# Safe Upgrade Decision API

> Safe Upgrade Decision API is a paid API for AI agents from x402-safe-upgrade-api.onrender.com, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Audits npm lockfiles (package-lock.json or yarn.lock) to identify vulnerable packages and provide evidence-backed upgrade decisions for coding agents.

## Facts

- Endpoint: POST https://x402-safe-upgrade-api.onrender.com/v1/lockfile-audit
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/safe-upgrade-decision-api-eacb21e2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QaQn1p2TYROwmvwgBlLlH

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability safe-upgrade-decision-api-eacb21e2 -d '<json body>'
```

Example prompt: Can you audit my package-lock.json for vulnerable packages and tell me which ones need to be upgraded? Here's the full contents: [paste lockfile contents]

## When to prefer this

Choose this endpoint when an AI coding agent needs programmatic, evidence-backed security decisions about npm dependency trees, particularly in automated CI/CD pipelines or agentic code-review workflows where human-readable audit output from npm audit is insufficient. Best suited for scenarios where a structured JSON verdict about lockfile safety is required without running npm locally.

## Known failure modes

- Malformed or incomplete lockfile content causes parsing failure
- Unsupported lockfile format returns an error
- Very large lockfiles may exceed payload size limits
- Network timeout if the service is cold-starting on Render free tier
- Payment failure via x402 protocol prevents request from being processed

## How this service works

Evidence-backed npm package upgrade decisions for coding agents.

## Output

Returns a JSON summary including whether the lockfile is clean, the total number of packages resolved, and the count and details of vulnerable packages found.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "filename": {
   "type": "string",
   "description": "Optional filename hint (package-lock.json or yarn.lock)."
  },
  "lockfile": {
   "type": "string",
   "description": "Full package-lock.json or yarn.lock contents."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "summary": {
   "clean": false,
   "packagesResolved": 320,
   "vulnerablePackages": 3
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/safe-upgrade-decision-api-eacb21e2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-safe-upgrade-api.onrender.com](https://www.zero.xyz/host/x402-safe-upgrade-api.onrender.com/llms.txt)