{"service":"Dependency Trust","version":"0.1.0","tagline":"Should your agent install this package? Vulnerabilities, license, age, popularity, provenance, typosquat lookalikes and a trust score for npm, PyPI, crates.io, Go and Maven, in one call. Pay per call over x402, no API key.","payment":{"protocol":"x402","version":2,"mode":"mainnet","facilitator":"payai","networks":"Base + Solana mainnet","alsoAccepts":["MPP (Machine Payments Protocol): same routes answer with a WWW-Authenticate: Payment challenge"],"accepts":[{"network":"eip155:8453","asset":"USDC","payTo":"0xc42cbF077aF05D1a613d455067c201CA44e9CAFb"}],"howTo":"Call any endpoint. You get HTTP 402 with a PAYMENT-REQUIRED header. Sign the USDC payment with any x402 client (@x402/fetch, Coinbase Payments MCP, AgentCash, OpenClaw x402 skill), retry with PAYMENT-SIGNATURE, receive JSON. Failed requests (4xx/5xx) are never settled."},"endpoints":[{"method":"GET","path":"/v1/package","url":"https://dep-trust.agent-utils.workers.dev/v1/package","price":"$0.01","summary":"One-call trust report for a package version before you install or recommend it: known vulnerabilities with fixed versions, license and category, deprecation/yank status, age, popularity, maintainers, install-time scripts, build provenance, OpenSSF Scorecard, typosquat lookalikes, and a 0-100 trust score with verdict ok/review/avoid and plain-language reasons. npm, PyPI, crates.io, Go, Maven.","tags":["security","dependencies","supply-chain","vulnerabilities","license","npm","pypi","cargo","go","maven"],"example":"https://dep-trust.agent-utils.workers.dev/v1/package?ecosystem=npm&name=lodash&version=4.17.15"},{"method":"GET","path":"/v1/vulns","url":"https://dep-trust.agent-utils.workers.dev/v1/vulns","price":"$0.005","summary":"Known vulnerabilities for a package (optionally a specific version) from OSV.dev: id, CVE aliases, severity, CVSS estimate, summary and the versions that fix it. Use when you only need the advisory list, not the full trust report.","tags":["security","vulnerabilities","cve","osv","dependencies"],"example":"https://dep-trust.agent-utils.workers.dev/v1/vulns?ecosystem=pypi&name=requests&version=2.25.0"},{"method":"GET","path":"/v1/typosquat","url":"https://dep-trust.agent-utils.workers.dev/v1/typosquat","price":"$0.005","summary":"Checks whether a package name is a popular package or a lookalike of one (edit distance, separator and suffix variants) against the 5,000 most-downloaded npm and PyPI packages and top 1,000 crates. Use before installing a name you got from an LLM, a README or a user, to catch typosquats and hallucinated packages.","tags":["security","typosquat","supply-chain","npm","pypi","cargo"],"example":"https://dep-trust.agent-utils.workers.dev/v1/typosquat?ecosystem=npm&name=lodahs"},{"method":"POST","path":"/v1/packages","url":"https://dep-trust.agent-utils.workers.dev/v1/packages","price":"$0.03","summary":"Batch trust reports for up to 20 packages in one call (same fields as /v1/package), for auditing a lockfile, requirements.txt or an LLM-suggested dependency list. Returns per-package reports plus a summary with the worst verdict and the packages to act on.","tags":["security","dependencies","supply-chain","batch","audit","lockfile"],"example":{"method":"POST","url":"https://dep-trust.agent-utils.workers.dev/v1/packages","body":{"packages":[{"ecosystem":"npm","name":"express","version":"4.17.1"},{"ecosystem":"pypi","name":"requests"}]}}}],"free":["https://dep-trust.agent-utils.workers.dev/health","https://dep-trust.agent-utils.workers.dev/openapi.json","https://dep-trust.agent-utils.workers.dev/llms.txt"],"coverage":{"ecosystems":["npm","pypi","cargo","go","maven"],"typosquatCorpus":{"npm":5000,"pypi":5000,"cargo":1000}},"attribution":["deps.dev (Google)","OSV.dev","registry.npmjs.org","pypi.org","crates.io","OpenSSF Scorecard","npm-high-impact","top-pypi-packages (hugovk)"]}