# Safe Upgrade Decision API

> Safe Upgrade Decision API is a paid API for AI agents from x402-safe-upgrade-api.onrender.com, paid per call via x402, $0.25/call, status down (last checked 2026-09-15).

Audits npm package dependencies for vulnerabilities, deprecations, and upgrade safety, returning evidence-backed recommendations for coding agents.

## Facts

- Endpoint: POST https://x402-safe-upgrade-api.onrender.com/v1/dependency-audit
- Price: $0.25/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/safe-upgrade-decision-api-18aaf804
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_gNsaQR0daawGz8ere94Bo

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability safe-upgrade-decision-api-18aaf804 -d '<json body>'
```

Example prompt: Can you audit my npm dependencies for security vulnerabilities and deprecations? Here's my dependency map: { "express": "4.18.2", "lodash": "4.17.20", "axios": "1.3.0" }

## When to prefer this

Use this endpoint when a coding agent needs fast, evidence-backed vulnerability and deprecation signals for npm packages specifically, without running a full local `npm audit` process — ideal for CI pipelines, automated code review agents, or pre-deploy safety checks where access to the local filesystem is unavailable.

## Known failure modes

- Input exceeds 100 package limit — request is rejected
- Invalid package name or version format causes validation error
- Unknown package not found in registry returns partial or missing data
- Service unavailable on Render cold start causing timeout
- Payment not completed via x402 protocol results in 402 response blocking the call

## How this service works

Evidence-backed npm package upgrade decisions for coding agents.

## Output

Returns a JSON object with a summary (count of audited packages, number deprecated, list of packages needing attention, count with known vulnerabilities) and a per-package breakdown including vulnerability IDs (e.g. GHSA identifiers), status, and any relevant advisory details.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "dependencies": {
   "type": "object",
   "description": "Package-name to version map, exactly as in package.json (max 100 entries).",
   "additionalProperties": {
    "type": "string"
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "summary": {
   "audited": 2,
   "deprecated": 0,
   "attentionNeeded": [
    "express"
   ],
   "withKnownVulnerabilities": 1
  },
  "packages": [
   {
    "name": "express",
    "status": "audited",
    "vulnerabilities": [
     {
      "id": "GHSA-example"
     }
    ]
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/safe-upgrade-decision-api-18aaf804/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-safe-upgrade-api.onrender.com](https://www.zero.xyz/host/x402-safe-upgrade-api.onrender.com/llms.txt)