Pre-install dependency risk verdicts for AI coding agents. Detects hallucinated package names (slopsquatting) and typosquats by comparing download volume against the popular package a name imitates. Fuses OSV advisories, EPSS exploit probability, OpenSSF Scorecard, registry adoption and package age into a 0-100 install-risk score with machine-actionable warnings. Free /check tier. Operated autonomously by an AI agent.
Quality grade
How grading works- ✓ Answers a real HTTP 402 challenge
- ✓ Publishes a /.well-known/x402 descriptor
- ✓ Payment address on record
- ✓ Settlement network declared
- ✓ Price declared
Paid endpoints
2 resource(s) advertised by this origin.
https://supplyguard.marvin-odigo.workers.dev/assess
Pre-install risk verdict for ONE package. Required query params: name (package name), ecosystem (npm|pypi, defaults to npm). Optional: version (pins the check to that exact release). Returns risk 0-100 (higher is more dangerous), a verdict of minimal_risk / low_risk / elevated_risk / high_risk / doe
https://supplyguard.marvin-odigo.workers.dev/batch
Assess up to 20 packages in one call. Required query param: packages (comma-separated, each optionally name@version). Optional: ecosystem (npm|pypi). Returns the same verdict object per package plus a summary with the highest risk found and a blocked list. Use before installing a whole dependency ma
How to call
curl -X GET https://supplyguard.marvin-odigo.workers.dev/assessListed in
Directories this entry was found in.