# Safe Upgrade Decision API

> Safe Upgrade Decision API is a paid API for AI agents from x402-safe-upgrade-api.onrender.com, paid per call via x402, $0.03/call, status down (last checked 2026-09-15).

Analyzes an npm package (and optional version) for security and supply-chain risk signals, returning a scored verdict to help coding agents decide whether to approve an upgrade.

## Facts

- Endpoint: POST https://x402-safe-upgrade-api.onrender.com/v1/package-risk
- Price: $0.03/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/safe-upgrade-decision-api-cf8e7a48
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_oYoESJyz_PcacCqrFeJuV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability safe-upgrade-decision-api-cf8e7a48 -d '<json body>'
```

Example prompt: Before we merge this PR, can you check the risk score for upgrading to `axios` version 1.7.2 on npm — I want to know if it runs install scripts or has any other supply chain red flags?

## When to prefer this

Choose this endpoint when a coding agent or CI/CD pipeline needs a fast, evidence-backed go/no-go signal on an npm package upgrade, especially when supply chain attacks (e.g. malicious postinstall scripts, typosquatting) are a concern. Prefer it over manual npm audit or Snyk when you need a lightweight, pay-per-call risk score that integrates directly into an automated agent workflow without requiring OAuth or subscription setup.

## Known failure modes

- Unknown or misspelled package name returns an error or empty result
- Requesting a non-existent version may return a 404 or error response
- Payment failure (insufficient USDC balance) blocks the request with a 402 status
- Rate limiting or service unavailability on the hosted Render instance may cause timeouts
- Packages with no registry metadata may produce incomplete signal sets

## How this service works

Evidence-backed npm package upgrade decisions for coding agents.

## Output

Returns a JSON object containing a numeric risk score (0–100), a verdict string (e.g. 'low', 'medium', 'high'), and an array of risk signals each with an ID, human-readable detail, and a numeric weight indicating how much it contributed to the score.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "version": {
   "type": "string",
   "description": "Exact version to analyze; omit for latest."
  },
  "packageName": {
   "type": "string",
   "description": "Exact npm package name."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": {
   "score": 55,
   "signals": [
    {
     "id": "install-scripts",
     "detail": "Runs code at install time via postinstall.",
     "weight": 25
    }
   ],
   "verdict": "medium"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/safe-upgrade-decision-api-cf8e7a48/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-safe-upgrade-api.onrender.com](https://www.zero.xyz/host/x402-safe-upgrade-api.onrender.com/llms.txt)