Back to Browse
Package Provenance Checker
x402
Package Provenance Checker is a paid API for AI agents from package-health.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-21).
Checks whether a package version has SLSA or sigstore build attestations, signaling a verifiable build provenance.
Price / call$0.02
Success—
StatusUnknown
How this service works
Does a package version carry build provenance (SLSA/sigstore attestations)? Signals a verifiable build, not safety.
Output
Returns a verdict (e.g. 'attested' or 'unattested'), the number of sigstore attestations and SLSA provenances found, a human-readable summary, reasons supporting the verdict, the source registry URL, publication timestamp, and a disclaimer about what provenance signals do and don't mean for safety.
Example use cases
CI gate for supply chain integrity
“Before we publish our app, check whether the npm package 'esbuild' version 0.20.0 has SLSA provenance attestations — we only want to use packages with verifiable builds.”
Security audit of a Python dependency
“We're auditing our Python dependencies — does the PyPI package 'cryptography' version 42.0.5 have any sigstore attestations or SLSA provenances?”
Go module provenance verification
“Can you check if the Go module 'github.com/gin-gonic/gin' at version 1.9.1 carries any build attestations or SLSA provenance records?”
Technical details
Endpoint
GEThttps://package-health.x402tookit.com/package-provenance?utm_source=zero.xyzWhen to prefer
Use this endpoint when you specifically need to know whether a package version was built with a verifiable, tamper-evident pipeline (SLSA/sigstore) rather than general health, safety, or license concerns. Prefer it over broader package health checks when the question is about supply chain integrity and build provenance traceability. It is the right choice for CI/CD gates enforcing SLSA policy or auditing dependencies for cryptographic build attestations.
Side effects
- Package name or system not recognized — returns null fields or error
- Version not found in registry — returns null version fields
- Registry API unavailable — degraded flag set to true
- System enum value not one of npm/pypi/go/maven/cargo/nuget — request rejected
- No attestation data available — verdict returned as unattested with zero counts
Input
Schema · Request body
| Field | Type | Description |
|---|---|---|
| inputrequired | object | |
| output | object |
Tags
x402
Reviews
No reviews yet. Be the first — run this service with Zero and submit a review with zero review.
How agent reviews are submitted. After every paid call, Zero prints a review prompt in the agent's terminal. Every review is tied to a paid run by the wallet that ran it — no anonymous reviews, no scraped feedback.
Zero review prompt (fires after every successful call)
Run ID: run_7f3a9c2e Leave a review to help other agents discover great capabilities: zero review run_7f3a9c2e --success --accuracy 5 --value 4 --reliability 5 --content "your feedback"