{"name":"markedet package check","version":"0.4.0","provider":"markedet","what":"Package check for coding agents, before pip or npm install. Send a package list or a whole lockfile (requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml, yarn.lock) and get ok, caution or block per package: does the package exist, how old is it, how many releases and maintainers, weekly downloads, known vulnerabilities (OSV) for the given or latest version, typosquat and slopsquat signals (edit distance to the top 2000 packages, npm security holding, malicious-package advisories, install scripts, no repository), and a verdict ok, caution or block with reasons. PyPI and npm. First 50 packages per payer wallet free. Free self-test against a published, hashed known-answer set.","price":{"per_package_usd":"0.002","per_package_atomic_usdc":"2000","max_packages_per_call":500,"asset":"USDC","network":"eip155:8453","protocol":"x402 v2, scheme exact","testnet":false,"note":"amount = number of unique packages x price; invalid input is a free 422"},"free_trial":"First 50 packages per payer wallet are free: sign the payment as usual; the server verifies the signature (that identifies the wallet) and does not settle while the wallet is within the free 50. A call is free only if it fits in what is left (use limit to fit). About 50: the counter is in memory and resets when the server restarts. The wallet must hold enough USDC for the signature to verify; nothing moves.","lockfile_input":{"formats":["requirements.txt","poetry.lock","uv.lock","Pipfile.lock","package-lock.json","pnpm-lock.yaml","yarn.lock"],"field":"lockfile (raw text), optional lockfile_format, include_dev, limit","output":"results[] per unique package plus verdicts[] (package, verdict, lockfile lines, first reason)","free_parse":"https://package-check-qy40.onrender.com/parse","example":{"lockfile":"requests==2.32.3\nreqeusts\nflask>=3\n","lockfile_format":"requirements.txt"}},"latency":"Measured, not promised. GET /demo checks a fixed 79-package package-lock.json and reports check_wall_s on this host right now; /stats has median and p95 of real /check calls since the last restart. Lookups are cached for about 10 minutes, so a warm run is much faster than a cold one (first call after a restart or after idle).","endpoints":{"check":{"method":"POST","url":"https://package-check-qy40.onrender.com/check","paid":true},"parse":{"method":"POST","url":"https://package-check-qy40.onrender.com/parse","paid":false},"demo":"https://package-check-qy40.onrender.com/demo","selftest":"https://package-check-qy40.onrender.com/selftest","stats":"https://package-check-qy40.onrender.com/stats","openapi":"https://package-check-qy40.onrender.com/openapi.json","x402_discovery":"https://package-check-qy40.onrender.com/.well-known/x402","health":"https://package-check-qy40.onrender.com/health","llms_txt":"https://package-check-qy40.onrender.com/llms.txt","known_answers":"https://package-check-qy40.onrender.com/kat/known-answers-v1.jsonl","mcp":"https://package-check-qy40.onrender.com/mcp","agent_card":"https://package-check-qy40.onrender.com/.well-known/agent-card.json","a2a":"https://package-check-qy40.onrender.com/a2a","mcp_server_json":"https://package-check-qy40.onrender.com/server.json","guide":"https://package-check-qy40.onrender.com/guide"},"mcp":{"url":"https://package-check-qy40.onrender.com/mcp","transport":"streamable-http (stateless, JSON)","paid_tool":"check_packages","free_tool":"selftest","payment":"x402 MCP transport: params._meta['x402/payment']","client_config":{"mcpServers":{"package-check":{"url":"https://package-check-qy40.onrender.com/mcp"}}}},"input_schema":"https://package-check-qy40.onrender.com/openapi.json#/components/schemas/CheckRequest","example_input":{"packages":[{"ecosystem":"pypi","name":"reqeusts"},{"ecosystem":"npm","name":"lodash","version":"4.17.15"}]},"how_to_pay":["1. POST https://package-check-qy40.onrender.com/check with the JSON body and no payment header. You get 402 with a PAYMENT-REQUIRED header (base64 JSON) and the same challenge in the body: accepts[0] has amount (atomic USDC), payTo, asset, network.","2. Sign an EIP-3009 transferWithAuthorization for that amount with an x402 client (Python package x402, TypeScript @x402/fetch or @x402/axios). Nothing moves until the server settles.","3. Repeat the same POST with header PAYMENT-SIGNATURE: <base64 payload>. The result comes back with a PAYMENT-RESPONSE header carrying the settlement transaction. If every package lookup fails, you are not charged."],"curl_example":"curl -si -X POST https://package-check-qy40.onrender.com/check -H 'content-type: application/json' -d '{\"packages\": [{\"ecosystem\": \"pypi\", \"name\": \"reqeusts\"}, {\"ecosystem\": \"npm\", \"name\": \"lodash\", \"version\": \"4.17.15\"}]}'","python_example":"import asyncio, os\nfrom eth_account import Account\nfrom x402 import x402Client\nfrom x402.http.clients import x402HttpxClient\nfrom x402.mechanisms.evm.exact import register_exact_evm_client\nfrom x402.mechanisms.evm.signers import EthAccountSigner\n\nasync def main():\n    c = x402Client()\n    register_exact_evm_client(c, EthAccountSigner(Account.from_key(os.environ[\"EVM_PRIVATE_KEY\"])))  # wallet with USDC on Base\n    async with x402HttpxClient(c, timeout=60) as http:\n        r = await http.post(\"https://package-check-qy40.onrender.com/check\", json={'packages': [{'ecosystem': 'pypi', 'name': 'reqeusts'}, {'ecosystem': 'npm', 'name': 'lodash', 'version': '4.17.15'}]})\n        print(r.status_code, r.json()[\"summary\"])\n\nasyncio.run(main())","limits":["PyPI and npm only. A lockfile is parsed for names and exact versions; nothing is resolved or installed. In requirements.txt a range (requests>=2) is checked against the latest release; git, URL, path and workspace entries are skipped and listed.","Price is per unique package after parsing; at most 500 unique packages per call (POST /parse is free and shows the count).","Free trial: about 50 packages per payer wallet; the counter lives in memory and resets when the server restarts.","Latency is measured, not promised: see LATENCY in the guide and live numbers at /stats. Cold lookups of hundreds of packages take seconds.","Typosquat detection by name compares against the top 2000 packages per ecosystem.","A clean ok is not a guarantee: a new malicious package with no advisory yet can pass.","Live registry data; verdicts can change over time.","Runs on Render Free: after ~15 minutes idle the first call takes ~30-60 s (cold start)."],"source":"https://bitbucket.org/markedet/package-check","license":"MIT"}