# SpellzCode dependency audit

Check pinned dependencies before an agent installs them. One request checks up to 10 public package identifiers for $0.20 USDC on Base.

## What you receive

- Package and exact-version existence checks.
- Known advisory identifiers, affected/fixed ranges where available, and source retrieval timestamps.
- Dated FIRST EPSS estimates for CVE aliases, with missing or incomplete coverage identified.

This is a bounded automated report. It does not inspect your source code or prove that a dependency is safe. Upstream failures and omitted advisory details are reported as unknown or partial.

## 1. Choose public package versions

Use ecosystem:name@exact-version, separated by commas. Scoped npm packages use npm:@scope/name@version. Maximum 10 packages per request. Replace the illustrative versions below with your own. Omit private package names, credentials and source code.

Example: npm:express@4.21.2,pypi:requests@2.32.3

## 2. Inspect payment terms for free

An ordinary GET of the example URL returns HTTP 402 and the PAYMENT-REQUIRED header. It does not pay or run the audit.

https://agent-data-tools.revmesh2074.workers.dev/package-audit?packages=npm%3Aexpress%404.21.2%2Cpypi%3Arequests%402.32.3

The payment is native USDC on Base (eip155:8453), to 0x2074c40346ae2a90e0e4a391bcee6f16bf5277f5. No API account is required. Failed calls are not charged.

## 3. Make one paid request with your own x402 client

The client below is dedicated to /package-audit. It pins the network, token and recipient and rejects quotes above $0.20. It makes one API request per invocation. Run it only when you intend to pay; repeated invocations can each incur a charge. Your private key stays in your own process environment and is never sent to this API.

Install: npm install @x402/fetch @x402/evm viem
Development tools: npm install --save-dev typescript tsx @types/node
Save as client.ts, configure X402_PRIVATE_KEY privately in your environment, then run npx tsx client.ts.


```typescript
// Save as client.ts; set X402_PRIVATE_KEY in your environment, never in source.
import { ExactEvmScheme } from "@x402/evm";
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const rawPrivateKey = process.env.X402_PRIVATE_KEY;
if (!rawPrivateKey || !/^0x[0-9a-fA-F]{64}$/.test(rawPrivateKey)) {
  throw new Error("Set X402_PRIVATE_KEY in a secret manager or process environment.");
}
const account = privateKeyToAccount(rawPrivateKey as `0x${string}`);
const serviceOrigin = "https://agent-data-tools.revmesh2074.workers.dev";
const expectedPayTo = "0x2074c40346ae2a90e0e4a391bcee6f16bf5277f5";
const baseUsdc = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
const maxUsdcAtomic = 200000n; // $0.20 USDC, the current /package-audit price

const client = new x402Client()
  .register("eip155:8453", new ExactEvmScheme(account))
  .setSpendControls({ maxAmountPerPayment: "$0.20" })
  .registerPolicy((_version, requirements) =>
    requirements.filter((requirement) => {
      if (requirement.network !== "eip155:8453" || requirement.scheme !== "exact") return false;
      if (requirement.payTo.toLowerCase() !== expectedPayTo) return false;
      if (requirement.asset.toLowerCase() !== baseUsdc.toLowerCase()) return false;
      return /^\d+$/.test(requirement.amount) && BigInt(requirement.amount) <= maxUsdcAtomic;
    }),
  );

const fetchWithPayment = wrapFetchWithPayment(fetch, client);
const response = await fetchWithPayment(new URL("/package-audit?packages=npm%3Aexpress%404.21.2%2Cpypi%3Arequests%402.32.3", serviceOrigin));
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);
console.log(await response.json());
```

## Read the result

Review each package verdict and versionAdvisories, including affected/fixed ranges. Check lookupFailed, versionAdvisoryLookupIncomplete, per-advisory detailStatus and epssLookup coverage before relying on the report. Missing evidence is unknown, not zero risk. The example does not automatically install packages or change a project.

OpenAPI: https://agent-data-tools.revmesh2074.workers.dev/openapi.json
All tools: https://agent-data-tools.revmesh2074.workers.dev/llms.txt
Payment evidence totals: https://agent-data-tools.revmesh2074.workers.dev/revenue