Package facts for agents that write code — latest version, licence, deprecation and known vulnerabilities across npm, PyPI and crates.io. Live from each registry, nothing cached. Pay-per-call in USDC on Base (x402 v1+v2).
| Endpoint | Price | What it returns |
|---|---|---|
| /package?ecosystem=npm&name=express | $0.001 | Latest version, licence, deprecation, repo, dependency count |
| /vulns?ecosystem=npm&name=lodash&version=4.17.20 | $0.002 | Known advisories with the versions that fix them |
| /audit?ecosystem=npm&name=express | $0.004 | One verdict: safe to add, or the specific concerns |
Payment: send an X-PAYMENT header (x402 exact scheme, USDC on Base). Without it, paid routes return a 402 challenge. Free: /health, /sources, /llms.txt, /server.json, /openapi.json. An unknown package returns not_found and is not charged. A clean audit verdict means nothing was found in these sources — not a security guarantee.