# pkgproof Package Verification

> pkgproof Package Verification is a paid API for AI agents from x402.pkgproof.net, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Verifies the authenticity and integrity of a software package, returning a proof-of-verification result for a single package lookup.

## Facts

- Endpoint: POST https://x402.pkgproof.net/v1/verify
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkgproof-package-verification-8fb81f27
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_d8KrVeDVeEbPMeuhLNeCJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkgproof-package-verification-8fb81f27 -d '<json body>'
```

Example prompt: Can you verify that the npm package lodash version 4.17.21 is authentic and hasn't been tampered with — I need a pkgproof verification before I approve it for our production build?

## When to prefer this

Use this endpoint when you need a paid, authoritative single-package integrity verification with a cryptographic or provenance proof — particularly in security-sensitive workflows like CI/CD pipelines, pre-deployment audits, or supply chain risk assessments where a simple checksum comparison is not sufficient and a trusted third-party attestation is required.

## Known failure modes

- Package not found in registry — returns not-found or unrecognized package error
- Invalid or missing package version — endpoint may return validation error
- Network or upstream registry unreachable — service may return a timeout or upstream error
- Tampered or unverified package — returns a failed verification status rather than a positive proof
- Malformed request payload — returns 400-level error for missing required fields

## How this service works

One pkgproof package verification

## Output

Returns a verification result indicating whether the specified software package is authentic and its integrity is intact, including a proof status, any detected anomalies, and metadata about the verified package version.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "description": "Package name. ASCII only; homoglyph and Unicode-confusable names are refused before any upstream call."
  },
  "version": {
   "type": "string",
   "description": "Optional. Omit to verify the package rather than one release."
  },
  "ecosystem": {
   "enum": [
    "npm"
   ],
   "type": "string",
   "description": "npm is the only ecosystem this service verifies."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "left-pad",
  "reasons": [
   {
    "code": "package_exists",
    "kind": "fact",
    "detail": "left-pad 1.3.0 is published on the npm registry.",
    "source": "npm registry",
    "verdict": "safe"
   },
   {
    "code": "no_known_advisories",
    "kind": "fact",
    "detail": "OSV lists no advisories for this version.",
    "source": "osv.dev",
    "verdict": "safe"
   }
  ],
  "sources": {
   "osv.dev": "https://api.osv.dev",
   "npm registry": "https://registry.npmjs.org"
  },
  "verdict": "safe",
  "version": "1.3.0",
  "ecosystem": "npm",
  "checked_at": "2026-08-26T12:00:00Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkgproof-package-verification-8fb81f27/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.pkgproof.net](https://www.zero.xyz/host/x402.pkgproof.net/llms.txt)