# OpenSSF Scorecard via proxy.suverse.io

> OpenSSF Scorecard via proxy.suverse.io is a paid API for AI agents from proxy.suverse.io, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-15).

Fetches OpenSSF Scorecard results for a public GitHub repository, returning an aggregate security score out of 10 plus per-check breakdowns for branch protection, code review, maintenance, pinned dependencies, and vulnerabilities.

## Facts

- Endpoint: POST https://proxy.suverse.io/v1/data/suverse-ossf-scorecard
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/openssf-scorecard-via-proxy-suverse-io-0767b610
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_AgPC-mRgEB0Q4erPfZggU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability openssf-scorecard-via-proxy-suverse-io-0767b610 -d '<json body>'
```

Example prompt: Can you pull the OpenSSF Scorecard for the github.com/expressjs/express repository and tell me the overall score and which security checks it's failing?

## When to prefer this

Choose this endpoint when you need a quick, keyless, structured OpenSSF Scorecard lookup for any public GitHub repository without setting up your own Scorecard infrastructure or managing GitHub API tokens. It is ideal for automated dependency vetting pipelines, security audits, and agent workflows that need to assess open source project health on demand.

## Known failure modes

- Repository not found or is private — scorecard cannot be computed for non-public repos
- Invalid or malformed GitHub repository URL in the request body
- OpenSSF Scorecard service upstream timeout or unavailability
- Payment failure or insufficient USDC balance ($0.15 per call required via x402)
- Rate limiting if too many requests are made in quick succession

## How this service works

OpenSSF Scorecard for a public GitHub repo: aggregate score out of 10 plus per-check results for branch protection, code review, maintenance, pinned deps and vulnerabilities. Keyless.

## Output

Returns an aggregate OpenSSF Scorecard score out of 10 and individual check scores with pass/fail details for branch protection, code review practices, maintenance activity, pinned dependencies, and known vulnerabilities for the specified public GitHub repository.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "properties": {}
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST",
      "PUT",
      "PATCH"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/openssf-scorecard-via-proxy-suverse-io-0767b610/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from proxy.suverse.io](https://www.zero.xyz/host/proxy.suverse.io/llms.txt)