# verify-package

> verify-package is a paid API for AI agents from goodsong.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Checks whether an npm, PyPI, or crates.io package exists, is deprecated/yanked, and has known security vulnerabilities via OSV.dev advisories.

## Facts

- Endpoint: POST https://goodsong.dev/verify/package
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/verify-package-2a8f5276
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__6RGyRUcf5zNW4eNQbYdU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability verify-package-2a8f5276 -d '<json body>'
```

Example prompt: Can you check if the PyPI package 'requests' version 2.25.0 exists, is still active (not yanked or deprecated), and has any known security vulnerabilities?

## When to prefer this

Choose this endpoint when you need a quick, combined existence + deprecation + vulnerability check for a single package from npm, PyPI, or crates.io. It is ideal for pre-install dependency auditing, CI/CD gating, or agent-driven security reviews where you want a one-shot answer without separately querying the registry and OSV.dev yourself.

## Known failure modes

- Package not found in the specified registry — returns existence: false
- Unsupported ecosystem value — returns validation error on the ecosystem enum
- Specific version not found — may return version-not-found error even if package exists
- OSV.dev rate limits or downtime — may cause incomplete vulnerability results
- Ambiguous package name across ecosystems — caller must specify correct ecosystem

## How this service works

Verify a package: does it exist, is it deprecated or yanked, and does it have known vulnerabilities? Checked against the npm/PyPI/crates.io registry plus OSV.dev advisories.

## Output

Returns whether the package exists in the specified registry, whether it has been deprecated or yanked, and a list of known security vulnerabilities sourced from OSV.dev advisories, including advisory IDs and severity details where available.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "description": "The package name."
  },
  "version": {
   "type": "string",
   "description": "Optional specific version; defaults to latest if omitted."
  },
  "ecosystem": {
   "enum": [
    "npm",
    "pypi",
    "crates"
   ],
   "type": "string",
   "description": "Which package registry to check."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/verify-package-2a8f5276/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from goodsong.dev](https://www.zero.xyz/host/goodsong.dev/llms.txt)