# Dependency Trust

> Dependency Trust is a paid API for AI agents from dep-trust.agent-utils.workers.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Analyzes npm, PyPI, crates.io, Go, and Maven packages for vulnerabilities, license risk, age, popularity, provenance, typosquatting, and returns a trust score in one call.

## Facts

- Endpoint: POST https://dep-trust.agent-utils.workers.dev/v1/packages
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-trust-bf38917b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_aXed21l-xlJVnOvwrlsWM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-trust-bf38917b -d '<json body>'
```

Example prompt: Before I add lodash@4.17.15 from npm to the project, can you check its trust score, any known vulnerabilities, license, and whether there are any typosquatting lookalikes I should worry about?

## When to prefer this

Choose this endpoint when an agent needs a single-call, cross-ecosystem package security assessment that combines vulnerability data, license compliance, popularity signals, provenance, and typosquat detection without managing multiple API keys. Ideal for CI/CD automation, agentic coding assistants vetting dependencies before installation, or security bots reviewing pull requests. Especially useful when payment is handled automatically via x402 per-call billing with no subscription overhead.

## Known failure modes

- Package not found in registry — 'found: false' returned
- Network timeout fetching from upstream registries (osv.dev, deps.dev, npmjs)
- Unsupported ecosystem specified
- Malformed package string input
- Payment failure over x402 if USDC balance is insufficient

## How this service works

Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.

## Output

A JSON report per package containing: trust score (0-100), verdict (ok/review/avoid), vulnerability list with CVSS scores and fix versions, license name and category (permissive/copyleft/etc.), maintainer count, weekly and total downloads, package age, version age, versions behind latest, deprecation status and reason, provenance attestation, typosquat analysis with lookalikes list, GitHub project stats (stars, forks, open issues, OpenSSF Scorecard), and a summary object with worst-case verdict across all queried packages.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "packages": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 2,
  "reports": [
   {
    "name": "lodash",
    "found": true,
    "yanked": false,
    "license": "MIT",
    "project": {
     "forks": 7000,
     "stars": 60000,
     "scorecard": 6.2,
     "openIssues": 120,
     "scorecardChecks": {
      "Maintained": 10,
      "Code-Review": 4
     }
    },
    "reasons": [
     "1 high-severity vulnerability(ies) affect 4.17.15",
     "2 medium-severity vulnerability(ies)",
     "single maintainer for a very widely used package (bus factor)"
    ],
    "sources": [
     "deps.dev",
     "osv.dev",
     "registry.npmjs.org",
     "api.npmjs.org"
    ],
    "verdict": "review",
    "version": "4.17.15",
    "homepage": "https://lodash.com/",
    "isLatest": false,
    "ecosystem": "npm",
    "typosquat": {
     "isPopular": true,
     "lookalikes": [],
     "suspicious": false,
     "popularRank": 34
    },
    "deprecated": false,
    "provenance": "none",
    "repository": "https://github.com/lodash/lodash",
    "trustScore": 60,
    "vulnCounts": {
     "low": 0,
     "high": 1,
     "medium": 2,
     "unknown": 0,
     "critical": 0
    },
    "generatedAt": "2026-09-06T19:00:00.000Z",
    "maintainers": 1,
    "publishedAt": "2019-07-17T19:10:23Z",
    "latestVersion": "4.18.1",
    "installScripts": [],
    "packageAgeDays": 5249,
    "totalDownloads": null,
    "versionAgeDays": 2608,
    "versionsBehind": 6,
    "licenseCategory": "permissive",
    "vulnerabilities": [
     {
      "id": "GHSA-29mw-wpgm-hmr9",
      "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
      "aliases": [
       "CVE-2020-28500"
      ],
      "fixedIn": [
       "4.17.21"
      ],
      "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
      "severity": "medium",
      "cvssScore": 5,
      "published": "2021-02-19T00:00:00Z"
     }
    ],
    "weeklyDownloads": 173745865,
    "deprecatedReason": null,
    "firstPublishedAt": "2012-04-23T16:37:12Z"
   }
  ],
  "summary": {
   "ok": [
    "pypi:requests@2.34.2"
   ],
   "avoid": [],
   "review": [
    "npm:express@4.17.1"
   ],
   "worstVerdict": "review"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-trust-bf38917b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dep-trust.agent-utils.workers.dev](https://www.zero.xyz/host/dep-trust.agent-utils.workers.dev/llms.txt)