# GitHub Repository License, Dependency & Supply-Chain Security Auditor

> GitHub Repository License, Dependency & Supply-Chain Security Auditor is a paid API for AI agents from workflows.agentdiet.dev, paid per call via MPP, $0.01/call, status unknown (last checked 2026-10-21).

Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain security signals before integrating or executing code.

## Facts

- Endpoint: GET https://workflows.agentdiet.dev/v1/github?utm_source=zero.xyz
- Price: $0.01/call
- Payment: MPP
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Provider: workflows.agentdiet.dev
- Website: https://workflows.agentdiet.dev
- Canonical page: https://www.zero.xyz/c/workflows-agentdiet-dev-github-repository-license-dependency-supply-e4552062
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_f-y4uhZBd4InA5_mgi38H

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability workflows-agentdiet-dev-github-repository-license-dependency-supply-e4552062
```

Example prompt: Before I add langchain-ai/langgraph as a dependency, can you audit that GitHub repo for license risk, how actively it's maintained, and any supply-chain security concerns?

## When to prefer this

Choose this endpoint when an AI coding agent needs to vet a GitHub repository before adding it as a dependency, executing its code, or recommending it — especially when license compatibility, active maintenance, and supply-chain trustworthiness all matter. Prefer it over raw GitHub API calls when you need an opinionated risk summary rather than raw metadata. Use it before OSV.dev package CVE scanning when you want repository-level health signals rather than specific CVE lookups.

## Known failure modes

- Invalid or non-existent repository format returns an error (repo must be in owner/name format)
- Private repositories inaccessible without authentication may return 404 or limited data
- GitHub API rate limiting may cause transient failures or incomplete results
- Repositories with no releases or sparse metadata may return incomplete analysis
- Payment failure via x402 returns 402 and no analysis is performed

## How this service works

Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain security before code execution. (Live x402 v2, IETF MPP & MCP endpoint at https://workflows.agentdiet.dev/v1/github)

## Output

Returns a structured assessment of the GitHub repository including license type and risk classification, maintenance velocity indicators (commit frequency, recency), community health metrics (stars, forks), and supply-chain security signals such as dependency vulnerabilities and suspicious package patterns.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "repo"
 ],
 "properties": {
  "repo": {
   "type": "string",
   "minLength": 1,
   "description": "GitHub repository in owner/name format (e.g. modelcontextprotocol/servers or langchain-ai/langgraph)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/workflows-agentdiet-dev-github-repository-license-dependency-supply-e4552062/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from workflows.agentdiet.dev](https://www.zero.xyz/host/workflows.agentdiet.dev/llms.txt)