Annalist Packages API
The packages API from Annalist — 2 operation(s) for packages.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/annalist-dev:annalist-dev-packages-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Annalist Dev Packages API
version: 0.9.0
x-guidance: 'Annalist sells signed data for agents, priced per call over x402 (USDC on Base or Solana). Start with the free GET /v1/catalog: every paid route with the question it answers, its price and an example. Hyperliquid in one call: GET /v1/perp/full?coin=BTC (crowd state, smart-money positioning, liquidation levels). Before paying an x402 service: GET /v1/checks/service?host=, or the free GET /v1/verify/attestation?host=. Before connecting an MCP server: GET /v1/mcp/server?url=, or the free GET /v1/verify/mcp?url=. Before an agent shops on a site: the free GET /v1/verify/store?domain=, or GET /v1/web/readiness?domain=. Every answer is Ed25519-signed; the key is at /.well-known/annalist-key.json. Not investment advice.'
description: 'Operations tagged packages across 2 of this provider''s published API definitions: annalist-dev-openapi.json, openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.annalist.dev
tags:
- name: Packages
paths:
/v1/packages/check:
get:
operationId: packages_check
tags:
- Packages
summary: Should my agent depend on this npm, PyPI, Rust or Go package, and did it just…
description: 'Supply-chain check of a popular package (the 8,000 most used on each of npm, PyPI, crates.io and Go): latest version and release activity, maintainers or owners, install scripts, provenance, deprecation, retractions, and what changed since we began tracking it daily: releases by a new publisher account, owner changes, install scripts added, provenance dropped, source repository moved, yanks. Account names are never published. Signed.'
x-price: $0.01
x-payment-info:
price:
mode: fixed
currency: USD
amount: '0.010000'
protocols:
- x402: {}
parameters:
- name: ecosystem
in: query
required: false
schema:
type: string
enum:
- npm
- pypi
- crates
- go
description: npm (default), pypi, crates or go
- name: name
in: query
required: true
schema:
type: string
description: package name, for example lodash, requests, serde or golang.org/x/crypto
responses:
'200':
description: Signed data
content:
application/json:
schema:
type: object
required:
- as_of
- data
- signature
properties:
as_of:
type: string
format: date-time
data:
type: object
method:
type: object
request_id:
type: string
stale:
type: boolean
sources:
type: array
items:
type: string
notice:
type: string
key_id:
type: string
signature:
type: string
description: Ed25519 over RFC 8785 canonical JSON of {as_of, data, method, request_id}
signature_info:
type: string
example:
data:
ecosystem: npm
name: lodash
version: 4.18.1
maintainers: 3
install_scripts: []
provenance: true
signals:
- signal: new_publisher
detail: 4.18.2 was published by an account that had not published this package before
'402':
description: Payment required (x402 v2, USDC on Base or Solana)
servers:
- url: https://api.annalist.dev
/v1/packages/watch:
get:
operationId: packages_watch
tags:
- Packages
summary: Which popular npm, PyPI, Rust or Go packages changed hands or added risky…
description: 'Supply-chain watch across the 8,000 most-used packages on each of npm, PyPI, crates.io and Go, newest first: releases by a new publisher account, maintainer and owner changes, install scripts added, provenance dropped, source repositories moved, retractions, deprecations and yanks, with counts, for the last 1 to 30 days (days=, default 7), for one ecosystem or all. Signed.'
x-price: $0.02
x-payment-info:
price:
mode: fixed
currency: USD
amount: '0.020000'
protocols:
- x402: {}
parameters:
- name: ecosystem
in: query
required: false
schema:
type: string
enum:
- npm
- pypi
- crates
- go
- name: days
in: query
required: false
schema:
type: string
description: 1 to 30 (default 7)
responses:
'200':
description: Signed data
content:
application/json:
schema:
type: object
required:
- as_of
- data
- signature
properties:
as_of:
type: string
format: date-time
data:
type: object
method:
type: object
request_id:
type: string
stale:
type: boolean
sources:
type: array
items:
type: string
notice:
type: string
key_id:
type: string
signature:
type: string
description: Ed25519 over RFC 8785 canonical JSON of {as_of, data, method, request_id}
signature_info:
type: string
example:
data:
days: 7
counts:
new_publisher: 4
install_script_added: 1
owners_changed: 12
events:
- date: '2026-10-20'
eco: npm
package: example-lib
type: new_publisher
version: 2.0.1
'402':
description: Payment required (x402 v2, USDC on Base or Solana)
servers:
- url: https://api.annalist.dev
x-refined-from:
- annalist-dev-openapi.json
- openapi.json