# NPM Package Preflight Safety Check

> NPM Package Preflight Safety Check is a paid API for AI agents from base-agent-preflight.bytoken2023.workers.dev, paid per call via x402, $0.015/call, status unknown (last checked 2026-09-15).

Analyzes an npm package for security risk, flags, provenance, and metadata to help agents safely evaluate packages before installation or use.

## Facts

- Endpoint: GET https://base-agent-preflight.bytoken2023.workers.dev/v1/x402/software/npm-package-preflight
- Price: $0.015/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/npm-package-preflight-safety-check-ef75a1fa
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_kLFY3LyMQjdu-NXqM9pol

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability npm-package-preflight-safety-check-ef75a1fa
```

Example prompt: Before I add it to my project, can you run a preflight safety check on the npm package 'lodash' version '4.17.21' and tell me its risk score, any flags, and whether its provenance looks clean?

## When to prefer this

Use this endpoint when an AI agent needs to programmatically evaluate whether an npm package is safe to install or depend on, particularly before automated dependency management, CI/CD pipeline integration, or autonomous code generation that pulls in external packages. Prefer this over manual registry inspection when you need a machine-readable risk score and structured flags.

## Known failure modes

- Package not found on npm registry returns error or empty result
- Invalid package name format causes validation failure
- Unsupported or malformed version string may return error
- Network timeout if npm registry is temporarily unavailable
- Private or scoped packages behind auth may not be resolvable

## How this service works

Machine-payable service intelligence for discovering, verifying, and monitoring identity, risk, authorization, execution-preflight, and evidence APIs before autonomous agents spend.

## Output

Returns a JSON object with risk_level (e.g. 'low'), risk_score (numeric), an array of flags indicating detected issues, provenance details, activity signals, and identity metadata for the queried npm package and version.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "package"
     ],
     "properties": {
      "package": {
       "type": "string",
       "maxLength": 214,
       "minLength": 1,
       "description": "npm package name, including an optional scope."
      },
      "version": {
       "type": "string",
       "maxLength": 80,
       "minLength": 1,
       "description": "Exact npm version or latest. Defaults to latest."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "network": {
       "type": "string"
      },
      "product": {
       "type": "string"
      },
      "activity": {
       "type": "object"
      },
      "identity": {
       "type": "object"
      },
      "assessment": {
       "type": "object"
      },
      "provenance": {
       "type": "object"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "network": "eip155:8453",
  "product": "npm-package-preflight",
  "assessment": {
   "flags": [],
   "risk_level": "low",
   "risk_score": 0
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/npm-package-preflight-safety-check-ef75a1fa/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from base-agent-preflight.bytoken2023.workers.dev](https://www.zero.xyz/host/base-agent-preflight.bytoken2023.workers.dev/llms.txt)