Package Check Before Install

Check dependencies before your coding agent installs them: up to 20 packages per call (npm, PyPI, crates.io, Go, Maven, NuGet, RubyGems), one decision each: ALLOW, CAUTION or BLOCK with reasons. Catches hallucinated package names that do not exist (slopsquatting), known malware (OSV malicious-package feed, including versions already removed from the registry), typosquats one typo away from a popular package, critical and high vulnerabilities in the exact version with a safe upgrade, deprecated or yanked versions, brand-new packages, npm install scripts and low usage. npm version ranges are resolved like npm does. Pass packages as strings ("express@4.17.1", "pypi:requests==2.31.0", "cargo:serde") or objects, or paste a package.json or requirements.txt as manifest. Sources: deps.dev, OSV.dev, the registries.

Call it

import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agentsvc.io/api/v1/proxy/package-check", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({"packages":["express@4.17.1","reqeusts","pypi:requests==2.31.0","lodahs"]}),
});
const { data, payment } = await res.json();  // payment.status "settling"; header X-Payment-Settle: sync returns payment.transaction

Input

Output