Package & Dependency Intelligence API (x402)

A pay-per-call API selling npm, PyPI and crates.io (Rust) package health, dependency-graph, and vulnerability data to AI coding agents over the x402 payment protocol — plus an MCP server so agents in Claude Desktop/Cursor can call it and pay automatically.

Defaults to Base Sepolia testnet via the free public facilitator. Going to mainnet is an explicit config change (see Going to mainnet).

Endpoints

Raw passthrough of the upstream sources is free: npm, PyPI, crates.io, OSV and deps.dev are themselves free and unauthenticated, so charging for a relay of them prices against zero. What gets charged for is the consolidation — the score.

:ecosystem is npm, pypi or crates. Also unpaid: /healthz, /v1/sample (canned example response), /.well-known/x402 (discovery manifest).

Free routes are rate limited to 60/min and 2000/day per caller — a runaway agent loop is how we would get our egress IP blocked by npm or OSV. Paid routes are exempt; their price is the limiter. Exceeding a limit returns 429 with Retry-After.

Tier, price, description, and discovery metadata all come from src/catalog.ts — edit there and the payment middleware, rate limiter, manifest, and Bazaar declarations stay in sync. tier is a required discriminant, so a new endpoint cannot default into being free.

Trusting the caller's address

The rate limiter counts per client IP, but the service sits behind a Worker proxy and a tunnel, so every request arrives from the same address. The proxy forwards the real one as x-stable-ip signed with PROXY_SECRET, and the origin honours it only when the secret matches. Anything else — wrong secret, no secret, or a request straight to the tunnel hostname — shares a single bucket. Without that signature a caller could forge a fresh address per request, or skip the proxy, and get unmetered upstream fan-out.

Set the same value in both places:

# .env for the origin, plus:
npx wrangler secret put PROXY_SECRET

The server warns at startup if it is missing on mainnet.

Local setup (testnet)

npm install
npm run gen-wallet

gen-wallet prints two testnet-only keypairs — never fund these with real assets:

• Seller — put its address in .env as PAY_TO (where payments land).
• Buyer — put its private key in .env as BUYER_PRIVATE_KEY (used by the test script to simulate a paying agent).

Copy .env.example to .env and fill those in. Then fund the buyer with Base Sepolia USDC at faucet.circle.com (select Base Sepolia; no account needed). No testnet ETH is required — x402's exact scheme uses EIP-3009, so the buyer only signs off-chain and the facilitator pays gas.

npm run dev

Verify: curl http://localhost:4021/healthz → 200, and curl -i http://localhost:4021/v1/health/npm/express → 402 with payment instructions.

Test the payment flow

npm run test-buyer                              # GET /v1/health/npm/express (default)
npm run test-buyer -- /v1/deps/npm/express
npm run test-buyer -- /v1/batch

On Git Bash/Windows, prefix with MSYS_NO_PATHCONV=1 so the leading / isn't rewritten into a Windows path.

A request for a nonexistent package returns 404 without charging — the x402 middleware skips settlement entirely on any 4xx/5xx response, so failures are free.

MCP se

... View full README on GitHub