# Package Trust Score & Safety Signals

> Package Trust Score & Safety Signals is a paid API for AI agents from x402-api-24223879872.us-east1.run.app, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-11).

Returns install-safety signals for an npm or PyPI package, including registry metadata, install-script usage, OSV advisories, typosquat risk, and a 0-100 trust score.

## Facts

- Endpoint: GET https://x402-api-24223879872.us-east1.run.app/v1/package-trust?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-trust-score-safety-signals-5fd6b77a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Z1RQ9hT1kbka6VNW-cU3B

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-trust-score-safety-signals-5fd6b77a
```

Example prompt: Can you check whether the npm package 'colors' is safe to install — I want to see its trust score, any known advisories, whether it uses install scripts, and if there's any typosquat risk?

## When to prefer this

Choose this endpoint when you need a holistic, multi-signal safety assessment of an npm or PyPI package before installation or inclusion in a dependency tree. It combines registry metadata, vulnerability advisories, typosquat detection, and install-script auditing into a single scored response — ideal for automated CI/CD gates, dependency review workflows, or agent-driven security pipelines where you need a single trust number plus actionable flags rather than querying OSV, npm, and PyPI registries separately.

## Known failure modes

- Package name not found in the specified ecosystem — returns empty or low-confidence result
- Invalid ecosystem value (must be 'npm' or 'pypi') — returns validation error
- OSV or registry API upstream timeout — partial data may be returned
- Typosquat detection may produce false positives for intentionally short or similar package names
- Newly published packages may have incomplete registry metadata

## How this service works

Install-safety signals for an npm or PyPI package: registry metadata, install-script usage, OSV advisories, typosquat risk, and a 0-100 trust score.

## Output

A JSON object containing: a 0-100 trust score, boolean flags array listing detected issues, registry metadata (age, license, deprecation status, maintainer count, publish dates, latest version), install script usage (preinstall, install, postinstall booleans), OSV advisories (count, IDs, max severity), and typosquat matches with edit distances.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "name": {
       "type": "string"
      },
      "flags": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "score": {
       "type": "number"
      },
      "registry": {
       "type": "object",
       "properties": {
        "exists": {
         "type": "boolean"
        },
        "ageDays": {
         "type": "number"
        },
        "license": {
         "type": [
          "string",
          "null"
         ]
        },
        "deprecated": {
         "type": "boolean"
        },
        "latestVersion": {
         "type": "string"
        },
        "maintainerCount": {
         "type": "number"
        },
        "firstPublishedAt": {
         "type": "string"
        },
        "latestPublishedAt": {
         "type": "string"
        }
       }
      },
      "ecosystem": {
       "type": "string"
      },
      "typosquat": {
       "type": "object",
       "properties": {
        "matches": {
         "type": "array",
         "items": {
          "type": "object",
          "properties": {
           "name": {
            "type": "string"
           },
           "distance": {
            "type": "number"
           }
          }
         }
        }
       }
      },
      "advisories": {
       "type": "object",
       "properties": {
        "ids": {
         "type": "array",
         "items": {
          "type": "string"
         }
        },
        "count": {
         "type": "number"
        },
        "maxSeverity": {
         "type": [
          "string",
 
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-trust-score-safety-signals-5fd6b77a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-api-24223879872.us-east1.run.app](https://www.zero.xyz/host/x402-api-24223879872.us-east1.run.app/llms.txt)