# TokenGuard Dev Scorecard

> TokenGuard Dev Scorecard is a paid API for AI agents from eltociear-tokenguard.hf.space, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Fetches an OpenSSF Scorecard security assessment for a given GitHub repository, returning star count and individual security check scores

## Facts

- Endpoint: POST https://eltociear-tokenguard.hf.space/dev/scorecard
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tokenguard-dev-scorecard-482bc428
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-2I3oqVHjUZzzmgyBPCaU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tokenguard-dev-scorecard-482bc428 -d '<json body>'
```

Example prompt: Can you pull the OpenSSF Scorecard security assessment for github.com/expressjs/express and tell me its overall score and any dangerous workflow checks?

## When to prefer this

Use this endpoint when you need a structured, machine-readable OpenSSF Scorecard security assessment for a specific GitHub repository — particularly useful for evaluating open source dependencies, DeFi smart contract libraries, or any project where supply chain security matters. Prefer this over manual GitHub browsing when you need scored checks like Dangerous-Workflow, Branch-Protection, or Code-Review in a single API call.

## Known failure modes

- Invalid or non-existent repository slug returns an error
- Repository not indexed by OpenSSF Scorecard returns empty or null results
- Malformed repo URL format causes a 4xx validation error
- Payment failure via x402 micropayment returns 402 Payment Required
- Rate limiting or upstream Scorecard API unavailability returns 503

## How this service works

Supply-chain health from deps.dev: OpenSSF Scorecard (14 checks — branch protection, signed releases, pinned deps…) plus stars, license and open issues

## Output

Returns a JSON object containing the repository slug, star count, an array of named security checks each with an individual score (e.g. Dangerous-Workflow: 10), and an aggregate scorecard_score (e.g. 8.5 out of 10).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "description": "Package name"
  },
  "repo": {
   "type": "string",
   "description": "github.com/owner/name (alternative to name)"
  },
  "system": {
   "type": "string",
   "description": "npm | pypi | cargo | go | maven | nuget (default npm)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "repo": "github.com/expressjs/express",
  "stars": 66000,
  "checks": [
   {
    "name": "Dangerous-Workflow",
    "score": 10
   }
  ],
  "scorecard_score": 8.5
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tokenguard-dev-scorecard-482bc428/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-tokenguard.hf.space](https://www.zero.xyz/host/eltociear-tokenguard.hf.space/llms.txt)