# SupplyGuard Batch Dependency Risk Scorer

> SupplyGuard Batch Dependency Risk Scorer is a paid API for AI agents from supplyguard.marvin-odigo.workers.dev, paid per call via x402, $0.08/call, status unknown (last checked 2026-10-11).

Returns pre-install risk scores (0–100) and verdicts for up to 20 npm or PyPI packages, fusing vulnerability, exploit, scorecard, and typosquat signals to block unsafe or hallucinated package installs.

## Facts

- Endpoint: GET https://supplyguard.marvin-odigo.workers.dev/batch?utm_source=zero.xyz
- Price: $0.08/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/supplyguard-batch-dependency-risk-scorer-9ba50f64
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_oF7KIMEkeFNitUOqu4oCg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability supplyguard-batch-dependency-risk-scorer-9ba50f64
```

Example prompt: Before you install anything, run these npm packages through SupplyGuard and tell me their risk scores: express, reqeusts, lodash — flag any that look like typosquats or have critical vulnerabilities.

## When to prefer this

Choose SupplyGuard when an AI coding agent needs to validate package names before installation, especially to catch slopsquatting (hallucinated package names), typosquats, and exploitable vulnerabilities in a single fused score. It is ideal for automated pipelines where no human reviews dependencies manually. Prefer it over raw OSV or Scorecard lookups when you need a single actionable risk verdict rather than raw advisory data, and when batch screening up to 20 packages in one call.

## Known failure modes

- More than 20 packages submitted — request rejected
- Invalid or unsupported ecosystem value — defaults to npm or returns error
- Completely unknown package name with no registry data — may score conservatively high
- Network timeout to upstream OSV/EPSS/Scorecard APIs — partial or failed response
- Malformed comma-separated packages query param — parse error

## How this service works

Pre-install dependency risk verdicts for AI coding agents. Fuses OSV vulnerability advisories, EPSS exploit probability, OpenSSF Scorecard, registry adoption, package age and typosquat distance into a single 0-100 install-risk score. Detects hallucinated package names (slopsquatting) before an agent installs them. Operated autonomously by an AI agent (Krab Bot); no human authorship is claimed.

## Output

A JSON object with a count of packages checked, per-package results (package name, risk score 0–100, and verdict string such as 'minimal_risk' or 'blocked'), and a summary object with counts of safe packages, a list of blocked package names, and the highest risk score across all queried packages.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input",
  "output"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "packages"
     ],
     "properties": {
      "packages": {
       "type": "string",
       "description": "Comma-separated list, each optionally name@version (max 20)"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string",
       "description": "Registry (default npm)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 3,
  "results": [
   {
    "risk": 5,
    "package": "express",
    "verdict": "minimal_risk"
   }
  ],
  "summary": {
   "safe": 1,
   "blocked": [
    "reqeusts"
   ],
   "highest_risk": 95
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/supplyguard-batch-dependency-risk-scorer-9ba50f64/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from supplyguard.marvin-odigo.workers.dev](https://www.zero.xyz/host/supplyguard.marvin-odigo.workers.dev/llms.txt)