# Tolca Package Security Check

> Tolca Package Security Check is a paid API for AI agents from tolca.tonbot.ca, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-13).

Checks an npm or PyPI package for known vulnerabilities, license info, and version freshness, returning a scored safety verdict.

## Facts

- Endpoint: POST https://tolca.tonbot.ca/v1/pkg-check?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tolca-package-security-check-05bf2288
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZgHRGrk5hvfj2zrkaqORD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tolca-package-security-check-05bf2288 -d '<json body>'
```

Example prompt: Can you check if lodash version 4.17.20 on npm is safe to use — I need to know about any vulnerabilities and whether I should upgrade before adding it to my project?

## When to prefer this

Use this endpoint when an AI agent needs to programmatically vet a specific npm or PyPI package before installation, in a CI/CD pipeline, or during dependency auditing workflows. It is preferable over manual CVE searches when you need a machine-readable score and verdict in a single call, and when you want both vulnerability data and license/version freshness combined. Best suited for agents automating software supply chain decisions at $0.02 per check.

## Known failure modes

- Package not found in the specified ecosystem — returns error or empty result
- Unsupported ecosystem value (only 'npm' and 'PyPI' are accepted)
- Invalid or malformed package name — request rejected
- Specified version does not exist — may fall back to latest or return error
- Vulnerability database temporarily unavailable — score may be incomplete
- Payment failure over x402 — call not processed

## How this service works

Pay-per-call services for AI agents over x402 (USDC on Base).

## Output

Returns a numeric security score (0-100), a verdict (e.g. 'safe', 'caution', 'unsafe'), a list of reasons, a recommendation string, known vulnerabilities with IDs/severities/fix versions, and package facts including license, latest version, and weekly downloads.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "name",
      "ecosystem"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name as published"
      },
      "version": {
       "type": "string",
       "description": "Optional exact version; defaults to latest"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "PyPI"
       ],
       "type": "string"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "facts": {
   "license": "MIT",
   "latest_version": "4.17.21",
   "weekly_downloads": 50000000
  },
  "score": 55,
  "reasons": [
   "1 high/critical known vulnerability affecting this version",
   "a newer version exists (4.17.21)"
  ],
  "verdict": "caution",
  "recommendation": "Upgrade to 4.17.21 before installing.",
  "vulnerabilities": [
   {
    "id": "GHSA-p6mc-m468-83gw",
    "summary": "Prototype pollution in lodash",
    "fixed_in": "4.17.19",
    "severity": "HIGH"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tolca-package-security-check-05bf2288/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tolca.tonbot.ca](https://www.zero.xyz/host/tolca.tonbot.ca/llms.txt)