# Saylor Innovations Data Desk – Package Dependency Risk

> Saylor Innovations Data Desk – Package Dependency Risk is a paid API for AI agents from saylorinnovations.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-27).

Returns security advisories, license info, release age, OpenSSF Scorecard, and risk flags for a package across npm, PyPI, Go, Maven, Cargo, or NuGet ecosystems

## Facts

- Endpoint: GET https://saylorinnovations.com/api/registry/deps/npm/:system?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/saylor-innovations-data-desk-package-dependency-risk-d4a7dea2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_j853Ns98DPV0QtwHWNlF_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability saylor-innovations-data-desk-package-dependency-risk-d4a7dea2
```

Example prompt: Can you pull the dependency risk report for the 'lodash' npm package — I want to see its advisories, license, OpenSSF Scorecard, and any risk flags before we add it to our project?

## When to prefer this

Choose this endpoint when you need a one-call consolidated risk snapshot for an open-source package — combining advisories, license, scorecard, and release freshness — without having to aggregate multiple registries or APIs yourself. Ideal for CI/CD gates, agent-driven dependency audits, or compliance checks across all major package ecosystems (npm, PyPI, Go, Maven, Cargo, NuGet).

## Known failure modes

- Unknown package name returns empty or 404-style response
- Invalid system value (anything other than npm/pypi/go/maven/cargo/nuget) returns an error
- Maven packages require group:artifact format; omitting the group causes lookup failure
- Rate limiting or payment failure returns 402 or 429 error
- Package exists but has no scorecard data — scorecard fields return null
- Network timeout for packages with very large version histories

## How this service works

Package dependency risk - deps.dev advisories, license, release age, OpenSSF Scorecard and risk flags for an npm, PyPI, Go, Maven, Cargo or NuGet package

## Output

A JSON object containing: package system and name, overall risk level, list of security advisories (with count), license identifiers, OpenSSF Scorecard score and date, risk flags, deprecation status, source repository URL, star and fork counts, open issue count, version count, publication timestamp, and the timestamp when the check was run.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "pathParams"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object",
     "required": [
      "system",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name after the system (maven: group:artifact)"
      },
      "system": {
       "type": "string",
       "description": "npm, pypi, go, maven, cargo or nuget in the path"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "required": [
      "system",
      "name",
      "risk_level"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Name"
      },
      "forks": {
       "type": [
        "number",
        "null"
       ]
      },
      "stars": {
       "type": [
        "number",
        "null"
       ],
       "description": "Star count"
      },
      "source": {
       "type": [
        "string",
        "null"
       ],
       "description": "Data source the values come from"
      },
      "system": {
       "type": "string",
       "description": "Package system"
      },
      "licenses": {
       "type": "array",
       "items": {
        "type": "string"
       },
       "description": "License identifiers"
      },
      "advisories": {
       "type": [
        "array",
        "null"
       ],
       "description": "Advisories issued"
      },
      "checked_at": {
       "type": [
        "string",
        "null"
       ],
       "description": "Time the check was run (UTC)"
      },
      "deprecated": {
       "type": [
        "boolean",
        "null"
       ],
       "description": "True when the package is deprecated"
      },
      "risk_flags": {
       "type": "array",
       "items": {
        "type": "string"
       },
       "description": "Risk flags raised"
      },
      "risk_level": {
       "type": "string",
       "description": "Risk level"
      },
      "open_issues": {
       "type": [
        "nu
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/saylor-innovations-data-desk-package-dependency-risk-d4a7dea2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from saylorinnovations.com](https://www.zero.xyz/host/saylorinnovations.com/llms.txt)