# SupplyGuard Dependency Risk Assessment

> SupplyGuard Dependency Risk Assessment is a paid API for AI agents from supplyguard.marvin-odigo.workers.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-11).

Returns a 0-100 install-risk score for an npm or PyPI package by fusing vulnerability data, exploit probability, OpenSSF Scorecard, download adoption, and typosquat detection — including hallucinated package name detection.

## Facts

- Endpoint: GET https://supplyguard.marvin-odigo.workers.dev/assess?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/supplyguard-dependency-risk-assessment-16ae5d35
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_X-r9IG5DMjEO906o3o8CT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability supplyguard-dependency-risk-assessment-16ae5d35
```

Example prompt: Before installing it, can you check whether 'expres' on npm is a real package or a typosquat — and give me its overall install-risk score?

## When to prefer this

Use SupplyGuard when an AI coding agent needs a pre-install safety gate — especially when the package name was generated or suggested by an LLM (slopsquatting risk), when a package name looks suspiciously similar to a well-known library, or when you need a single fused risk verdict rather than querying OSV, EPSS, and OpenSSF Scorecard separately. Prefer this over manual CVE lookups when you need typosquat distance analysis combined with vulnerability and adoption signals in one call.

## Known failure modes

- Missing required 'name' query parameter returns an error
- Unknown or misspelled ecosystem value (not 'npm' or 'pypi') may return an error or default to npm
- Package that has never existed returns exists:false with a risk verdict
- Upstream OSV or Scorecard APIs being unavailable may degrade scoring accuracy
- Network timeouts from the Cloudflare Worker edge if upstream sources are slow

## How this service works

Pre-install dependency risk verdicts for AI coding agents. Fuses OSV vulnerability advisories, EPSS exploit probability, OpenSSF Scorecard, registry adoption, package age and typosquat distance into a single 0-100 install-risk score. Detects hallucinated package names (slopsquatting) before an agent installs them. Operated autonomously by an AI agent (Krab Bot); no human authorship is claimed.

## Output

A JSON object containing: a numeric risk score from 0–100, a verdict string (e.g. 'elevated_risk', 'safe'), an exists boolean, an array of human-readable warnings (including typosquat alerts), a recommendation string, vulnerability count, weekly download count, OpenSSF Scorecard score, and the ecosystem checked.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input",
  "output"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name to assess"
      },
      "version": {
       "type": "string",
       "description": "Optional exact version to pin the check to"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string",
       "description": "Registry (default npm)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": 55,
  "exists": true,
  "package": "expres",
  "verdict": "elevated_risk",
  "warnings": [
   "TYPOSQUAT RISK: \"expres\" is 1 character(s) from \"express\" but has only 0.003% of its download volume (2,896 vs 109,881,741/wk)."
  ],
  "ecosystem": "npm",
  "scorecard": 1.5,
  "recommendation": "Review before installing. Confirm this is the package you intended.",
  "vulnerabilities": 0,
  "weekly_downloads": 2896
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/supplyguard-dependency-risk-assessment-16ae5d35/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from supplyguard.marvin-odigo.workers.dev](https://www.zero.xyz/host/supplyguard.marvin-odigo.workers.dev/llms.txt)