# Dependency Risk Preflight

> Dependency Risk Preflight is a paid API for AI agents from dependency-risk-preflight.dependency-risk-preflight.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-10).

Checks a single npm or PyPI package+version for vulnerabilities, CISA KEV status, deprecation, license, and yanked releases, returning a PASS/WARN/BLOCK/UNKNOWN verdict before install or upgrade.

## Facts

- Endpoint: POST https://dependency-risk-preflight.dependency-risk-preflight.workers.dev/v1/dependency/preflight?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-risk-preflight-4dc6b2d6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3EcIE_1gQ09c-abPYZacA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-risk-preflight-4dc6b2d6 -d '<json body>'
```

Example prompt: Before I install lodash version 4.17.15 from npm, run a security preflight check — look up any known vulnerabilities, check if it's on the CISA exploited list, and tell me if it's deprecated or has a bad license, then give me a PASS or BLOCK verdict.

## When to prefer this

Use this endpoint when an autonomous coding agent, CI pipeline, or package-update bot needs a deterministic, single-call safety gate before installing or upgrading any npm or PyPI dependency. It is purpose-built for agentic workflows, combining OSV vulnerabilities, CISA KEV known-exploit status, and registry metadata (deprecation, license, yanked releases) into one structured verdict — eliminating the need to stitch together multiple security APIs yourself. Prefer it over generic vulnerability scanners when you need a machine-readable PASS/WARN/BLOCK/UNKNOWN verdict with reason codes that an agent can act on without further parsing.

## Known failure modes

- Package or version not found in registry — verdict returns UNKNOWN with appropriate reason code
- OSV or CISA KEV source unavailable — sources array shows checked:false, verdict may be UNKNOWN
- Invalid ecosystem value — request rejected with validation error
- Malformed or missing package/version fields — returns error response
- Network timeout to upstream data sources — partial results with unavailable source flags

## How this service works

Deterministic npm/PyPI dependency vulnerability preflight for a single package+version -- a package security check before install/update. Checks OSV.dev vulnerabilities, the CISA Known Exploited Vulnerabilities catalog, and registry deprecation/license/yanked-release metadata in one call, returning a PASS/WARN/BLOCK/UNKNOWN verdict with reason codes. Built for autonomous coding agents and CI/package-update agents to call before installing or upgrading a dependency.

## Output

Returns a JSON object with a top-level verdict (PASS, WARN, BLOCK, or UNKNOWN), an array of reason_codes explaining the verdict, a list of vulnerabilities with IDs, aliases, severity, fixed versions, and known_exploited flag, a recommended_version pointing to the lowest version resolving all findings, registry metadata (deprecated, yanked, deprecation_message), license info with SPDX status, and a checked_at timestamp with source availability for OSV, CISA KEV, and the registry.

## Request schema (JSON Schema)

```json
{
 "input": {
  "type": "object",
  "required": [
   "ecosystem",
   "package",
   "version"
  ],
  "properties": {
   "package": {
    "type": "string",
    "maxLength": 214,
    "minLength": 1
   },
   "version": {
    "type": "string",
    "maxLength": 100,
    "minLength": 1
   },
   "ecosystem": {
    "enum": [
     "npm",
     "PyPI"
    ],
    "type": "string",
    "description": "Case-sensitive."
   }
  },
  "additionalProperties": false
 },
 "output": {
  "type": "object",
  "required": [
   "schema_version",
   "request",
   "verdict",
   "reason_codes",
   "vulnerabilities",
   "checked_at"
  ],
  "properties": {
   "verdict": {
    "enum": [
     "PASS",
     "WARN",
     "BLOCK",
     "UNKNOWN"
    ],
    "type": "string"
   },
   "reason_codes": {
    "type": "array",
    "items": {
     "type": "string"
    }
   },
   "schema_version": {
    "type": "string",
    "const": "1"
   },
   "recommended_version": {
    "type": [
     "string",
     "null"
    ]
   },
   "vulnerability_count": {
    "type": "integer"
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "example": {
  "license": {
   "raw": "MIT",
   "source": "npm-registry",
   "status": "known",
   "spdx_validated": false
  },
  "request": {
   "package": "lodash",
   "version": "4.17.15",
   "ecosystem": "npm"
  },
  "sources": [
   {
    "name": "OSV",
    "status": "available",
    "checked": true
   },
   {
    "name": "CISA_KEV",
    "status": "available",
    "checked": true,
    "catalog_version": "2026.08.11"
   },
   {
    "name": "NPM_REGISTRY",
    "status": "available",
    "checked": true
   }
  ],
  "verdict": "WARN",
  "registry": {
   "exists": true,
   "deprecated": false,
   "project_status": null,
   "release_yanked": null,
   "deprecation_message": null
  },
  "checked_at": "2026-08-13T00:00:00.000Z",
  "reason_codes": [
   "MODERATE_VULNERABILITY"
  ],
  "schema_version": "1",
  "vulnerabilities": [
   {
    "id": "GHSA-example-0000",
    "aliases": [
     "CVE-2020-28500"
    ],
    "severity": "MODERATE",
    "fixed_versions": [
     "4.17.21"
    ],
    "known_exploited": false
   }
  ],
  "recommended_version": "4.17.21",
  "vulnerability_count": 1,
  "recommended_version_basis": "lowest version resolving all known findings",
  "vulnerabilities_truncated": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-risk-preflight-4dc6b2d6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dependency-risk-preflight.dependency-risk-preflight.workers.dev](https://www.zero.xyz/host/dependency-risk-preflight.dependency-risk-preflight.workers.dev/llms.txt)