# orphan-patch-score

> orphan-patch-score is a paid API for AI agents from market.561.group, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-12).

Ranks open-source packages as orphan-patch candidates by scoring them on disclosed advisories, maintainer silence, and dependent count using only public, deterministic inputs.

## Facts

- Endpoint: POST https://market.561.group/v1/orphan-patch/score?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/orphan-patch-score-457afa12
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_I88YVEJPWPXUzhUG5PYOc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability orphan-patch-score-457afa12 -d '<json body>'
```

Example prompt: Score these npm and PyPI packages for orphan-patch candidacy — I have advisory data with severity and fixedVersion, dependent counts, and maintenance stats like days since last release and median issue response time. Tell me which ones to prioritize for writing community patches.

## When to prefer this

Choose this endpoint when you need a reproducible, transparent, public-input-only prioritization of which packages deserve orphan patches — particularly when you already have structured advisory, dependent, and maintenance data and need a scored ranking rather than a raw list. It is preferable over manual triage or general vulnerability scanners when the goal is specifically to identify high-impact, unmaintained packages that the community should patch independently.

## Known failure modes

- Missing or malformed advisory rows (null package or ecosystem fields) may cause scoring errors
- fixedVersion nulls must be explicit — omitting the field may skew scoring toward false negatives
- Empty dependents or maintenance arrays result in partial scores with reduced ranking confidence
- Unsupported ecosystem values may be ignored or cause validation failures
- Sending packages with no advisory data produces a zero-risk score that may not surface real risks

## How this service works

Ranks packages with disclosed advisories, silent maintainers, and many dependents as orphan-patch candidates, deterministically, from public inputs alone.

## Output

A ranked list of packages scored as orphan-patch candidates, computed deterministically from the supplied advisory, dependency, and maintenance data. Each entry reflects how urgently a community patch is warranted based on vulnerability severity, absence of an official fix, maintainer inactivity, and downstream blast radius.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "advisories": {
   "type": "array",
   "description": "{id, package, ecosystem, severity, published, fixedVersion} rows; fixedVersion is null when no fix is known."
  },
  "dependents": {
   "type": "array",
   "description": "{package, ecosystem, dependentCount} rows."
  },
  "maintenance": {
   "type": "array",
   "description": "{package, ecosystem, lastReleaseDaysAgo, openIssueResponseDaysMedian} rows; openIssueResponseDaysMedian is null when no issue response was ever recorded."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/orphan-patch-score-457afa12/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from market.561.group](https://www.zero.xyz/host/market.561.group/llms.txt)