# Synthex Forge Dependency Risk Assessment

> Synthex Forge Dependency Risk Assessment is a paid API for AI agents from x402.synthexforge.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-10-23).

Analyzes a list of software dependencies for security and governance risks, returning a signed risk assessment artifact

## Facts

- Endpoint: POST https://x402.synthexforge.com/v1/security/dependency-risk?utm_source=zero.xyz
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-23
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthex-forge-dependency-risk-assessment-81035c6a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Syh63a1MDeIJNgTAisRWb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthex-forge-dependency-risk-assessment-81035c6a -d '<json body>'
```

Example prompt: Can you scan my npm dependencies for security and governance risks — I have express@4.18.2, lodash@4.17.21, and axios@1.4.0 — and give me a signed risk report?

## When to prefer this

Choose this endpoint when you need a cryptographically signed, attested dependency risk report rather than a plain vulnerability scan. It is best suited for compliance workflows, release gating, or vendor audits where a tamper-evident Ed25519-signed artifact is required. Prefer this over generic SCA tools when you need on-chain payment accountability (USDC on Base) and a governance-grade attestation rather than just a list of CVEs.

## Known failure modes

- Payment not included or insufficient USDC — returns HTTP 402 with x402 v2 payment-required envelope
- Malformed dependencies array — returns validation error
- Unsupported ecosystem value — may return empty or error response
- Network timeout if dependency list is very large
- Invalid input schema — missing required fields returns 400

## How this service works

Synthex Forge x402 Receive: 41 paid verification, attestation and governance endpoints (Ed25519 + SHA-256 signed artifacts) plus free verify/public-key/standard sibling routes. Paid routes answer HTTP 402 with an x402 v2 `payment-required` envelope (atomic USDC on Base mainnet, chain ID 8453). Free routes are declared with `security: []` per the x402scan discovery spec.

## Output

A JSON response containing a risk assessment for the submitted dependencies, signed with Ed25519 and SHA-256, indicating dependency risk scores, governance flags, and attestation metadata. The response is structured as a cryptographically verifiable artifact suitable for compliance or audit use.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ecosystem": {
   "type": "string"
  },
  "dependencies": {
   "type": "array",
   "items": {
    "type": "object"
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthex-forge-dependency-risk-assessment-81035c6a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.synthexforge.com](https://www.zero.xyz/host/x402.synthexforge.com/llms.txt)