Dependency Provenance

Dependency risk and supply chain trust for one package in a single call: registry adoption stats, a package risk score, source repo health and star velocity, auto-routed to the right ecosystem.

Overview

Dependency risk and supply chain trust for one package in a single call: registry adoption stats, a package risk score, source repo health and star velocity, auto-routed to the right ecosystem. Composite: one call runs npm-package-stats or pypi-package-stats or crates-io-stats, package-risk-npm or pypi-package-risk, github-repo-health, and github-stars-history in parallel, ecosystem-routed from the package name or an explicit ecosystem input. Send a package name and an optional ecosystem or repo override; get back stats, a risk score, repo health and stars trend, merged into one trust view. Use it as a package trust API, an sbom enrichment tool, or a supply-chain risk check before you install a dependency.

Endpoint

Method	Endpoint	Price	Description
POST	/v1/marketplace/api/dependency-provenance	$0.069	Invoke Dependency Provenance (Code) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i -X POST https://api.jarvisclaw.ai/v1/marketplace/api/dependency-provenance \
  -H 'Content-Type: application/json' \
  -d '{}'

# 2. Pay it (the SDK signs and retries for you)
curl -X POST https://api.jarvisclaw.ai/v1/marketplace/api/dependency-provenance \
  -H 'Content-Type: application/json' \
  -H 'X-PAYMENT: <signed-payload>' \
  -d '{}'

Open in the marketplace