# FreshDep GitHub Dependency Age Scanner

> FreshDep GitHub Dependency Age Scanner is a paid API for AI agents from api.bakhour.ca, paid per call via x402, $25/call, status unknown (last checked 2026-09-14).

Scans a GitHub repository's lockfiles for recently-published dependencies that may indicate a supply-chain or freshness risk, flagging any package published within a configurable number of days.

## Facts

- Endpoint: POST https://api.bakhour.ca/freshdep/scan
- Price: $25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/freshdep-github-dependency-age-scanner-e4c7d85f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_rdQYN1K22J-zcsd4P-trS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability freshdep-github-dependency-age-scanner-e4c7d85f -d '<json body>'
```

Example prompt: Can you scan https://github.com/acme/backend-api for any dependencies published in the last 7 days — I want to know if anything suspiciously fresh snuck into the lockfiles?

## When to prefer this

Choose this endpoint when you need a fast, automated signal on whether a GitHub repository's declared dependencies include suspiciously fresh package releases — particularly useful in CI pipelines, pre-merge security gates, or vendor due-diligence workflows where detecting supply chain attacks via newly hijacked or malicious package versions matters. Prefer it over general vulnerability scanners (e.g. Snyk, Dependabot) when the specific concern is recency/freshness rather than known CVEs.

## Known failure modes

- Repository not found or inaccessible (private repo without credentials)
- No lockfile detected in the repository (no supported dependency files found)
- Invalid or malformed GitHub URL supplied
- Network timeout fetching repository contents
- Package registry lookup failure preventing age determination
- Repository has no dependencies to check

## How this service works

Decision-grade security/due-diligence outcome reports ($20-$100) plus deterministic paid utilities ($0.001+) for software agents and automated workflows.

## Output

Returns a JSON object listing all flagged dependencies (those published more recently than the threshold), including each package's name, version, ecosystem, and age in days, plus summary counts of how many lockfiles and total dependencies were checked and whether results were truncated.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ref": {
   "type": "string",
   "description": "Optional branch/tag to check out instead of the default branch."
  },
  "repo_url": {
   "type": "string",
   "description": "Full https://github.com/<owner>/<repo> URL to scan."
  },
  "threshold_days": {
   "type": "number",
   "description": "Flag anything published more recently than this many days ago. Defaults to 7."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "errors": [],
  "flagged": [
   {
    "name": "some-package",
    "flagged": true,
    "version": "3.1.4",
    "age_days": 0.6,
    "ecosystem": "pypi"
   }
  ],
  "repo_url": "https://github.com/octocat/Hello-World",
  "flagged_count": 1,
  "threshold_days": 7,
  "lockfiles_checked": [
   "requirements.txt"
  ],
  "dependencies_checked": 42,
  "dependencies_truncated": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/freshdep-github-dependency-age-scanner-e4c7d85f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.bakhour.ca](https://www.zero.xyz/host/api.bakhour.ca/llms.txt)