# pkg-oracle Package Safety Verifier

> pkg-oracle Package Safety Verifier is a paid API for AI agents from mcp-snowy-dew-9447.fly.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-11).

Verifies an npm or PyPI package by checking existence, known CVEs via OSV.dev, OpenSSF Scorecard, and typosquat/slopsquat similarity, returning an ALLOW/WARN/BLOCK verdict.

## Facts

- Endpoint: POST https://mcp-snowy-dew-9447.fly.dev/verify?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkg-oracle-package-safety-verifier-ac740789
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VCf71MjT8Dm-VrXITtiL4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkg-oracle-package-safety-verifier-ac740789 -d '<json body>'
```

Example prompt: Before I install it, can you check if the npm package 'colors' version 1.4.0 is safe — look for known CVEs, its OpenSSF scorecard, and whether it might be a typosquat of something popular?

## When to prefer this

Choose this endpoint when you need a fast, opinionated ALLOW/WARN/BLOCK safety verdict on an npm or PyPI package before installing it — especially useful in CI/CD pipelines, agentic coding workflows, or when evaluating AI-suggested packages that may be hallucinated (slopsquat). It combines CVE lookup, scorecard analysis, and typosquat detection in a single call, making it more comprehensive than querying OSV.dev or OpenSSF alone.

## Known failure modes

- Package not found in the specified ecosystem — returns existence failure
- OSV.dev or OpenSSF Scorecard upstream unavailability causing incomplete results
- Ambiguous package name with no clear match leading to inconclusive verdict
- Invalid ecosystem value (not npm or pypi) causing schema validation error
- Version string malformed or not found for the given package

## How this service works

Verify an npm/PyPI package before installing it: existence, known CVEs (OSV.dev), OpenSSF Scorecard, and typosquat/slopsquat similarity. Returns an ALLOW/WARN/BLOCK verdict.

## Output

Returns a verdict of ALLOW, WARN, or BLOCK for the specified package, along with details on known CVEs sourced from OSV.dev, an OpenSSF Scorecard rating, typosquat/slopsquat similarity analysis against popular packages, and confirmation of whether the package exists in the specified ecosystem.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string"
  },
  "version": {
   "type": "string"
  },
  "ecosystem": {
   "enum": [
    "npm",
    "pypi",
    "crates.io"
   ],
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkg-oracle-package-safety-verifier-ac740789/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from mcp-snowy-dew-9447.fly.dev](https://www.zero.xyz/host/mcp-snowy-dew-9447.fly.dev/llms.txt)