# packages.melchiorlabs.com NPM Package Evidence

> packages.melchiorlabs.com NPM Package Evidence is a paid API for AI agents from packages.melchiorlabs.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Returns a citation-ready evidence record for an npm package, including registry facts, integrity digests, license, repository URL, resolved version, and provenance attestation status.

## Facts

- Endpoint: POST https://packages.melchiorlabs.com/v1/npm/evidence
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/packages-melchiorlabs-com-npm-package-evidence-1494f5cf
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_axifgez2p7FvH0HYMPCWV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability packages-melchiorlabs-com-npm-package-evidence-1494f5cf -d '<json body>'
```

Example prompt: Can you pull a citation-ready evidence record for the npm package 'lodash' at version 4.17.21 — I need the integrity hash, license, repository URL, and whether it has provenance attestation?

## When to prefer this

Choose this endpoint when you need a stable, pay-per-request, citation-ready evidence record for an npm package — particularly for audit trails, compliance documentation, or software supply chain verification where a single authoritative snapshot of registry facts, integrity, and provenance status is required. Prefer this over scraping the npm registry directly when you need a structured, request-ID-backed artifact suitable for citation.

## Known failure modes

- Package or version not found in the npm registry — returns an error indicating unresolvable package
- Network or registry availability issues causing lookup failure
- Invalid package name format causing a validation error
- Provenance/attestation data unavailable, surfaced as a flag rather than a hard failure

## How this service works

Pay per request for a stable, citation-ready npm package evidence record: registry facts, integrity, and provenance over x402.

## Output

A JSON object containing the resolved version, license, repository URL, sha512 integrity digest of the package, attestation URL (if available), signature count, provenance flags (e.g. provenance_attestation_missing), a unique request ID, and a disclaimer about the scope of the report.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "package": {
   "type": "string",
   "maxLength": 214,
   "description": "Public npm package name, scoped or unscoped, lowercase."
  },
  "version": {
   "type": "string",
   "default": "latest",
   "maxLength": 64,
   "description": "Exact semver or dist-tag."
  },
  "nodeVersion": {
   "type": "string",
   "maxLength": 64,
   "description": "Exact stable semver; enables the node_engine_mismatch flag."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "flags": [
   "provenance_attestation_missing"
  ],
  "digests": {
   "input": "…",
   "result": "…"
  },
  "license": "MIT",
  "requestId": "89416332-bc4e-43da-b0e2-32af08677d9e",
  "limitations": [
   "This report states public npm registry facts only; it does not certify that the package is safe, trustworthy, maintained, or free of vulnerabilities."
  ],
  "distribution": {
   "integrity": "sha512-…",
   "attestationUrl": null,
   "signatureCount": 1
  },
  "repositoryUrl": "git+https://github.com/example/example.git",
  "resolvedVersion": "2.19.0"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/packages-melchiorlabs-com-npm-package-evidence-1494f5cf/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from packages.melchiorlabs.com](https://www.zero.xyz/host/packages.melchiorlabs.com/llms.txt)