Security Package

Security and provenance for an open-source package, composed live from three authoritative sources in one call.

Overview

Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."

Endpoint

Method	Endpoint	Price	Description
GET	/v1/marketplace/api/security-package	$0.002484	Invoke Security Package (Code) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i https://api.jarvisclaw.ai/v1/marketplace/api/security-package

# 2. Pay it (the SDK signs and retries for you)
curl -H "X-PAYMENT: <signed-payload>" https://api.jarvisclaw.ai/v1/marketplace/api/security-package

Open in the marketplace