# Dependency Trust Package Safety Check

> Dependency Trust Package Safety Check is a paid API for AI agents from dep-trust.agent-utils.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Returns a comprehensive trust score, vulnerability report, license info, typosquat detection, and provenance data for a package across npm, PyPI, crates.io, Go, and Maven ecosystems.

## Facts

- Endpoint: GET https://dep-trust.agent-utils.workers.dev/v1/package
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-trust-package-safety-check-15f2d21b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KxqduIvH8QFOgG9Ed9b0i

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-trust-package-safety-check-15f2d21b
```

Example prompt: Before we install lodash version 4.17.15 from npm, can you check if it's safe — look up its vulnerabilities, trust score, license, and whether it might be a typosquat?

## When to prefer this

Choose this endpoint when you need a holistic, multi-signal trust assessment of an open-source package before installation or dependency approval — especially when you want vulnerability data, license info, typosquat detection, and supply chain provenance all in one call across npm, PyPI, cargo, Go, or Maven. Prefer this over dedicated vulnerability scanners when you also need license compliance, maintainer bus-factor risk, and typosquat checks in a single request without managing API keys.

## Known failure modes

- Package not found in the specified ecosystem — 'found: false' returned
- Ecosystem enum value not one of npm/pypi/cargo/go/maven — 400 error
- Version string not recognized or not published — falls back to latest
- Registry API timeout causing incomplete data — partial results with available sources listed
- Payment not fulfilled — 402 Payment Required response
- Malformed Maven groupId:artifactId format — query parse error

## How this service works

Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.

## Output

A JSON object containing: a verdict (ok/review/avoid), a numeric trust score (0-100), CVE/vulnerability list with severity and CVSS scores, SPDX license identifier and category, typosquat detection with lookalike names, OpenSSF Scorecard rating, GitHub stars/forks/open issues, maintainer count, download stats, provenance type, deprecation/yanked status, version age and how many versions behind latest, and the data sources used.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (npm scoped names allowed; Maven as groupId:artifactId; Go as module path)"
      },
      "version": {
       "type": "string",
       "description": "Exact version. Defaults to the registry's latest/default version."
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "name": {
       "type": "string"
      },
      "found": {
       "type": "boolean"
      },
      "yanked": {
       "type": "boolean"
      },
      "license": {
       "type": [
        "string",
        "null"
       ],
       "description": "SPDX id when known"
      },
      "project": {
       "type": [
        "object",
        "null"
       ],
       "properties": {
        "forks": {
         "type": [
          "integer",
          "null"
         ]
        },
        "stars": {
         "type": [
          "integer",
          "null"
         ]
        },
        "scorecard": {
         "type": [
          "number",
          "null"
         ],
         "description": "OpenSSF Scorecard 0-10"
        },
        "openIssues": {
         "type": [
          "integer",
          "null"
         ]
        },
        "scorecardChecks": {
         "type": [
          "object",
          "null"
         ]
        }
       }
      },
      "reasons": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "sources": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "verdict": {
       "enum": [
        "ok",
        "review",
        "avoi
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodash",
  "found": true,
  "yanked": false,
  "license": "MIT",
  "project": {
   "forks": 7000,
   "stars": 60000,
   "scorecard": 6.2,
   "openIssues": 120,
   "scorecardChecks": {
    "Maintained": 10,
    "Code-Review": 4
   }
  },
  "reasons": [
   "1 high-severity vulnerability(ies) affect 4.17.15",
   "2 medium-severity vulnerability(ies)",
   "single maintainer for a very widely used package (bus factor)"
  ],
  "sources": [
   "deps.dev",
   "osv.dev",
   "registry.npmjs.org",
   "api.npmjs.org"
  ],
  "verdict": "review",
  "version": "4.17.15",
  "homepage": "https://lodash.com/",
  "isLatest": false,
  "ecosystem": "npm",
  "typosquat": {
   "isPopular": true,
   "lookalikes": [],
   "suspicious": false,
   "popularRank": 34
  },
  "deprecated": false,
  "provenance": "none",
  "repository": "https://github.com/lodash/lodash",
  "trustScore": 60,
  "vulnCounts": {
   "low": 0,
   "high": 1,
   "medium": 2,
   "unknown": 0,
   "critical": 0
  },
  "generatedAt": "2026-09-06T19:00:00.000Z",
  "maintainers": 1,
  "publishedAt": "2019-07-17T19:10:23Z",
  "latestVersion": "4.18.1",
  "installScripts": [],
  "packageAgeDays": 5249,
  "totalDownloads": null,
  "versionAgeDays": 2608,
  "versionsBehind": 6,
  "licenseCategory": "permissive",
  "vulnerabilities": [
   {
    "id": "GHSA-29mw-wpgm-hmr9",
    "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
    "aliases": [
     "CVE-2020-28500"
    ],
    "fixedIn": [
     "4.17.21"
    ],
    "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
    "severity": "medium",
    "cvssScore": 5,
    "published": "2021-02-19T00:00:00Z"
   }
  ],
  "weeklyDownloads": 173745865,
  "deprecatedReason": null,
  "firstPublishedAt": "2012-04-23T16:37:12Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-trust-package-safety-check-15f2d21b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dep-trust.agent-utils.workers.dev](https://www.zero.xyz/host/dep-trust.agent-utils.workers.dev/llms.txt)