Agent Harbor Package Check API

openapi: 3.2.0
info:
  title: Agent Harbor x402 Gateway Package Check API
  version: 1.0.0
  x-guidance: 'Pay-per-call business website data for agents. Every paid operation takes one bare domain (e.g. example.com). Call it unpaid to get HTTP 402 with the price; pay with x402 (USDC on Base, PAYMENT-SIGNATURE header) or, where offered, MPP (WWW-Authenticate: Payment, Tempo USDC) and retry. Failed or unusable calls are never charged. Cheapest first: /company, then /scrape; /enrich and /audit are the deeper tiers. Free: /catalog, /llms.txt, /SKILL.md, /.well-known/x402. Public-data routes (SEC EDGAR, recalls, package check, domain verification, PDF) take the query parameters listed in their own entries instead of a domain.'
  contact:
    name: Agent Harbor LLC
    email: anchor@agentharbor.agency
    url: https://agentharbor.agency
tags:
- name: Package Check
paths:
  /package-check:
    get:
      summary: Data Package Check
      operationId: data_package_check_package_check_get
      responses:
        '200':
          description: Served and charged.
          content:
            application/json:
              schema: {}
              example:
                product: package_check
                tier: package-check
                price_paid_usdc: 0.003
                data:
                  ecosystem: pypi
                  name: requests
                  version: 2.25.0
                  latest_version: 2.34.2
                  is_latest: false
                  published_at: '2020-11-11'
                  deprecated: false
                  licenses:
                  - Apache-2.0
                  vulnerability_count: 8
                  vulnerability_count_is_lower_bound: false
                  max_severity: MODERATE
                  vulnerabilities:
                  - id: GHSA-9hjg-9r4m-mvj7
                    aliases:
                    - CVE-2024-47081
                    - PYSEC-2026-1872
                    summary: Requests vulnerable to .netrc credentials leak via malicious URLs
                    severity: MODERATE
                    published: '2025-06-09'
                    fixed_in:
                    - 2.32.4
                    url: https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7
                  - id: GHSA-9wx4-h78v-vm56
                    aliases:
                    - CVE-2024-35195
                    - PYSEC-2026-1873
                    summary: Requests `Session` object does not verify requests after making first request with verify=False
                    severity: MODERATE
                    published: '2024-05-20'
                    fixed_in:
                    - 2.32.0
                    url: https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56
                  recommendation: 'upgrade: known vulnerabilities in this version'
                  links:
                    documentation: https://requests.readthedocs.io
                    source_repo: https://github.com/psf/requests
                  sources:
                  - https://api.deps.dev/v3/systems/PYPI/packages/requests
                  - https://api.deps.dev/v3/systems/PYPI/packages/requests/versions/2.25.0
                  attribution: Vulnerability data from OSV.dev (https://osv.dev, CC-BY 4.0); package metadata from deps.dev (https://deps.dev, CC-BY 4.0).
                provider: Agent Harbor — public-data service
        '402':
          description: 'Payment required: x402 v2 PAYMENT-REQUIRED challenge (price, network, payTo).'
        '422':
          description: Invalid input, not found, or nothing usable to sell. Not charged.
        '502':
          description: Upstream failure. Not charged.
      description: Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist.
      x-payment-info:
        protocol: x402
        version: 2
        scheme: exact
        network: eip155:8453
        asset: USDC
        price_usd: '0.003'
        payTo: '0x840C829530DF7B4CCF700Fa3A0060cF2C80b014e'
        price:
          mode: fixed
          currency: USD
          amount: '0.003'
        protocols:
        - x402:
            version: 2
            scheme: exact
            network: eip155:8453
            asset: USDC
            amount: '3000'
            payTo: '0x840C829530DF7B4CCF700Fa3A0060cF2C80b014e'
      parameters:
      - name: ecosystem
        in: query
        required: true
        schema:
          type: string
          enum:
          - pypi
          - npm
          - go
          - cargo
          - maven
          - nuget
          - rubygems
          example: pypi
        description: Package registry
      - name: name
        in: query
        required: true
        schema:
          type: string
          maxLength: 214
          example: requests
        description: Package name as published, e.g. requests or @types/node
      - name: version
        in: query
        required: false
        schema:
          type: string
          maxLength: 100
          example: 2.25.0
        description: Exact version; omit for the latest
      tags:
      - Package Check