{"x402Version":2,"version":1,"name":"pkgpulse","description":"Dependency intelligence for AI coding agents, paid per call via x402 (USDC on Base): npm package health, typosquat checks, package comparison, dependency audits, known-vulnerability scans (npm, PyPI and more) and PyPI preflight.","network":"eip155:8453","asset":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"payTo":"0xc863b1c6658971ca427e90665dccce90a41a2bc2","openapi":"https://pkgpulse.letom1176.workers.dev/openapi.json","documentation":"https://pkgpulse.letom1176.workers.dev/llms.txt","free":["https://pkgpulse.letom1176.workers.dev/api/sample"],"resources":["https://pkgpulse.letom1176.workers.dev/api/package-health","https://pkgpulse.letom1176.workers.dev/api/typosquat-check","https://pkgpulse.letom1176.workers.dev/api/pick","https://pkgpulse.letom1176.workers.dev/api/deps-audit","https://pkgpulse.letom1176.workers.dev/api/vuln-check","https://pkgpulse.letom1176.workers.dev/api/vuln-audit","https://pkgpulse.letom1176.workers.dev/api/pypi-check","https://pkgpulse.letom1176.workers.dev/api/pypi-audit"],"endpoints":[{"resource":"https://pkgpulse.letom1176.workers.dev/api/package-health","method":"GET","price":"$0.005","description":"npm package health score (0-100) with a fully disclosed rubric: maintenance recency, adoption + download trend, license/repository/maintainer integrity, install-script and deprecation flags, GitHub context. Signals it could not fetch are listed, never hidden. The one call an agent makes before adding a dependency. Params: ?name=<package>. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/typosquat-check","method":"GET","price":"$0.003","description":"Typosquat / imitation check for an npm package name: edit distance + separator/affix/scope imitation patterns against curated popular packages, risk-graded with the package's own registry facts (age, adoption, install scripts). Catches hallucinated install commands and squat bait BEFORE npm install executes anything. Params: ?name=<package>. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/pick","method":"GET","price":"$0.015","description":"Rank up to 5 alternative npm packages and get a recommendation with the gap quantified: full disclosed-rubric health report per package, close calls flagged as close calls. The 'axios vs got vs undici' decision in one call. Params: ?names=a,b,c. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/deps-audit","method":"GET","price":"$0.015","description":"Audit a list of npm packages in one call: each name is checked for registry existence (hallucination guard), deprecation, install scripts, staleness and known vulnerabilities (OSV), with summary counts, worst offenders and per-package flags. GET ?names=express,lodash (up to 40), or POST a package.json. For a coding agent about to install dependencies. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/deps-audit","method":"POST","price":"$0.015","description":"Audit an entire dependency map in one call: POST a package.json (or {dependencies} map, or array of names) and every package is checked for registry existence (hallucination guard), deprecation, install scripts, staleness and known vulnerabilities for the version each range resolves to — summary counts, worst offenders, per-package flags. Up to 40 packages. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/vuln-check","method":"GET","price":"$0.003","description":"Known vulnerabilities for one package version via OSV.dev (GitHub Advisory DB, PyPA, Go, RustSec, OpenSSF malicious packages). npm and PyPI ranges resolve to the version the package manager installs; Go, crates.io, Maven, NuGet, RubyGems, Packagist checked as given. Severity, CVSS, CVEs, fix on your line, upgrade target. ?name=lodash&version=4.17.15&ecosystem=npm or ?purl=. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/vuln-audit","method":"GET","price":"$0.015","description":"Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/vuln-audit","method":"POST","price":"$0.015","description":"Vulnerability scan for a whole dependency set: POST a package-lock.json (every transitive package), package.json, requirements.txt, Pipfile.lock or a list. Up to 200 packages across npm, PyPI, Go, crates.io, Maven and more via OSV.dev: summary, worst offenders, per-package advisories with severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/pypi-check","method":"GET","price":"$0.003","description":"Python package preflight before pip install: does it exist on PyPI (hallucinated-name guard), does it imitate a popular project (typosquat check vs the top 1,000), latest and last release, yanked, wheel or source-only, license, downloads, and known vulnerabilities for the version pip would install. ?name=requests&version=>=2.28. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/pypi-audit","method":"GET","price":"$0.01","description":"Audit Python dependencies in one call: GET ?names=requests==2.19.0,numpy,reqeusts (or POST a requirements.txt). Each project is checked for existence on PyPI (hallucination guard), imitation of popular projects, staleness and known vulnerabilities for the version pip would install, with summary counts, worst offenders and per-package flags. Up to 30. Errors are not charged. JSON.","mimeType":"application/json"},{"resource":"https://pkgpulse.letom1176.workers.dev/api/pypi-audit","method":"POST","price":"$0.01","description":"Audit a requirements.txt in one call: POST the file as text (or {requirements: \"...\"}, a Pipfile.lock, or a list). Each project is checked for existence on PyPI (hallucination guard), imitation of popular projects, staleness and known vulnerabilities for the version pip would install, with summary counts, worst offenders and per-package flags. Up to 30. Errors are not charged. JSON.","mimeType":"application/json"}],"instructions":"Request any resource without payment to receive an HTTP 402 with x402 v2 requirements in the PAYMENT-REQUIRED header. Free sample at /api/sample."}