
  },
  "policy": {
   "type": "object",
   "properties": {
    "block_install_scripts": {
     "type": "boolean"
    },
    "block_on_vulnerability": {
     "type": "boolean"
    },
    "require_provenance_signal": {
     "type": "boolean"
    },
    "require_registry_signature": {
     "type": "boolean"
    }
   }
  },
  "version": {
   "type": "string",
   "maxLength": 100,
   "minLength": 5
  },
  "expected_integrity": {
   "type": "string",
   "description": "Optional pinned npm sha512 SRI from lockfile"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "mode": "release_sentinel_example",
  "name": "lodash",
  "version": "4.17.21",
  "warning": "Worked schema example, not live npm or OSV verification. Paid fulfillment runs independent source checks.",
  "decision": "illustrative_only",
  "not_live": true,
  "example_only": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/bounty-engineer-release-sentinel-evidence-9d07ad29/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bounty-engineer-x402-prod.onrender.com](https://www.zero.xyz/host/bounty-engineer-x402-prod.onrender.com/llms.txt)