{"openapi":"3.1.0","info":{"title":"markedet package check","version":"0.4.0","description":"Package check for coding agents, before pip or npm install. Send a package list or a whole lockfile (requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml, yarn.lock) and get ok, caution or block per package: does the package exist, how old is it, how many releases and maintainers, weekly downloads, known vulnerabilities (OSV) for the given or latest version, typosquat and slopsquat signals (edit distance to the top 2000 packages, npm security holding, malicious-package advisories, install scripts, no repository), and a verdict ok, caution or block with reasons. PyPI and npm. First 50 packages per payer wallet free. Free self-test against a published, hashed known-answer set.","x-guidance":"Use POST /check before installing packages. JSON body: {\"packages\": [{\"ecosystem\": \"pypi\" or \"npm\", \"name\": \"...\", \"version\": \"exact, optional\"}]}, 1 to 500 items, or {\"lockfile\": \"<raw requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml or yarn.lock>\"} (unique packages, optional limit). POST /parse is free and quotes the count. First 50 packages per payer wallet are free: sign the payment as usual; the server verifies the signature (that identifies the wallet) and does not settle while the wallet is within the free 50. A call is free only if it fits in what is left (use limit to fit). About 50: the counter is in memory and resets when the server restarts. The wallet must hold enough USDC for the signature to verify; nothing moves. Price is $0.002 per package in USDC via x402 (the 402 quotes the exact amount). Each result has verdict ok, caution or block with reasons; treat block as do-not-install. GET /selftest is free and shows the known-answer score.","contact":{"name":"markedet","email":"novusops@mail.grokbot.com","url":"https://bitbucket.org/markedet/package-check"},"license":{"name":"MIT","url":"https://bitbucket.org/markedet/package-check/src/main/LICENSE"}},"servers":[{"url":"https://package-check-qy40.onrender.com"}],"externalDocs":{"url":"https://bitbucket.org/markedet/package-check","description":"source and README"},"paths":{"/check":{"post":{"operationId":"checkPackages","summary":"Check PyPI/npm packages or a whole lockfile before install: existence, vulnerabilities, typosquat signals, verdict per package","tags":["Paid"],"x-payment-info":{"price":{"mode":"dynamic","currency":"USD","min":"0.002000","max":"1.000000"},"protocols":[{"x402":{"version":2,"scheme":"exact","network":"eip155:8453","asset":"USDC","pricePerItemUsd":"0.002","pricing":"amount = number of packages x pricePerItemUsd"}}]},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckRequest"},"example":{"packages":[{"ecosystem":"pypi","name":"reqeusts"},{"ecosystem":"npm","name":"lodash","version":"4.17.15"}]},"examples":{"packages":{"value":{"packages":[{"ecosystem":"pypi","name":"reqeusts"},{"ecosystem":"npm","name":"lodash","version":"4.17.15"}]}},"lockfile":{"value":{"lockfile":"requests==2.32.3\nreqeusts\nflask>=3\n","lockfile_format":"requirements.txt"}}}}}},"responses":{"200":{"description":"Results, one per package, in input order","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckResponse"},"example":{"results":[{"ecosystem":"pypi","name":"reqeusts","exists":false,"verdict":"block","reasons":["no package named 'reqeusts' on the pypi registry; installing a name an LLM suggested that does not exist invites slopsquatting (someone can register it later)"],"similar_popular":[{"name":"requests","kind":"edit_distance","distance":1}]},{"ecosystem":"npm","name":"lodash","exists":true,"checked_version":"4.17.15","verdict":"caution","reasons":["6 known vulnerabilities in lodash 4.17.15 (CVE-2020-8203, CVE-2021-23337, ...)"]}],"summary":{"packages":2,"ok":0,"caution":1,"block":1,"error":0}}}}},"402":{"description":"Payment Required: x402 v2 challenge in the PAYMENT-REQUIRED header and the body. First packages per payer wallet are free: send a signed payment anyway; it is verified, not settled"},"422":{"description":"Invalid input (free, never charged)"},"502":{"description":"Every package lookup failed; payment not settled"}}}},"/parse":{"post":{"operationId":"parseLockfile","summary":"Parse a lockfile and quote the price (free, no lookups)","tags":["Free"],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckRequest"},"example":{"lockfile":"requests==2.32.3\nreqeusts\nflask>=3\n","lockfile_format":"requirements.txt"}}}},"responses":{"200":{"description":"Unique packages and the quote","content":{"application/json":{"schema":{"type":"object"}}}},"422":{"description":"Invalid input"}}}},"/selftest":{"get":{"operationId":"selftest","summary":"Known-answer self-test against live registries (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/demo":{"get":{"operationId":"demo","summary":"Check of a fixed bundled package-lock.json with measured latency (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/stats":{"get":{"operationId":"stats","summary":"Counters and latency since process start (free, in memory)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/health":{"get":{"operationId":"health","summary":"Health (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/.well-known/x402":{"get":{"operationId":"x402Discovery","summary":"x402 discovery document (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/":{"get":{"operationId":"info","summary":"Service description (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/guide":{"get":{"operationId":"guide","summary":"Long-form guide (free, HTML)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/llms.txt":{"get":{"operationId":"llmsTxt","summary":"Short description for LLMs (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/.well-known/agent-card.json":{"get":{"operationId":"agentCard","summary":"A2A agent card (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/server.json":{"get":{"operationId":"mcpServerJson","summary":"MCP registry server.json (free)","tags":["Free"],"security":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}}}}}},"components":{"schemas":{"CheckRequest":{"type":"object","properties":{"packages":{"type":"array","minItems":1,"maxItems":500,"items":{"type":"object","required":["ecosystem","name"],"properties":{"ecosystem":{"type":"string","enum":["pypi","npm"]},"name":{"type":"string","maxLength":214},"version":{"type":"string","description":"exact version; omitted = latest"}}}},"lockfile":{"type":"string","description":"raw content of requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml or yarn.lock; parsed to unique packages"},"lockfile_format":{"type":"string","enum":["requirements.txt","poetry.lock","uv.lock","Pipfile.lock","package-lock.json","pnpm-lock.yaml","yarn.lock"],"description":"optional; auto-detected from the content"},"include_dev":{"type":"boolean","default":true,"description":"lockfile only: false drops packages marked dev"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"lockfile only: check just the first N unique packages (in file order), e.g. 50 for the free trial"}},"anyOf":[{"required":["packages"]},{"required":["lockfile"]}],"description":"Send packages (a list) or lockfile (raw text). 1 to 500 unique packages per call; price = unique packages x $0.002. First 50 packages per payer wallet are free."},"CheckResponse":{"type":"object","properties":{"results":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"verdict":{"type":"string","enum":["ok","caution","block","error"]},"reasons":{"type":"array","items":{"type":"string"}},"exists":{"type":"boolean"},"checked_version":{"type":["string","null"]},"latest_version":{"type":["string","null"]},"first_release_date":{"type":["string","null"]},"age_days":{"type":["integer","null"]},"release_count":{"type":["integer","null"]},"maintainers_count":{"type":["integer","null"]},"downloads":{"type":"object","properties":{"weekly":{"type":["integer","null"]},"monthly":{"type":["integer","null"]}}},"repository":{"type":["string","null"]},"install_scripts":{"type":["object","null"]},"vulnerabilities":{"type":"array"},"similar_popular":{"type":"array"},"signals":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"level":{"type":"string","enum":["block","caution","info"]},"detail":{"type":"string"}}}}}}},"summary":{"type":"object"},"verdicts":{"type":"array","description":"compact view: one row per package with lockfile line numbers when known","items":{"type":"object","properties":{"package":{"type":"string"},"verdict":{"type":"string"},"lines":{"type":"array"},"reason":{"type":["string","null"]}}}},"lockfile":{"type":"object","description":"format, unique packages, skipped entries (when a lockfile was sent)"},"payment":{"type":"object","description":"settled or free_trial, free_trial_remaining for the payer wallet"}}}},"securitySchemes":{}}}