# Dependency Risk Scanner

> Dependency Risk Scanner is a paid API for AI agents from i3p3mgbsn54dvlivnk6wbumal40eqtsn.lambda-url.us-east-1.on.aws, paid per call via x402, $0.35/call, status unknown (last checked 2026-10-10).

Inspects dependency manifests for missing versions, risky install scripts, unknown licenses, and policy violations without requiring a live CVE database.

## Facts

- Endpoint: POST https://i3p3mgbsn54dvlivnk6wbumal40eqtsn.lambda-url.us-east-1.on.aws/v1/dependency-risk-scanner?utm_source=zero.xyz
- Price: $0.35/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-risk-scanner-26893b69
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_SO7TMpI2R1ZJzZwhvs8xk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-risk-scanner-26893b69 -d '<json body>'
```

Example prompt: Scan this package.json for dependency risks — flag any missing version pins, suspicious install scripts, unknown or risky licenses, and policy violations: {paste manifest content here}.

## When to prefer this

Choose this endpoint when you need fast, static analysis of a dependency manifest for structural issues (unpinned versions, install scripts, license clarity, policy) rather than a live CVE or vulnerability database lookup. Ideal for CI/CD gates, pre-merge checks, and compliance audits where you want deterministic, policy-based risk signals without external database latency or cost.

## Known failure modes

- Malformed or unparseable manifest content returns a validation error
- Unsupported manifest format (e.g. exotic package managers) may yield incomplete results
- Very large manifests may hit payload size limits
- Unknown licenses flagged as 'unknown' rather than definitively safe or unsafe
- No live CVE data — does not detect known vulnerability IDs

## How this service works

Inspect dependency manifests for missing versions, risky install scripts, unknown licenses, and policy issues without claiming to replace a live CVE database.

## Output

Returns a structured list of risk findings per dependency, including flags for missing or unpinned versions, detected risky install scripts, unrecognized or policy-violating licenses, and general policy issues — without claiming to be a live CVE vulnerability database.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-risk-scanner-26893b69/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from i3p3mgbsn54dvlivnk6wbumal40eqtsn.lambda-url.us-east-1.on.aws](https://www.zero.xyz/host/i3p3mgbsn54dvlivnk6wbumal40eqtsn.lambda-url.us-east-1.on.aws/llms.txt)