# Dependency Provenance Assessment

> Dependency Provenance Assessment is a paid API for AI agents from phion.systems, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Checks declared software dependencies for identity integrity, source authenticity, and cryptographic digest coverage

## Facts

- Endpoint: POST https://phion.systems/v1/paid/trust/dependency-provenance-assessment
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-provenance-assessment-4d431928
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_e6JLvJmllTS_nH1BVQ1ox

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-provenance-assessment-4d431928 -d '<json body>'
```

Example prompt: Can you check the provenance of the dependencies listed in our project manifest — I need to know which ones have verified identity, confirmed source origins, and cryptographic digest coverage?

## When to prefer this

Choose this endpoint when you need a focused, machine-verifiable attestation of whether software dependencies have proper identity, traceable source origins, and cryptographic digest coverage — particularly in CI/CD pipelines, software release gates, or supply chain audits. Prefer this over general vulnerability scanners when the concern is provenance and attestation integrity rather than known CVEs.

## Known failure modes

- Missing or malformed dependency declarations in the input payload result in validation errors
- Dependencies referencing private or inaccessible registries may yield incomplete source coverage
- Unrecognized package ecosystems may reduce assessment coverage
- Stale or unsupported digest algorithms may be flagged as insufficient coverage
- Service may return partial results if upstream provenance data sources are unavailable

## How this service works

Check declared dependency identity, source and digest coverage

## Output

Returns a structured assessment of declared dependency provenance, including: identity verification status (whether the declared package identity is confirmed), source coverage (whether dependencies trace to verifiable, authentic sources), and digest coverage (whether cryptographic digests are present and valid for all declared dependencies), along with any gaps or failures detected.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-provenance-assessment-4d431928/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from phion.systems](https://www.zero.xyz/host/phion.systems/llms.txt)