Docs

One endpoint. Send a package name, get a verdict back. Everything below is free to read. Only the check itself is paid.

The request

POST to x402.pkgproof.net/v1/verify. version is optional. Leave it out to check the package rather than one release.

{ "ecosystem": "npm", "name": "crossenv", "version": "6.1.1" }

The response

One verdict, plus the findings behind it: safe, caution, block, or does_not_exist. You get the worst result any single check produced, so block always wins.

A completed check returns 200. block and does_not_exist are answers, not errors.

{
  "ecosystem": "npm",
  "name": "crossenv",
  "version": null,
  "verdict": "block",
  "reasons": [
    {
      "verdict": "caution",
      "code": "registry_security_hold",
      "kind": "fact",
      "source": "npm_registry",
      "detail": "Package 'crossenv' is under an npm security hold (real versions unpublished, replaced by a '-security' placeholder), quarantined by the registry. Treat with caution."
    },
    {
      "verdict": "block",
      "code": "malicious_package",
      "kind": "fact",
      "source": "osv.dev",
      "detail": "crossenv is affected by a confirmed-malicious advisory (GHSA-c2m4-w5hm-vqjw): crossenv is malware"
    }
  ],
  "sources": {
    "npm_registry": "https://registry.npmjs.org",
    "osv": "https://api.osv.dev/v1",
    "npm_downloads": "https://api.npmjs.org/downloads/point/last-week"
  },
  "checked_at": "2026-08-14T11:02:01Z"
}

Paying for a check

$0.05 per check, in USDC on Base. There is no account and no API key: the endpoint answers 402 with signed terms, your client signs them, and the same request goes back through.

The paid call

// npm i @x402/core @x402/evm viem
import { x402Client, x402HTTPClient } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const url = "https://x402.pkgproof.net/v1/verify";
const body = { ecosystem: "npm", name: "crossenv" };
const init = {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(body)
};

const client = new x402HTTPClient(
  registerExactEvmScheme(new x402Client(), {
    signer: privateKeyToAccount(process.env.PRIVATE_KEY)
  })
);

// 402, carrying the terms to sign
const quote = await (await fetch(url, init)).json();
const paid = await client.handlePaymentRequired(quote, url);

// the same request, one header heavier
Object.assign(init.headers, paid);
const verified = await fetch(url, init);

One authorisation buys one check. Replaying it answers 409 with the result it already bought, rather than charging twice. Terms are published at /.well-known/x402.json.

Just looking

# the first call each day is free, verdict and all
curl -s -X POST https://x402.pkgproof.net/v1/verify \
  -H 'content-type: application/json' \
  -d '{"ecosystem":"npm","name":"crossenv"}'

One free verification per address per day, no key and no signup. The response carries X-Free-Verification: 1 when it was the free one. After that the same call returns 402 and the terms, so you can see exactly what a check costs before paying for one.

When it declines to answer

Errors carry a code and a message, and nothing else. No upstream, no internal status, no package name.

Every way the endpoint can refuse, and what causes it.
Status	Code	Cause
400	invalid_json	The request body is not valid JSON.
402	payment_identity_missing	The request reached the origin carrying no payment identity.
402	free_quota_exhausted	Today's free verification has already been used, or the service's daily free allowance is gone.
404	not_found	The request did not arrive through the paid Worker.
405	method_not_allowed	Anything other than POST on /v1/verify.
409	payment_already_used	This authorisation was already spent. One authorisation buys one verification.
409	payment_claim_in_flight	This payer already has a verification running. The authorisation is unspent; resend it.
422	invalid_request	A missing or malformed name, ecosystem, or version.
422	unsupported_ecosystem	An ecosystem other than npm.
502	upstream_error	A required data source could not be reached. No verdict is issued.
504	upstream_timeout	The verification exceeded its wall-clock budget.

502 is the one that defines the service: a source that cannot be reached produces no verdict, rather than a verdict with a check silently missing from it.

For machines

Everything an agent needs to find and call this on its own, free and without a payment first.

OpenAPI 3.1: /openapi.json
Plain text summary: /llms.txt
Payment terms: /.well-known/x402