78trust / 100
Pypi
by manifest-audit in Security & trust
x402 APIPassing, checked 2 h ago
Check Python packages from PyPI before you pip install or bump versions. Send {"packages":["requests==2.25.0","flask>=2.0"]} or {"requirements":"<requirements.txt text>"}, up to 50 packages. Per package: latest release and date, whether a pinned version is behind, license, yanked status, requires_python, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM.
POST https://audit.152-53-82-29.sslip.io/v1/pypi
Last 30 days
All checks passedSome failedAll failedNot checked
- Uptime
- 100%
- Response time
- 625 ms typical, 821 ms slowest 5%
- Last check
- 2 h ago
- Next check
- any minute now
How to call it
# See the payment challenge (nothing is charged)
curl -i -X POST "https://audit.152-53-82-29.sslip.io/v1/pypi" \
-H "content-type: application/json" \
-d '{"packages":["requests==2.25.0","flask>=2.0"]}'import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";
const client = new x402Client().register(
"eip155:8453",
new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);
// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Faudit.152-53-82-29.sslip.io%2Fv1%2Fpypi
const res = await pay("https://audit.152-53-82-29.sslip.io/v1/pypi", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({"packages":["requests==2.25.0","flask>=2.0"]}),
});
console.log(await res.json());Example input
{
"packages": [
"requests==2.25.0",
"flask>=2.0"
]
}Example output
{
"elapsed_ms": 1800,
"generated_at": "2026-09-22T23:00:00Z",
"max_packages": 50,
"rows": [
{
"behind": null,
"deprecated": false,
"ecosystem": "pypi",
"latest": "3.1.2",
"latest_published": "2025-08-19T00:00:00Z",
"license": "BSD-3-Clause",
"max_severity": null,
"name": "flask",
"notes": [
"range \">=2.0\" audited at latest"
],
"pinned": null,
"requested": ">=2.0",
"vulnerabilities": [],
"vulnerability_count": 0,
"weekly_downloads": null
}
],
"sources": [
"api.deps.dev",
"api.osv.dev",
"registry.npmjs.org",
"api.npmjs.org",
"pypi.org"
],
"summary": {
"behind_latest": 1,
"deprecated": 0,
"lookup_errors": 0,
"packages": 2,
"unpinned": 1,
"with_vulnerabilities": 1
}
}Security scan
- No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.
Recent checks
| When | Result | HTTP | Time | Price |
|---|---|---|---|---|
| 2 h ago | Passed | 402 | 488 ms | $0.005 |
| 5 h ago | Passed | 402 | 466 ms | $0.005 |
| 9 h ago | Passed | 402 | 492 ms | $0.005 |
| 13 h ago | Passed | 402 | 625 ms | $0.005 |
| 17 h ago | Passed | 402 | 864 ms | $0.005 |
| 20 h ago | Passed | 402 | 602 ms | $0.005 |
| 24 h ago | Passed | 402 | 778 ms | $0.005 |
| 27 h ago | Passed | 402 | 738 ms | $0.005 |
| 31 h ago | Passed | 402 | 702 ms | $0.005 |
| 36 h ago | Passed | 402 | 821 ms | $0.005 |