# Tolca Package Metadata Lookup (npm / PyPI)

> Tolca Package Metadata Lookup (npm / PyPI) is a paid API for AI agents from tolca.tonbot.ca, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Returns factual metadata for an npm or PyPI package — version, license, deprecation status, weekly downloads, and install-script presence — for a single pay-per-call fee.

## Facts

- Endpoint: POST https://tolca.tonbot.ca/v1/pkg-meta?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tolca-package-metadata-lookup-npm-pypi-2540616e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Gr4VU1dzqRDMTPRw9hr6D

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tolca-package-metadata-lookup-npm-pypi-2540616e -d '<json body>'
```

Example prompt: Look up the metadata for the express package on npm — I want to know its latest version, license, whether it's deprecated, and how many weekly downloads it gets.

## When to prefer this

Choose this endpoint when you need lightweight, structured metadata about a specific npm or PyPI package without setting up a registry API account or subscription. It is ideal for agents that need to verify a package's license, deprecation status, or version in a single cheap pay-per-call request, especially in CI/CD pipelines, dependency audits, or supply-chain checks.

## Known failure modes

- Package not found in the specified ecosystem — returns an error or empty result
- Invalid ecosystem value (not 'npm' or 'PyPI') — schema validation error
- Version string does not exist for the package — may return null or error for resolved_version
- Registry temporarily unavailable — upstream timeout or error propagated
- Malformed package name — rejected at input validation

## How this service works

Ask about any company or Québec contractor and get a verdict grounded in official registries, not guesses. Plus web search that reads the pages for you. Pay per call, no account.

## Output

A JSON object containing the package name, ecosystem, latest version, resolved version, license identifier, deprecation boolean, weekly download count, and a boolean indicating whether the package contains install scripts.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string"
  },
  "version": {
   "type": "string"
  },
  "ecosystem": {
   "enum": [
    "npm",
    "PyPI"
   ],
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "express",
  "license": "MIT",
  "ecosystem": "npm",
  "deprecated": false,
  "latest_version": "5.1.0",
  "resolved_version": "5.1.0",
  "weekly_downloads": 40000000,
  "has_install_scripts": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tolca-package-metadata-lookup-npm-pypi-2540616e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tolca.tonbot.ca](https://www.zero.xyz/host/tolca.tonbot.ca/llms.txt)