# Dependency Trust - Package Vulnerability & Trust Score

> Dependency Trust - Package Vulnerability & Trust Score is a paid API for AI agents from dep-trust.agent-utils.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Returns vulnerabilities, license, age, popularity, provenance, typosquat lookalikes, and a trust score for a given package across npm, PyPI, crates.io, Go, and Maven ecosystems.

## Facts

- Endpoint: GET https://dep-trust.agent-utils.workers.dev/v1/vulns
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-trust-package-vulnerability-trust-score-5372c982
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QH9mliHhbCP8OCMaY_8Pk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-trust-package-vulnerability-trust-score-5372c982
```

Example prompt: Before I add it to my project, check the PyPI package 'requests' version 2.25.0 for vulnerabilities, known CVEs, and give me a trust score — I need to know if it's safe to install.

## When to prefer this

Prefer this endpoint when an AI agent or developer needs a comprehensive, single-call security and trust assessment for a package — especially when combining vulnerability data with provenance, typosquat detection, and a trust score matters. Ideal for automated dependency auditing pipelines, pre-install checks in agent workflows, or supply chain security reviews. Works across npm, PyPI, crates.io, Go, and Maven in one unified API with no API key required (pay-per-call via x402).

## Known failure modes

- Unknown ecosystem value returns validation error
- Package name not found in ecosystem returns empty or 404
- Malformed Maven groupId:artifactId format causes lookup failure
- Rate limiting or payment failure via x402 returns 402 or 429
- Network timeout from upstream OSV API causes delayed or failed response
- Omitting required 'ecosystem' or 'name' query params returns 400

## How this service works

Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.

## Output

Returns a JSON object containing the package name, ecosystem, queried version, total vulnerability count, per-severity counts (critical/high/medium/low/unknown), and an array of vulnerability objects each with an OSV ID, URL, CVE aliases, affected versions, fix versions, summary, severity level, CVSS score, and publication date. May also include trust score, license, age, popularity, provenance, and typosquat lookalike signals depending on endpoint variant.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (npm scoped names allowed; Maven as groupId:artifactId; Go as module path)"
      },
      "version": {
       "type": "string",
       "description": "Optional exact version; omit to list advisories across all versions"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "name": {
       "type": "string"
      },
      "count": {
       "type": "integer"
      },
      "version": {
       "type": [
        "string",
        "null"
       ]
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven"
       ],
       "type": "string",
       "description": "Package ecosystem"
      },
      "vulnCounts": {
       "type": "object"
      },
      "vulnerabilities": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "id": {
          "type": "string"
         },
         "url": {
          "type": "string"
         },
         "aliases": {
          "type": "array",
          "items": {
           "type": "string"
          }
         },
         "fixedIn": {
          "type": "array",
          "items": {
           "type": "string"
          }
         },
         "summary": {
          "type": "string"
         },
         "severity": {
          "enum": [
           "critical",
           "high",
           "medium",
           "low",
           "unknown"
          ],
          "type": "string"
         },
         "cvssScore": {
          "type": [
           "number",
   
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "requests",
  "count": 2,
  "version": "2.25.0",
  "ecosystem": "pypi",
  "vulnCounts": {
   "low": 0,
   "high": 0,
   "medium": 2,
   "unknown": 0,
   "critical": 0
  },
  "vulnerabilities": [
   {
    "id": "GHSA-j8r2-6x86-q33q",
    "url": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q",
    "aliases": [
     "CVE-2023-32681"
    ],
    "fixedIn": [
     "2.31.0"
    ],
    "summary": "Unintended leak of Proxy-Authorization header in requests",
    "severity": "medium",
    "cvssScore": 5,
    "published": "2023-05-26T00:00:00Z"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-trust-package-vulnerability-trust-score-5372c982/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dep-trust.agent-utils.workers.dev](https://www.zero.xyz/host/dep-trust.agent-utils.workers.dev/llms.txt)