manifest-audit
payment-ready until 2026-11-14
Pay-per-call dependency audit for coding agents.
Call it x402 v2
x402 v2
- Base URL
- https://audit.152-53-82-29.sslip.io
- Payment
- x402 v2, header channel
$ curl -i -X POST 'https://audit.152-53-82-29.sslip.io/v1/audit' An unpaid request returns HTTP 402 with the payment terms. Sign a payment authorization, then retry with the PAYMENT-SIGNATURE header.
Endpoints 4 paid routes on audit.152-53-82-29.sslip.io
Prices as captured in the 402 response: median $0.005 across the 4 endpoints.
Example 402 response
Endpoints and prices
| Method | Path | Description | Price | Network | Asset | 402 channel | Captured |
|---|---|---|---|---|---|---|---|
| POST | / | Audit a whole dependency manifest in one call before installing or upgrading. Send a package.json, a requirements.txt, or npm and PyPI package lists (up to 50 packages). Per dependency: latest version and publish date, whether your pin is behind, license, deprecation or yanked status, weekly npm downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM. Use before adding or bumping deps or when reviewing a lockfile change. | $0.01 | Base+ | USDC | header | since 09-23 |
| POST | / | Check npm packages before you install or upgrade. Send {"packages":["[email protected]","express"]} or a package.json (dependencies and devDependencies), up to 50 packages. Per package: latest version and publish date, whether a pinned version is behind, license, deprecation notice, weekly downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic registry data, no LLM. | $0.005 | Base+ | USDC | header | since 09-23 |
| POST | / | Check Python packages from PyPI before you pip install or bump versions. Send {"packages":["requests==2.25.0","flask>=2.0"]} or {"requirements":"<requirements.txt text>"}, up to 50 packages. Per package: latest release and date, whether a pinned version is behind, license, yanked status, requires_python, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM. | $0.005 | Base+ | USDC | header | since 09-23 |
| POST | / | Known vulnerabilities for a list of dependencies, npm and PyPI, in one call. Send {"npm":["[email protected]"],"pypi":["django==3.2.0"]} or a package.json or requirements.txt, up to 50 packages. Returns only packages that have advisories: OSV and GHSA ids, CVE aliases, severity, summary, and the first fixed version, plus counts. Unpinned packages are checked at their latest version. Deterministic OSV data, no LLM. | $0.005 | Base+ | USDC | header | since 09-23 |
Payment evidence
402 payload captured at . Check evidence JSON · Measurement methodology.
First of 4 payloads captured by the monitor.
324 lines, scroll inside
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
{
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:137",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
},
"payTo": "EtmTq4WoUyKvh5aPpB4xXNDRQDQmPSYBzLGLKJprZHHd",
"amount": "5000",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://audit.152-53-82-29.sslip.io/v1/pypi",
"tags": [
"pypi",
"python",
"pip",
"vulnerabilities",
"requirements.txt"
],
"mimeType": "application/json",
"description": "Check Python packages from PyPI before you pip install or bump versions. Send {\"packages\":[\"requests==2.25.0\",\"flask>=2.0\"]} or {\"requirements\":\"<requirements.txt text>\"}, up to 50 packages. Per package: latest release and date, whether a pinned version is behind, license, yanked status, requires_python, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM.",
"serviceName": "manifest-audit"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"packages": [
"requests==2.25.0",
"flask>=2.0"
]
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"rows": [
{
"name": "flask",
"notes": [
"range \">=2.0\" audited at latest"
],
"behind": null,
"latest": "3.1.2",
"pinned": null,
"license": "BSD-3-Clause",
"ecosystem": "pypi",
"requested": ">=2.0",
"deprecated": false,
"max_severity": null,
"vulnerabilities": [],
"latest_published": "2025-08-19T00:00:00Z",
"weekly_downloads": null,
"vulnerability_count": 0
}
],
"sources": [
"api.deps.dev",
"api.osv.dev",
"registry.npmjs.org",
"api.npmjs.org",
"pypi.org"
],
"summary": {
"packages": 2,
"unpinned": 1,
"deprecated": 0,
"behind_latest": 1,
"lookup_errors": 0,
"with_vulnerabilities": 1
},
"elapsed_ms": 1800,
"generated_at": "2026-09-22T23:00:00Z",
"max_packages": 50
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"properties": {
"packages": {
"type": "array",
"items": {
"type": "string"
},
"description": "PyPI requirement lines"
},
"requirements": {
"type": "string",
"description": "Raw requirements.txt text"
}
}
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"properties": {
"rows": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"notes": {
"type": "array",
"items": {
"type": "string"
}
},
"behind": {
"type": [
"boolean",
"null"
]
},
"latest": {
"type": [
"string",
"null"
]
},
"pinned": {
"type": [
"string",
"null"
]
},
"license": {
"type": [
"string",
"null"
]
},
"ecosystem": {
"type": "string"
},
"requested": {
"type": [
"string",
"null"
]
},
"deprecated": {
"type": [
"boolean",
"string",
"null"
]
},
"max_severity": {
"type": [
"string",
"null"
]
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"aliases": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "string"
},
"fixed_in": {
"type": [
"string",
"null"
]
},
"severity": {
"type": "string"
}
}
}
},
"latest_published": {
"type": [
"string",
"null"
]
},
"weekly_downloads": {
"type": [
"integer",
"null"
]
},
"vulnerability_count": {
"type": "integer"
}
}
}
},
"sources": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "object",
"properties": {
"packages": {
"type": "integer"
},
"unpinned": {
"type": "integer"
},
"deprecated": {
"type": "integer"
},
"behind_latest": {
"type": "integer"
},
"lookup_errors": {
"type": "integer"
},
"with_vulnerabilities": {
"type": "integer"
}
}
},
"elapsed_ms": {
"type": "integer"
}
}
}
}
}
}
}
}
},
"x402Version": 2
} Other captured 402 responses (3)
Captured payload 2 of 4
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "10000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
{
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "10000",
"scheme": "exact",
"network": "eip155:137",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
},
"payTo": "EtmTq4WoUyKvh5aPpB4xXNDRQDQmPSYBzLGLKJprZHHd",
"amount": "10000",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://audit.152-53-82-29.sslip.io/v1/audit",
"tags": [
"dependency-audit",
"package.json",
"requirements.txt",
"vulnerabilities",
"licenses"
],
"mimeType": "application/json",
"description": "Audit a whole dependency manifest in one call before installing or upgrading. Send a package.json, a requirements.txt, or npm and PyPI package lists (up to 50 packages). Per dependency: latest version and publish date, whether your pin is behind, license, deprecation or yanked status, weekly npm downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM. Use before adding or bumping deps or when reviewing a lockfile change.",
"serviceName": "manifest-audit"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"npm": [
"[email protected]",
"express@^4.18.0",
"left-pad"
],
"pypi": [
"requests==2.25.0",
"flask>=2.0"
]
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"rows": [
{
"name": "lodash",
"notes": [],
"behind": true,
"latest": "4.18.1",
"pinned": "4.17.20",
"license": "MIT",
"ecosystem": "npm",
"requested": "4.17.20",
"deprecated": false,
"max_severity": "HIGH",
"vulnerabilities": [
{
"id": "GHSA-35jh-r3h4-6jhm",
"aliases": [
"CVE-2021-23337"
],
"summary": "Command injection in lodash",
"fixed_in": "4.17.21",
"severity": "HIGH"
}
],
"latest_published": "2026-04-01T21:01:20Z",
"weekly_downloads": 128527290,
"vulnerability_count": 5
},
{
"name": "flask",
"notes": [
"range \">=2.0\" audited at latest"
],
"behind": null,
"latest": "3.1.2",
"pinned": null,
"license": "BSD-3-Clause",
"ecosystem": "pypi",
"requested": ">=2.0",
"deprecated": false,
"max_severity": null,
"vulnerabilities": [],
"latest_published": "2025-08-19T00:00:00Z",
"weekly_downloads": null,
"vulnerability_count": 0
}
],
"sources": [
"api.deps.dev",
"api.osv.dev",
"registry.npmjs.org",
"api.npmjs.org",
"pypi.org"
],
"summary": {
"packages": 2,
"unpinned": 1,
"deprecated": 0,
"behind_latest": 1,
"lookup_errors": 0,
"with_vulnerabilities": 1
},
"elapsed_ms": 1800,
"generated_at": "2026-09-22T23:00:00Z",
"max_packages": 50
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"properties": {
"npm": {
"type": "array",
"items": {
"type": "string"
},
"description": "npm packages as name or name@version"
},
"pypi": {
"type": "array",
"items": {
"type": "string"
},
"description": "PyPI requirement lines, for example requests==2.25.0"
},
"manifest": {
"type": "string",
"description": "Raw package.json or requirements.txt text"
},
"ecosystem": {
"enum": [
"npm",
"pypi"
],
"type": "string",
"description": "Required with `manifest` when it is a requirements.txt"
},
"dependencies": {
"type": "object",
"description": "package.json dependencies map"
},
"devDependencies": {
"type": "object",
"description": "package.json devDependencies map"
}
},
"description": "Send any one of: a package.json object, a requirements.txt string in `manifest`, or explicit `npm` and `pypi` lists."
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"properties": {
"rows": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"notes": {
"type": "array",
"items": {
"type": "string"
}
},
"behind": {
"type": [
"boolean",
"null"
]
},
"latest": {
"type": [
"string",
"null"
]
},
"pinned": {
"type": [
"string",
"null"
]
},
"license": {
"type": [
"string",
"null"
]
},
"ecosystem": {
"type": "string"
},
"requested": {
"type": [
"string",
"null"
]
},
"deprecated": {
"type": [
"boolean",
"string",
"null"
]
},
"max_severity": {
"type": [
"string",
"null"
]
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"aliases": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "string"
},
"fixed_in": {
"type": [
"string",
"null"
]
},
"severity": {
"type": "string"
}
}
}
},
"latest_published": {
"type": [
"string",
"null"
]
},
"weekly_downloads": {
"type": [
"integer",
"null"
]
},
"vulnerability_count": {
"type": "integer"
}
}
}
},
"sources": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "object",
"properties": {
"packages": {
"type": "integer"
},
"unpinned": {
"type": "integer"
},
"deprecated": {
"type": "integer"
},
"behind_latest": {
"type": "integer"
},
"lookup_errors": {
"type": "integer"
},
"with_vulnerabilities": {
"type": "integer"
}
}
},
"elapsed_ms": {
"type": "integer"
}
}
}
}
}
}
}
}
},
"x402Version": 2
}Captured payload 3 of 4
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
{
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:137",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
},
"payTo": "EtmTq4WoUyKvh5aPpB4xXNDRQDQmPSYBzLGLKJprZHHd",
"amount": "5000",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://audit.152-53-82-29.sslip.io/v1/npm",
"tags": [
"npm",
"package-check",
"vulnerabilities",
"deprecated",
"license"
],
"mimeType": "application/json",
"description": "Check npm packages before you install or upgrade. Send {\"packages\":[\"[email protected]\",\"express\"]} or a package.json (dependencies and devDependencies), up to 50 packages. Per package: latest version and publish date, whether a pinned version is behind, license, deprecation notice, weekly downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic registry data, no LLM.",
"serviceName": "manifest-audit"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"packages": [
"[email protected]",
"express",
"left-pad"
]
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"rows": [
{
"name": "lodash",
"notes": [],
"behind": true,
"latest": "4.18.1",
"pinned": "4.17.20",
"license": "MIT",
"ecosystem": "npm",
"requested": "4.17.20",
"deprecated": false,
"max_severity": "HIGH",
"vulnerabilities": [
{
"id": "GHSA-35jh-r3h4-6jhm",
"aliases": [
"CVE-2021-23337"
],
"summary": "Command injection in lodash",
"fixed_in": "4.17.21",
"severity": "HIGH"
}
],
"latest_published": "2026-04-01T21:01:20Z",
"weekly_downloads": 128527290,
"vulnerability_count": 5
},
{
"name": "flask",
"notes": [
"range \">=2.0\" audited at latest"
],
"behind": null,
"latest": "3.1.2",
"pinned": null,
"license": "BSD-3-Clause",
"ecosystem": "pypi",
"requested": ">=2.0",
"deprecated": false,
"max_severity": null,
"vulnerabilities": [],
"latest_published": "2025-08-19T00:00:00Z",
"weekly_downloads": null,
"vulnerability_count": 0
}
],
"sources": [
"api.deps.dev",
"api.osv.dev",
"registry.npmjs.org",
"api.npmjs.org",
"pypi.org"
],
"summary": {
"packages": 2,
"unpinned": 1,
"deprecated": 0,
"behind_latest": 1,
"lookup_errors": 0,
"with_vulnerabilities": 1
},
"elapsed_ms": 1800,
"generated_at": "2026-09-22T23:00:00Z",
"max_packages": 50
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"properties": {
"packages": {
"type": "array",
"items": {
"type": "string"
},
"description": "npm packages as name or name@version"
},
"dependencies": {
"type": "object"
},
"devDependencies": {
"type": "object"
}
}
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"properties": {
"rows": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"notes": {
"type": "array",
"items": {
"type": "string"
}
},
"behind": {
"type": [
"boolean",
"null"
]
},
"latest": {
"type": [
"string",
"null"
]
},
"pinned": {
"type": [
"string",
"null"
]
},
"license": {
"type": [
"string",
"null"
]
},
"ecosystem": {
"type": "string"
},
"requested": {
"type": [
"string",
"null"
]
},
"deprecated": {
"type": [
"boolean",
"string",
"null"
]
},
"max_severity": {
"type": [
"string",
"null"
]
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"aliases": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "string"
},
"fixed_in": {
"type": [
"string",
"null"
]
},
"severity": {
"type": "string"
}
}
}
},
"latest_published": {
"type": [
"string",
"null"
]
},
"weekly_downloads": {
"type": [
"integer",
"null"
]
},
"vulnerability_count": {
"type": "integer"
}
}
}
},
"sources": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "object",
"properties": {
"packages": {
"type": "integer"
},
"unpinned": {
"type": "integer"
},
"deprecated": {
"type": "integer"
},
"behind_latest": {
"type": "integer"
},
"lookup_errors": {
"type": "integer"
},
"with_vulnerabilities": {
"type": "integer"
}
}
},
"elapsed_ms": {
"type": "integer"
}
}
}
}
}
}
}
}
},
"x402Version": 2
}Captured payload 4 of 4
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
{
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x9Ea52806dB0b25a8130D2b210D5336eC1DCFBa0e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:137",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
},
"payTo": "EtmTq4WoUyKvh5aPpB4xXNDRQDQmPSYBzLGLKJprZHHd",
"amount": "5000",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://audit.152-53-82-29.sslip.io/v1/vulns",
"tags": [
"vulnerabilities",
"cve",
"osv",
"security",
"sca"
],
"mimeType": "application/json",
"description": "Known vulnerabilities for a list of dependencies, npm and PyPI, in one call. Send {\"npm\":[\"[email protected]\"],\"pypi\":[\"django==3.2.0\"]} or a package.json or requirements.txt, up to 50 packages. Returns only packages that have advisories: OSV and GHSA ids, CVE aliases, severity, summary, and the first fixed version, plus counts. Unpinned packages are checked at their latest version. Deterministic OSV data, no LLM.",
"serviceName": "manifest-audit"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"npm": [
"[email protected]"
],
"pypi": [
"django==3.2.0"
]
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"rows": [
{
"name": "django",
"ecosystem": "pypi",
"max_severity": "CRITICAL",
"version_checked": "3.2.0",
"vulnerabilities": [
{
"id": "GHSA-2gwj-7jmv-h26r",
"aliases": [
"CVE-2023-31047"
],
"summary": "Django bypass of validation when uploading multiple files",
"fixed_in": "3.2.19",
"severity": "CRITICAL"
}
],
"vulnerability_count": 63
}
],
"sources": [
"api.osv.dev",
"api.deps.dev"
],
"summary": {
"packages": 2,
"max_severity": "CRITICAL",
"with_vulnerabilities": 1,
"total_vulnerabilities": 63
},
"elapsed_ms": 900
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"properties": {
"npm": {
"type": "array",
"items": {
"type": "string"
}
},
"pypi": {
"type": "array",
"items": {
"type": "string"
}
},
"manifest": {
"type": "string"
},
"ecosystem": {
"enum": [
"npm",
"pypi"
],
"type": "string"
}
}
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"properties": {
"rows": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"ecosystem": {
"type": "string"
},
"max_severity": {
"type": [
"string",
"null"
]
},
"version_checked": {
"type": [
"string",
"null"
]
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"aliases": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "string"
},
"fixed_in": {
"type": [
"string",
"null"
]
},
"severity": {
"type": "string"
}
}
}
},
"vulnerability_count": {
"type": "integer"
}
}
}
},
"sources": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "object",
"properties": {
"packages": {
"type": "integer"
},
"max_severity": {
"type": [
"string",
"null"
]
},
"with_vulnerabilities": {
"type": "integer"
},
"total_vulnerabilities": {
"type": "integer"
}
}
},
"elapsed_ms": {
"type": "integer"
}
}
}
}
}
}
}
}
},
"x402Version": 2
}Can I trust it score from our own monitoring
score from our own monitoring
#39 of 186 in Verification. Bands: strong 93+, solid 75+, mixed 55+, weak below 55.
- Reliability
- 99.9% uptime 30d
- Compliance
- A 14/14 checks pass
- Price
- $0.005 to $0.01 p30 in Verification
- Risk
- clean no risk flag
- Traction
- $0.18 30d 8 buyers, top buyer 25% (address, not entity)
14/14 compliance checks
- 402 payload captured
- accepts[] array present
- payTo address recoverable
- payTo at accepts[0].payTo (conformant shape)
- payTo is a valid on-chain address
- atomic price declared
- atomic price in a sane range
- asset (token) address declared
- network resolves to CAIP-2
- payment scheme declared
- served over HTTPS
- declares the current x402 version (2)
- EIP-712 domain parameters present on every EVM entry
- x402 v2 envelope delivered in the payment-required header
402 terms unchanged since 2026-09-26. Last up 2026-11-07.
── Site signals
- homepage reachable
- openapi doc
- pricing page
- llms.txt
- robots.txt
- terms page
How the score works
What the score read on this service: status online, 99.9% uptime 30d, 422ms response p95, x402 compliance 14 of 14, $0.005 price against the category, on-chain traction measured. Each of those is measured, and each is published in full below.
The score comes from our own monitoring, never from reviews, operator claims, or a language model: reliability, x402 compliance, price against the category, a deterministic risk flag, and a small on-chain traction term, weighted by ranking generation 3. It is not placement anyone can buy: the paid verify tier is reported beside it and is not one of its inputs. Every component below stays published and read-only.
Bands on the 0 to 100 measured score: strong at 93 and above, solid from 75, mixed from 55, weak below 55. Price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, so the score places a service in its own field.
It is a score inside Verification, and only there: price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, which here means 186 listings, this one among them: the same 186 the position above is counted against. When the two differ, the field is the wider one, because a listing we have measured too little of to rank still sits in the field the price and the speed are normalized over. The same service in a different field would read differently. The same engine answers GET /api/v1/best, and asked for a different pool (the whole directory, or another filter) it returns a different number for this service under this same ranking generation. Neither is more correct: they answer different questions, and the methodology states which is which.
Settled via coinbase ($0.18, 26 tx). Traction is a conservative undercount; first settlement seen 2026-09-23.
All measured facts
What it does
Pay-per-call dependency audit for coding agents. POST a package.json, a requirements.txt, or npm and PyPI package lists and get per-package latest version and publish date, whether a pin is behind, license, deprecation or yanked status, weekly npm downloads, and OSV vulnerabilities with severity and first fixed version. Up to 50 packages per call. $0.01 whole manifest; $0.005 npm-only, PyPI-only, vulns-only. USDC on Base via the Coinbase facilitator, x402 v2, no API keys, no LLM.
manifest-audit is a listed x402 Verification API. Captured payment terms name Base, Polygon, Solana. Monitoring and settlement figures below describe the observations available to this directory; an unpaid HTTP 402 check does not prove that a paid call will deliver.
Assessment computed at . Latest service check observed at . Service data JSON · Measurement methodology.
Page rendered at . This response time is separate from the observation and computation times attached to each measurement.
Latest endpoint observation: . Latest price capture: . Prices are recorded quotes, not a promise of availability. Token assets and payment terms are listed separately. Endpoint data JSON · Price history JSON · Measurement methodology.
Assessment computed at . Uptime uses the stated daily-rollup window; response times are in milliseconds, compliance is passed/evaluated checks, and traction is a measured settlement floor. The comparison score is out of 100 within this category. Assessment JSON · Measurement methodology.
Observed daily coverage: 2026-10-09 to 2026-11-07 UTC. Daily monitoring and settlement rollups do not expose their computation time; a bucket date is not an update timestamp. Latest settlement in the assessment: . Uptime and response JSON · Volume JSON · Buyers JSON · Measurement methodology.
Ranked from the measured category pool, refreshed at most once a minute. The comparison has no persisted computation timestamp; the assessment time above belongs to this service only. Ranking API documentation · Ranking methodology.
x402 List home · Services · Verification
- uptime · latest daily rollup
- 100%
- uptime 7d
- 100%
- uptime 30d
- 99.9%
- uptime 90d
- 99.9%
- response p95
- 422ms
- avg response
- 322ms
- total checks
- 3,762
Measured on the unpaid 402 handshake, not the paid call. A service can 402 correctly and still fail after payment.
- price (min)
- $0.005
- price (max)
- $0.01
- category percentile (min)
- p30 in Verification
- category percentile (max)
- p25 in Verification
- endpoints / prices
- 4 / 2
- model
- tiered
- stability
- 100%
No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.
- domain age
- -
- registrar
- -
- hosting
- free host
- domain created
- ---
Identity facts, not a risk score.
- assessment volume 30d
- $0.18
- exact assessment volume 30d (USD)
- 0.18
- assessment recorded at (UTC)
- 2026-11-07T10:34:14.142Z
- buyers 30d
- 8
- settlements 30d
- 26
- measured since
- 2026-09-23 (start of our harvest window)
- last settlement
- 2026-10-27
- top buyer share
- 25% of 30d volume (address, not entity)
- top 3 buyers share
- 61% of 30d volume (addresses, not entities)
- concentrated volume
- no
- trend 7d vs 30d
- 0.83x the 30d daily rate
- networks
- eip155:137, eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d
- volume all-time
- $0.40
- settlements all-time
- 47
- median settlement 30d
- $0.005
- max settlement 30d
- $0.01
Assessment volume uses the latest 30d assessment. Over time sums daily address snapshots, rounded to cents and refreshed separately. The two sources can differ in timing, precision and shared-address attribution. Amounts use cents for comparison; known sub-cent values keep up to 12 significant digits. The exact stored assessment value is shown above.
Conservative undercount: only USDC settlements via facilitators we measure are counted. A measured floor, not an estimate.
Top buyer share lowers the on-chain traction part of the ranking score behind this page's verdict and /best, by up to half when one address holds all 30d volume. The Recommended and Highest volume sorts of the services list do not use it; they use the Concentrated volume rule instead.
- member since
- 2026-09-23
Recent checks
| Checked at (UTC) | Status | HTTP | Response | Endpoints |
|---|---|---|---|---|
| Online | 402 | 304ms | 4 | |
| Online | 402 | 256ms | 4 | |
| Online | 402 | 286ms | 4 | |
| Online | 402 | 149ms | 4 | |
| Online | 402 | 333ms | 4 | |
| Online | 402 | 180ms | 4 | |
| Online | 402 | 173ms | 4 | |
| Online | 402 | 203ms | 4 | |
| Online | 402 | 184ms | 4 | |
| Online | 402 | 221ms | 4 | |
| Online | 402 | 258ms | 4 | |
| Online | 402 | 98ms | 4 | |
| Online | 402 | 359ms | 4 | |
| Online | 402 | 1157ms | 4 | |
| Online | 402 | 327ms | 4 | |
| Online | 402 | 316ms | 4 | |
| Online | 402 | 314ms | 4 | |
| Online | 402 | 915ms | 4 |
Changes0 in 30d
No changes recorded in the last 30 days.
Over time
- Volume 30d
- $0.18
- Uptime
- 2 of 29 completed days below 100%
More charts
10-09 to 11-07* UTC
Scores over time
10-09 to 11-07* UTC
10-09 to 11-07* UTC
10-09 to 11-07* UTC
Scores: one day per column, 10-09 to 11-07*, on the columns of Response time. Uptime held below 100% on some days in this window, including any partial day. Daily readings remain in the Uptime strip and Values. The checklist grew from 11 to 14 checks on 2026-07-28, before this window. Pillar lines use their own low and high. Exact dated readings are available in each readout and in Values.
Each series spans only the dates it has data for. Every series is also served as JSON at /api, /scores, /volume and /buyers.
Values
* today so far, partial (UTC).
The uptime summary counts completed UTC days only. The strip, readouts and table retain today's partial reading.
Daily snapshot total, 30d: $0.11, peak $0.03 on 10-19. The visible 30d total in Traction comes from the latest assessment. These sources can differ in their window, refresh time, cent rounding and shared-address attribution.
Daily address snapshots: 2026-10-09 to 2026-11-07 UTC; * today so far, partial (UTC). Daily snapshots store cents. A recorded $0.00 with settlements cannot distinguish exact zero from volume rounded away. Lost precision is unavailable here.
Settlement volume uses the stored USD valuation of tracked payments; it is distinct from token quantities. USD-pegged assets are valued at 1 USD per token in these rollups. The measured settlement floor does not cover all payments to this service.
Assessment history last recorded at . Each UTC day uses its last recorded run; missing readings stay unmeasured. Assessment history JSON · Measurement methodology.
| Day | Volume | Buyers | Settlements | Uptime | Response | Compliance | Price percentile | Site signals |
|---|---|---|---|---|---|---|---|---|
| 2026-10-09 | no data | no data | no data | 100% | 318.40ms | 14/14 | p26 | 3/6 |
| 2026-10-10 | no data | no data | no data | 100% | 396.76ms | 14/14 | p26 | 3/6 |
| 2026-10-11 | no data | no data | no data | 100% | 442.76ms | 14/14 | p26 | 3/6 |
| 2026-10-12 | no data | no data | no data | 100% | 398.42ms | 14/14 | p26 | 3/6 |
| 2026-10-13 | no data | no data | no data | 100% | 331.46ms | 14/14 | p26 | 3/6 |
| 2026-10-14 | $0.01 | 1 | 1 | 100% | 360.97ms | 14/14 | p26 | 3/6 |
| 2026-10-15 | $0.01 | 1 | 2 | 100% | 327.48ms | 14/14 | p26 | 3/6 |
| 2026-10-16 | no data | no data | no data | 100% | 301.10ms | 14/14 | p26 | 3/6 |
| 2026-10-17 | no data | no data | no data | 98.88% | 301.32ms | 14/14 | p26 | 3/6 |
| 2026-10-18 | no data | no data | no data | 100% | 220.85ms | 14/14 | p27 | 3/6 |
| 2026-10-19 | $0.03 | 1 | 3 | 100% | 317.40ms | 14/14 | p27 | 3/6 |
| 2026-10-20 | $0.01 | 1 | 1 | 100% | 433.83ms | 14/14 | p27 | 3/6 |
| 2026-10-21 | no data | no data | no data | 100% | 271.19ms | 14/14 | p27 | 3/6 |
| 2026-10-22 | no data | no data | no data | 100% | 297.19ms | 14/14 | p27 | 3/6 |
| 2026-10-23 | $0.02 | 2 | 3 | 100% | 236.88ms | 14/14 | p27 | 3/6 |
| 2026-10-24 | no data | no data | no data | 100% | 304.15ms | 14/14 | p27 | 3/6 |
| 2026-10-25 | no data | no data | no data | 100% | 276.19ms | 14/14 | p27 | 3/6 |
| 2026-10-26 | no data | no data | no data | 98.86% | 231.11ms | 14/14 | p27 | 3/6 |
| 2026-10-27 | $0.02 | 1 | 3 | 100% | 239.92ms | 14/14 | p29 | 3/6 |
| 2026-10-28 | no data | no data | no data | 100% | 239.72ms | 14/14 | p29 | 3/6 |
| 2026-10-29 | no data | no data | no data | 100% | 309.61ms | 14/14 | p31 | 3/6 |
| 2026-10-30 | no data | no data | no data | 100% | 283.36ms | 14/14 | p31 | 3/6 |
| 2026-10-31 | no data | no data | no data | 100% | 281.30ms | 14/14 | p30 | 3/6 |
| 2026-11-01 | no data | no data | no data | 100% | 302.02ms | 14/14 | p30 | 3/6 |
| 2026-11-02 | no data | no data | no data | 100% | 193.23ms | 14/14 | p30 | 3/6 |
| 2026-11-03 | no data | no data | no data | 100% | 292.40ms | 14/14 | p30 | 3/6 |
| 2026-11-04 | no data | no data | no data | 100% | 292.60ms | 14/14 | p30 | 3/6 |
| 2026-11-05 | $0.01 | 1 | 1 | 100% | 272.08ms | 14/14 | p30 | 3/6 |
| 2026-11-06 | no data | no data | no data | 100% | 249.78ms | 14/14 | p30 | 3/6 |
| 2026-11-07* | no data | no data | no data | 100% | 318.98ms | 14/14 | p30 | 3/6 |
Alternatives in Verification
5 of 185 other ranked services in Verification, ordered by the same measured score.
Own this service?
Keep this listing accurate. Ownership is proven with a domain check and every change is reviewed by hand.
Update this listingEarn the verified tier: x402list pays a real call to this endpoint and, if it delivers, the service is delivery-verified. The fee covers the cost of the probe, not the badge; there is no refund if the call does not deliver. Agent and API only, no in-browser signing. See /api.
Verify this service ($0.25)Embed a badge
HTML
<a href="https://x402-list.com/services/ manifest-audit? utm_source=badge& utm_medium=referral& utm_campaign=embed"> <img src="https://x402-list.com/ badge/ manifest-audit.svg" alt="manifest-audit listed on x402-list" height="28"> </a>
Markdown
[](https://x402-list.com/ services/ manifest-audit? utm_source=badge& utm_medium=referral& utm_campaign=embed)
HTML, live uptime variant
<a href="https://x402-list.com/services/ manifest-audit? utm_source=badge& utm_medium=referral& utm_campaign=embed"> <img src="https://x402-list.com/ badge/ manifest-audit.svg? data=uptime" alt="manifest-audit uptime on x402-list" height="28"> </a>
Delisting
To request delisting, email info@x402-list.com with the service name, slug, or URL. Removal is free and does not require proof of ownership. See all free email requests.