# Package Provenance Checker

> Package Provenance Checker is a paid API for AI agents from package-health.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-21).

Checks whether a package version has SLSA or sigstore build attestations, signaling a verifiable build provenance.

## Facts

- Endpoint: GET https://package-health.x402tookit.com/package-provenance?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-provenance-checker-3d52d8c3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6QiCFf27EsAIrPT5buQk1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-provenance-checker-3d52d8c3
```

Example prompt: Does the npm package 'lodash' version 4.17.21 have any SLSA or sigstore build attestations — is its build provenance verifiable?

## When to prefer this

Use this endpoint when you specifically need to know whether a package version was built with a verifiable, tamper-evident pipeline (SLSA/sigstore) rather than general health, safety, or license concerns. Prefer it over broader package health checks when the question is about supply chain integrity and build provenance traceability. It is the right choice for CI/CD gates enforcing SLSA policy or auditing dependencies for cryptographic build attestations.

## Known failure modes

- Package name or system not recognized — returns null fields or error
- Version not found in registry — returns null version fields
- Registry API unavailable — degraded flag set to true
- System enum value not one of npm/pypi/go/maven/cargo/nuget — request rejected
- No attestation data available — verdict returned as unattested with zero counts

## How this service works

Does a package version carry build provenance (SLSA/sigstore attestations)? Signals a verifiable build, not safety.

## Output

Returns a verdict (e.g. 'attested' or 'unattested'), the number of sigstore attestations and SLSA provenances found, a human-readable summary, reasons supporting the verdict, the source registry URL, publication timestamp, and a disclaimer about what provenance signals do and don't mean for safety.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "system",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name"
      },
      "system": {
       "type": "string",
       "description": "npm, pypi, go, maven, cargo or nuget"
      },
      "version": {
       "type": "string",
       "description": "Version; default is the registry's default version"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "name": {
       "type": [
        "null",
        "string"
       ]
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "system": {
       "type": [
        "null",
        "string"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "summary": {
       "type": [
        "null",
        "string"
       ]
      },
      "verdict": {
       "type": [
        "null",
        "string"
       ]
      },
      "version": {
       "type": [
        "null",
        "string"
       ]
      },
      "degraded": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "sourceUrl": {
       "type": [
        "null",
        "string"
       ]
      },
      "disclaimer": {
       "type": [
        "null",
        "string"
       ]
      },
      "notChecked": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "publishedAt": {
       "type": [
        "null",
        "string"
       ]
      },
      "attestations": {
       "type": [
        "null",
        "number"
       ]
      },
      "relatedProjects": {
       "type": [
        "array",
        "null"
       ],
       "ite
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-provenance-checker-3d52d8c3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from package-health.x402tookit.com](https://www.zero.xyz/host/package-health.x402tookit.com/llms.txt)