# Package Risk Checker

> Package Risk Checker is a paid API for AI agents from x402-package-risk.x402-package-risk.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-13).

Returns deterministic dependency risk data for a single package — including licence classification, maintenance status, and known security advisories — resolved to the version an installer would actually get today.

## Facts

- Endpoint: POST https://x402-package-risk.x402-package-risk.workers.dev/v1/package/risk?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-risk-checker-9c4fc8b7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YU9eS6XzPOz5dAWn3EVL0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-risk-checker-9c4fc8b7 -d '<json body>'
```

Example prompt: Check the risk profile of the npm package 'express' — I need to know its licence, whether it's still maintained, and if there are any known security advisories against the version I'd get if I installed it today.

## When to prefer this

Choose this endpoint when you need deterministic, structured, non-AI-hallucinated risk data about a specific open source package before adding it to a project or shipping code. It is ideal for CI/CD pipeline gates, automated dependency audits, licence compliance checks, or any agent workflow that needs to programmatically decide whether a package is safe to use based on maintenance health, licence type, and known CVEs — without requiring a model to reason about package safety from training data.

## Known failure modes

- Package not found in the specified ecosystem — returns an error or empty result
- Invalid or unsupported ecosystem/system value
- Version string that doesn't resolve to a published release
- Network or upstream source (deps.dev, osv.dev) unavailability causing partial or failed data
- Ambiguous package names that exist in multiple ecosystems if system is not specified

## How this service works

Deterministic dependency risk data for agents: maintenance, licence, and known advisories for one package, resolved against the version an installer would actually get today. No model calls, no personal data.

## Output

A structured JSON object containing: the resolved package name and ecosystem, a licence object with class (e.g. permissive), SPDX identifier, and commercial safety flag, a maintenance object with days since last publish, deprecated flag, and last publish timestamp, an array of security advisories, an overall verdict (e.g. 'ok'), and the data sources used (deps.dev, osv.dev, and the relevant registry).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "name",
  "system"
 ],
 "properties": {
  "name": {
   "type": "string"
  },
  "system": {
   "enum": [
    "npm",
    "pypi",
    "go",
    "maven",
    "cargo",
    "nuget"
   ],
   "type": "string"
  },
  "version": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "licence": {
  "class": "permissive",
  "licence": "MIT",
  "commercialSafe": true
 },
 "package": {
  "name": "express",
  "system": "npm"
 },
 "sources": [
  "deps.dev",
  "osv.dev",
  "registry.npmjs.org"
 ],
 "verdict": "ok",
 "advisories": [],
 "maintenance": {
  "ageDays": 93,
  "deprecated": false,
  "lastPublish": "2026-05-11T18:50:00.007Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-risk-checker-9c4fc8b7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-package-risk.x402-package-risk.workers.dev](https://www.zero.xyz/host/x402-package-risk.x402-package-risk.workers.dev/llms.txt)