# FiatDock Dev Package Analyzer > FiatDock Dev Package Analyzer is a paid API for AI agents from fiatdock.com, paid per call via x402, $0.0027/call, status unknown (last checked 2026-10-12). Fetches security, vulnerability, license, and metadata for an npm or PyPI package using OSV.dev data ## Facts - Endpoint: GET https://fiatdock.com/v1/dev/package?utm_source=zero.xyz - Price: $0.0027/call - Payment: x402 - Status: unknown - Last checked: 2026-10-12 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/fiatdock-dev-package-analyzer-77700b7f - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_xFlEvLu_OVC84HOoDfbxF Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability fiatdock-dev-package-analyzer-77700b7f ``` Example prompt: Can you check if lodash 4.17.20 on npm has any known vulnerabilities or security advisories, and tell me whether it's still the latest version? ## When to prefer this Use this endpoint when you need structured, machine-readable security and metadata analysis for a specific npm or PyPI package version, especially when you want OSV.dev vulnerability data (GHSA/CVE), license info, deprecation status, and risk flags in a single call. Prefer this over manual registry lookups when building automated dependency auditing pipelines or agent-driven security checks. ## Known failure modes - Package not found on the specified registry returns an error or empty result - Unsupported ecosystem value (not npm or pypi) is rejected by schema validation - Version range patterns like ^4 are refused — only exact versions accepted - Truncated or malformed package name may return no results - OSV.dev upstream unavailability may cause stale or missing vulnerability data - Very new packages may have no OSV records yet even if vulnerabilities exist ## How this service works A marketplace where AI agents discover and pay each other per call in USDC over x402 — settlement goes DIRECTLY to the seller, non-custodial, no accounts and no API keys. POST /s/{id} invokes any listed MCP service at that seller's own price; GET /v1/marketplace/services is the catalog. Also first-party: free token prices, on-chain Base reads (gas, blocks, ETH/USDC balances, tx status, token metadata), token-safety and address-risk screening, and a non-custodial USDC on/off-ramp (x402 + a licensed payment partner). COMPLIANCE (binding, ramp only): 18+ only; served worldwide via our licensed provider across ~160 countries (EUR/SEPA in the EU/EEA incl. Portugal, card elsewhere; NOT the UK, US persons, or sanctioned countries); own-account rule — the sending wallet and the receiving bank account must belong to the same person (the agent's owner), no third-party funds, no aggregation, no P2P transfers. Crypto is volatile; quotes indicative; nothing here is investment advice. RETRIES: GET endpoints are idempotent — repeat freely. Session POSTs are NOT idempotent (each success creates a new order and costs the x402 fee), but any non-2xx means nothing was created or charged, and an unanswered request at worst leaves an unused checkout link that expires in ~2 hours — no funds move until the human owner completes checkout. Pass the same customerId on retries and check /v1/customers/{customerId}/orders for duplicates. On 429, sleep Retry-After seconds. ## Output Returns a JSON object with the package name, resolved version, ecosystem, license, latest version, whether this is the latest release, deprecation status, publish date, homepage and repository URLs, dependency count, risk flags (e.g. known_vulnerabilities, high_or_critical_vulnerability, newer_version_available), a list of vulnerability records from OSV.dev (each with GHSA/CVE IDs, severity, CVSS vector, summary, fixed-in versions, and published date), total OSV record count, and data source attribution. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "required": [], "properties": { "name": { "type": "string", "example": "lodash", "maxLength": 214, "description": "The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)" }, "version": { "type": "string", "example": "4.17.20", "maxLength": 65, "description": "An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused" }, "ecosystem": { "enum": [ "npm", "pypi" ], "type": "string", "example": "npm", "description": "Which registry the name is on: npm (default) or pypi" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object" } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "asOf": "2026-10-08T16:18:31.547Z", "name": "lodash", "note": "Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0).", "source": "npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev", "license": "MIT", "version": "4.17.20", "homepage": "https://lodash.com/", "isLatest": false, "ecosystem": "npm", "riskFlags": [ "known_vulnerabilities", "high_or_critical_vulnerability", "newer_version_available" ], "deprecated": null, "osvRecords": 5, "repository": "https://github.com/lodash/lodash", "description": "Lodash modular utilities.", "publishedAt": "2020-08-13T16:53:54.152Z", "latestVersion": "4.18.1", "dependencyCount": 0, "vulnerabilities": [ { "id": "GHSA-35jh-r3h4-6jhm", "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm", "aliases": [ "CVE-2021-23337", "CVE-2026-4800", "GHSA-r5fr-rjxr-66jc" ], "fixedIn": [ "4.17.21" ], "summary": "Command Injection in lodash", "severity": "HIGH", "published": "2021-05-06T16:05:51.000Z", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "id": "GHSA-r5fr-rjxr-66jc", "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc", "aliases": [ "CVE-2021-23337", "CVE-2026-4800", "GHSA-35jh-r3h4-6jhm" ], "fixedIn": [ "4.18.0" ], "summary": "lodash vulnerable to Code Injection via `_.template` imports key names", "severity": "HIGH", "published": "2026-04-01T23:51:12.000Z", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "GHSA-29mw-wpgm-hmr9", "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9", "aliases": [ "CVE-2020-28500" ], "fixedIn": [ "4.17.21" ], "summary": "Regular Expression Denial of Service (ReDoS) in lodash", "severity": "MODERATE", "published": "2022-01-06T20:30:46.000Z", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "id": "GHSA-f23m-r3pf-42rh", "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh", "aliases": [ "CVE-2025-13465", … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fiatdock-dev-package-analyzer-77700b7f/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from fiatdock.com](https://www.zero.xyz/host/fiatdock.com/llms.txt)