Package risk check API for npm, PyPI, Cargo, Go, Maven and NuGet

$0.002 per call · failed calls are never charged · no account or subscription: pay per call with a card key or USDC

Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency.

When to use it

Check a dependency before adding it: age, versions, downloads, licenses and deprecation
See known advisory severity for the latest or a pinned version
Let a coding agent vet the packages it is about to install

Run it free (25 free calls) Buy credits by card (from $1) Example result (JSON)

Inputs

Name	Type	Description
`ecosystem` (required)	string	One of npm, pypi, cargo, go, maven, nuget
`name` (required)	string	Exact package name, e.g. lodash or @scope/name
`version`	string	Optional exact version to inspect; ranges and tags are not accepted

Request

Over HTTP, with a card key from /credits:

curl -H "Authorization: Bearer adt_…" "https://tools.funwords.eu/package?ecosystem=npm&name=lodash"

Or one of your 25 free calls, no key:

curl "https://tools.funwords.eu/package?ecosystem=npm&name=lodash&trial=1"

Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum or Solana over x402; Base or Tempo over MPP) and retries.

Example result

{
  "ecosystem": "npm",
  "name": "lodash",
  "exists": true,
  "verdict": "ok",
  "flags": [],
  "latestVersion": "4.18.1",
  "ageDays": 5282,
  "versionCount": 117,
  "weeklyDownloads": 162476177,
  "licenses": [
    "MIT"
  ],
  "deprecated": false,
  "knownVulnerabilities": 0,
  "advisories": [],
  "repository": "git+https://github.com/lodash/lodash.git"
}

From an AI agent (MCP)

Add the MCP server to Claude, Cursor or any MCP client. This tool is package, and the first 25 successful calls are free:

https://tools.funwords.eu/mcp

Questions

Does ok mean the package is safe?

No. It means none of the listed flags applied.

Where are the CVE details?

/package-audit adds OSV affected ranges and dated FIRST EPSS estimates.

How do I pay?

Each successful call costs $0.002; failed calls are not charged. The first 25 calls are free. Then pay with card credits (from $1; the key goes in an Authorization header or, for clients that can only fetch a URL, as api_key= in the URL) or per call in USDC over x402 or MPP. No account is needed.