# Dependency Gate – Package Security & License Policy Check

> Dependency Gate – Package Security & License Policy Check is a paid API for AI agents from x402-canary.nicolas-x402-16f380a7.workers.dev, paid per call via x402, $0.015/call, status unknown (last checked 2026-09-14).

Validates npm and PyPI packages against vulnerability databases and license policies, returning an ALLOW/DENY decision for each package and the set as a whole.

## Facts

- Endpoint: POST https://x402-canary.nicolas-x402-16f380a7.workers.dev/v1/agent/dependency-gate
- Price: $0.015/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-gate-package-security-license-policy-check-c4faead2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2eKkctjBNgYXJTlP_7e-8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-gate-package-security-license-policy-check-c4faead2 -d '<json body>'
```

Example prompt: Before I add these packages to my project, check whether hono@4.13.2 (npm) is safe to install — block it if it has any direct vulnerabilities and deny anything with a GPL or AGPL license.

## When to prefer this

Use this endpoint when a coding agent needs a deterministic, policy-enforceable ALLOW/DENY decision on npm or PyPI packages backed by live vulnerability (OSV.dev) and metadata (deps.dev) data. Prefer it over manual npm audit or Snyk when you need a structured JSON gate result within an automated agent workflow, especially when license policy enforcement is also required.

## Known failure modes

- Package not found in registry – returns error or DENY for that package
- Version string not resolvable – unrecognized version may cause lookup failure
- Exceeds maxItems limit (5 packages per call) – request rejected with validation error
- Unsupported ecosystem value – must be 'npm' or 'pypi'
- Upstream deps.dev or OSV.dev unavailable – may return degraded or error response
- Payment not included or insufficient – x402 payment required at $0.015 USDC per call

## How this service works

Free need-to-tool routing plus pay-per-call npm docs and TypeScript API signatures, npm breaking-change diffs, JavaScript-rendered browser snapshots and deterministic coding-agent checks via AgentCash/x402.

## Output

Returns a top-level ALLOW or DENY decision, an install_allowed boolean, and per-package details including resolved version, vulnerability count, and individual ALLOW/DENY decisions, sourced from deps.dev and OSV.dev.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "policy": {
   "type": "object",
   "properties": {
    "denied_licenses": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "maxItems": 20
    },
    "fail_on_deprecated": {
     "type": "boolean",
     "default": false
    },
    "block_on_any_direct_vulnerability": {
     "type": "boolean",
     "default": true
    }
   },
   "additionalProperties": false
  },
  "packages": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "ecosystem",
     "name"
    ],
    "properties": {
     "name": {
      "type": "string",
      "maxLength": 214
     },
     "version": {
      "type": "string",
      "maxLength": 100
     },
     "ecosystem": {
      "enum": [
       "npm",
       "pypi"
      ],
      "type": "string"
     }
    },
    "additionalProperties": false
   },
   "example": [
    {
     "name": "hono",
     "version": "4.13.2",
     "ecosystem": "npm"
    }
   ],
   "maxItems": 5,
   "minItems": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "decision": "ALLOW",
   "packages": [
    {
     "name": "hono",
     "decision": "ALLOW",
     "ecosystem": "npm",
     "resolved_version": "4.13.2",
     "vulnerability_count": 0
    }
   ],
   "provenance": [
    "deps.dev v3",
    "OSV.dev v1"
   ],
   "package_count": 1,
   "install_allowed": true
  },
  "meta": {
   "engine": "dependency-gate"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-gate-package-security-license-policy-check-c4faead2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-canary.nicolas-x402-16f380a7.workers.dev](https://www.zero.xyz/host/x402-canary.nicolas-x402-16f380a7.workers.dev/llms.txt)