# vrsai Package Install Preflight > vrsai Package Install Preflight is a paid API for AI agents from api.vrsai.tech, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-13). Checks an exact npm or PyPI package version against registry, vulnerability, malicious-package, withdrawal, and provenance signals immediately before installation, returning ALLOW, REVIEW, BLOCK, or UNKNOWN with machine-readable reason codes. ## Facts - Endpoint: POST https://api.vrsai.tech/v1/capabilities/package_install_preflight?utm_source=zero.xyz - Price: $0.01/call - Payment: x402 - Status: unknown - Last checked: 2026-10-13 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/vrsai-package-install-preflight-af33e5e0 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qvhYjuLZ2FnylfvsUMmfb Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability vrsai-package-install-preflight-af33e5e0 -d '' ``` Example prompt: Before you install it, run a preflight safety check on npm package @colors/colors version 1.5.0 — I need to know if it's safe, withdrawn, or has any known vulnerabilities or malicious signals. ## When to prefer this Use this endpoint when you need a real-time, pre-installation safety gate for an exact npm or PyPI package version — particularly in automated CI/CD pipelines, agent-driven dependency resolution, or any workflow where installing a compromised or vulnerable package would have downstream consequences. It is preferable to static lock-file scanners when the package version is determined dynamically at runtime, or when you need fresh registry and vulnerability data at the moment of install rather than at audit time. Choose it over generic vulnerability databases when you need a single authoritative ALLOW/REVIEW/BLOCK decision that combines registry status, OSV vulnerabilities, malicious-package signals, and provenance attestation in one call. ## Known failure modes - Package not found in registry — may return UNKNOWN with reason code indicating absence - Network timeout to upstream registry or vulnerability database — evidence source marked with error status - Unsupported ecosystem — only npm and PyPI are supported; other ecosystems may return UNKNOWN - Invalid purl or version format — request rejected with validation error - Upstream OSV or deps.dev unavailable — partial evidence returned with unknowns populated - Ambiguous version specifier (range instead of exact) — may reject or return UNKNOWN ## How this service works Check an exact npm or PyPI package version immediately before installation using current registry, vulnerability, malicious-package, withdrawal/deprecation, and verified provenance evidence. Returns ALLOW, REVIEW, BLOCK, or UNKNOWN with machine-readable reasons. ## Output Returns a JSON object with a top-level decision field (ALLOW, REVIEW, BLOCK, or UNKNOWN), an array of reason_codes explaining the decision, a package object with name/version/ecosystem/purl, and a detailed observations section covering registry status (existence, yanked/deprecated, integrity, install scripts), vulnerability families and max severity, malicious package signals, provenance attestation details, and license information. Each evidence source (npm registry, OSV, deps.dev) is listed with latency, attempt count, and observed timestamp. An unknowns array lists any evidence gaps. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method", "bodyType", "body" ], "properties": { "body": { "type": "object" }, "type": { "type": "string", "const": "http" }, "method": { "enum": [ "POST" ], "type": "string" }, "bodyType": { "enum": [ "json", "form-data", "text" ], "type": "string" } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object" } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "package": { "name": "@colors/colors", "purl": "pkg:npm/%40colors/colors@1.5.0", "version": "1.5.0", "ecosystem": "npm" }, "decision": "ALLOW", "evidence": [ { "source": "npm_registry", "status": "OK", "attempts": 1, "latency_ms": 120, "observed_at": "2026-08-26T00:00:00.000Z" }, { "source": "osv", "status": "OK", "attempts": 1, "latency_ms": 240, "observed_at": "2026-08-26T00:00:00.000Z" }, { "source": "deps_dev", "status": "OK", "attempts": 1, "latency_ms": 90, "observed_at": "2026-08-26T00:00:00.000Z" } ], "unknowns": [], "observed_at": "2026-08-26T00:00:00.000Z", "observations": { "deps_dev": { "licenses": [ "MIT" ], "advisory_ids": [], "canonical_name": "@colors/colors", "canonical_version": "1.5.0" }, "registry": { "exists": true, "yanked": "NONE", "integrity": "sha512-fixture-integrity", "deprecated": false, "yanked_reasons": [], "install_scripts": [], "distribution_hashes": [], "repository_metadata": { "url": "https://github.com/Marak/colors.js", "verified": false } }, "provenance": { "verified": false, "attestation_types": [], "source_repositories": [], "expected_repository_match": "NOT_REQUESTED" }, "vulnerabilities": { "families": [], "family_count": 0, "max_severity": "NONE", "raw_record_count": 0, "malicious_package_signal": false }, "evidence_complete": true }, "reason_codes": [ "NO_BLOCKING_SIGNAL_OBSERVED" ], "policy_version": "balanced-2026-08-26", "input_fingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vrsai-package-install-preflight-af33e5e0/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from api.vrsai.tech](https://www.zero.xyz/host/api.vrsai.tech/llms.txt)