# DepScout Package Risk Checker

> DepScout Package Risk Checker is a paid API for AI agents from depscout.vercel.app, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Analyzes an npm package, PyPI package, or GitHub repo and returns a security/safety install verdict

## Facts

- Endpoint: POST https://depscout.vercel.app/risk/package
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/depscout-vercel-app-63afcf4a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6MXMLvnHOFXtBWhMclwyI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability depscout-vercel-app-63afcf4a -d '<json body>'
```

Example prompt: Can you check if the npm package 'colors' is safe to install? I want to know if there are any supply chain risks or security red flags before I add it as a dependency.

## When to prefer this

Use this endpoint when an AI agent or developer needs a fast, automated security verdict on a specific npm, PyPI, or GitHub dependency before installation or inclusion in a project. Prefer this over general web searches when you need a structured, machine-readable install verdict rather than community forum opinions.

## Known failure modes

- Package not found in the specified registry — returns error or unknown verdict
- Invalid or malformed package name or repo URL — returns validation error
- Registry API unavailable — upstream timeout or service error
- Unsupported package ecosystem — only npm, PyPI, and GitHub repos are supported

## How this service works

Check an npm package, PyPI package, or GitHub repo and return a DepScout install verdict.

## Output

A DepScout install verdict indicating whether the package is safe, risky, or dangerous, along with supporting risk signals about the npm, PyPI, or GitHub package analyzed.

## Example request

```json
{
 "package": "lodash",
 "ecosystem": "npm"
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object"
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST",
      "PUT",
      "PATCH"
     ],
     "type": "string"
    },
    "headers": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {}
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/depscout-vercel-app-63afcf4a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from depscout.vercel.app](https://www.zero.xyz/host/depscout.vercel.app/llms.txt)