# Package Dependency Risk Scanner

> Package Dependency Risk Scanner is a paid API for AI agents from agent-data.centorprat.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-29).

Scans npm and PyPI packages for known security vulnerabilities, staleness, deprecation, and download signals by querying registry metadata and OSV.dev advisories.

## Facts

- Endpoint: POST https://agent-data.centorprat.workers.dev/tools/package-dependency-risk-scanner?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-dependency-risk-scanner-2bad42d3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TsH5MgLIWl7mMYdN5j_1R

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-dependency-risk-scanner-2bad42d3 -d '<json body>'
```

Example prompt: Can you scan lodash, express@4.18.0, and pypi:requests for known security vulnerabilities, deprecation, and staleness — I want to know if these are safe to use before I add them to my project?

## When to prefer this

Use this endpoint when you need a quick, keyless security and health check for npm or PyPI packages before adding them to a project, during CI/CD pipeline audits, or when performing supply-chain risk assessments. It combines registry metadata, download signals, and OSV vulnerability data in one call — ideal for agents that need a consolidated risk brief without managing multiple API keys or credentials.

## Known failure modes

- Package not found in the specified registry — returned as a failed lookup (not charged)
- Invalid package name or version format causes lookup error
- Ecosystem mismatch (e.g. npm package queried as PyPI) results in not-found
- OSV.dev or registry API unavailability may cause incomplete results
- Exceeding the 5-package-per-call limit returns a schema validation error

## How this service works

Pay-per-call data and tools for AI agents, $0.002-0.01 per call in USDC via x402 (Base, Polygon or Solana), no account or API key; MAX tiers ($0.05-0.25) run deeper jobs. Agent toolkit: web search, search + read top pages, any page as clean markdown with a prompt-injection check, which-x402-API-to-call recommender, seller check. Data: Google Maps places with contacts, YouTube video data and transcripts, job listings (Indeed, LinkedIn, 13 boards), Google Ads Transparency, TikTok comments, Pinterest, Airbnb, Redfin, AliExpress, app stores, live sports, website and SEO checks, Shopify store tech stacks, and onchain token / address risk checks.

## Output

A risk brief per package including: known CVE/security advisories from OSV.dev, deprecation status, staleness indicators (time since last publish), npm download counts where applicable, and an overall risk signal summarizing whether the package is safe, risky, or flagged for attention.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "packages": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 5,
   "description": "e.g. [\"lodash\", \"express@4.18.0\", \"pypi:requests\", \"npm:@babel/core\"]. Prefix with npm: or pypi: to pick the ecosystem (else the default below); add @version (npm) or ==version (PyPI) to check a specific version. One brief per package."
  },
  "ecosystem": {
   "enum": [
    "npm",
    "pypi"
   ],
   "type": "string",
   "description": "Used for package names without an npm:/pypi: prefix."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "name": "lodash",
    "found": true,
    "query": "lodash",
    "created": "2012-04-23T16:37:11.912Z",
    "license": "MIT",
    "homepage": "https://lodash.com/",
    "ecosystem": "npm",
    "deprecated": false,
    "lastPublish": "2026-04-01T21:01:20.458Z",
    "maintainers": 1,
    "latestVersion": "4.18.1",
    "checkedVersion": "4.18.1",
    "weeklyDownloads": 94515109,
    "deprecatedReason": null
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-dependency-risk-scanner-2bad42d3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-data.centorprat.workers.dev](https://www.zero.xyz/host/agent-data.centorprat.workers.dev/llms.txt)