Agent Data Tools / SpellzCode

Check dependencies before your agent installs them

Up to 10 packages in one request. $0.20 USDC on Base. No API account required.

• Check whether a package and pinned version exist.
• Get known advisory IDs and affected/fixed ranges where available.
• Inspect dated EPSS evidence and explicit gaps in source coverage.

A bounded automated report. It does not inspect your source code or prove a dependency is safe.

1. Choose your public package versions

Use ecosystem:name@exact-version, separated by commas, for up to 10 packages. Scoped npm names are supported. Omit private package names, source code and credentials.

Illustrative versions to replace: npm:express@4.21.2,pypi:requests@2.32.3

2. Inspect the quote for free

This example returns the HTTP 402 payment terms. Opening it does not pay or run an audit.

Native USDC on Base, paid to 0x2074c40346ae2a90e0e4a391bcee6f16bf5277f5. Failed calls are not charged.

3. Send one paid request

This dedicated client rejects a wrong chain, token, recipient or quote above $0.20. It makes one request per invocation. Run it only when you intend to pay; repeated runs can each incur a charge.

Install npm install @x402/fetch @x402/evm viem and npm install --save-dev typescript tsx @types/node. Save the example as client.ts, configure X402_PRIVATE_KEY privately in your own environment, then run npx tsx client.ts. Your private key is never sent to this API.

// Save as client.ts; set X402_PRIVATE_KEY in your environment, never in source.
import { ExactEvmScheme } from "@x402/evm";
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const rawPrivateKey = process.env.X402_PRIVATE_KEY;
if (!rawPrivateKey || !/^0x[0-9a-fA-F]{64}$/.test(rawPrivateKey)) {
  throw new Error("Set X402_PRIVATE_KEY in a secret manager or process environment.");
}
const account = privateKeyToAccount(rawPrivateKey as `0x${string}`);
const serviceOrigin = "https://agent-data-tools.revmesh2074.workers.dev";
const expectedPayTo = "0x2074c40346ae2a90e0e4a391bcee6f16bf5277f5";
const baseUsdc = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
const maxUsdcAtomic = 200000n; // $0.20 USDC, the current /package-audit price

const client = new x402Client()
  .register("eip155:8453", new ExactEvmScheme(account))
  .setSpendControls({ maxAmountPerPayment: "$0.20" })
  .registerPolicy((_version, requirements) =>
    requirements.filter((requirement) => {
      if (requirement.network !== "eip155:8453" || requirement.scheme !== "exact") return false;
      if (requirement.payTo.toLowerCase() !== expectedPayTo) return false;
      if (requirement.asset.toLowerCase() !== baseUsdc.toLowerCase()) return false;
      return /^\d+$/.test(requirement.amount) && BigInt(requirement.amount) <= maxUsdcAtomic;
    }),
  );

const fetchWithPayment = wrapFetchWithPayment(fetch, client);
const response = await fetchWithPayment(new URL("/package-audit?packages=npm%3Aexpress%404.21.2%2Cpypi%3Arequests%402.32.3", serviceOrigin));
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);
console.log(await response.json());

Read the evidence before acting

Check each package verdict, affected/fixed ranges, retrieval timestamps, failed lookups and incomplete advisory/EPSS coverage. Unavailable evidence is unknown, not zero risk. This client does not install packages or edit your project.

Markdown guide for agents · OpenAPI · All tools