package_intel - FiatDock

PAID ($0.0027 USDC via x402). Before adding a dependency: give an npm or PyPI package (and optionally an exact version; default latest). Returns every vulnerability OSV.dev lists for that version (ids, CVE aliases, severity as its database labels it, fixed versions), whether it is deprecated (npm) or yanked (PyPI), licence, https source repository, publish dates, latest version, last week's downloads, runtime dependency and maintainer counts, and risk flags from a stated rule list. It reads registry metadata and advisories, not the code; 'no vulnerabilities' means none known to OSV. An unknown package or version, or an outage, answers 4xx/502 and is not charged. Without payment this returns the 402 challenge; the fiatdock-mcp npm package pays automatically. Any answer the tool cannot produce is >= 400 and is NOT charged.

Name	Required	Description
`name`	No	The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)
`payment`	No	Base64 of a single x402 v2 PaymentPayload (EIP-3009 transferWithAuthorization on Base USDC). OMIT it on the first call: the 402 you get back carries `howToPay.payloadTemplate` — the exact envelope to fill in — plus the price and the EIP-712 domain. Send it on the second call to complete the purchase; it is forwarded as the PAYMENT-SIGNATURE header, never as body data. Nothing is charged for the 402 itself, and a call that fails after payment settles nothing.
`version`	No	An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused
`ecosystem`	No	Which registry the name is on: npm (default) or pypi

Name

Required

Description

Default

name

The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)

payment

Base64 of a single x402 v2 PaymentPayload (EIP-3009 transferWithAuthorization on Base USDC). OMIT it on the first call: the 402 you get back carries `howToPay.payloadTemplate` — the exact envelope to fill in — plus the price and the EIP-712 domain. Send it on the second call to complete the purchase; it is forwarded as the PAYMENT-SIGNATURE header, never as body data. Nothing is charged for the 402 itself, and a call that fails after payment settles nothing.

version

An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused

ecosystem

Which registry the name is on: npm (default) or pypi

Name	Required	Description
`asOf`	Yes	ISO time of the oldest upstream read this answer used
`name`	Yes	The package name as the registry spells it
`note`	Yes	How to read the answer, its rules and limits, and the data attribution
`source`	Yes	Where the data came from
`license`	Yes	The declared licence (SPDX expression where given), or null when none is declared
`version`	Yes	The version analysed (the latest when none was named)
`homepage`	Yes	The declared homepage, or null
`isLatest`	Yes	True when the analysed version is the latest
`defaulted`	No	Present only when the body named no field: which package the answer is for, and why
`ecosystem`	Yes	The registry: npm or pypi
`riskFlags`	Yes	Flags from a stated rule list (see note): malicious_package, deprecated, yanked, known_vulnerabilities, high_or_critical_vulnerability, newer_version_available, no_release_in_2_years, very_low_downloads, no_license, no_repository
`deprecated`	Yes	npm: the deprecation message of this version; PyPI: 'yanked: <reason>' when the release is yanked; null otherwise
`osvRecords`	Yes	OSV records returned before the same flaw from two databases was folded into one row
`repository`	Yes	The declared source repository as an https URL, or null
`description`	Yes	The package's own one-line description
`publishedAt`	Yes	ISO time the analysed version was published (null when the registry could not be read for dates)
`latestVersion`	Yes	The registry's latest release (npm's `latest` dist-tag; PyPI's current version)
`dependencyCount`	Yes	Runtime dependencies this version declares (npm `dependencies`; PyPI `requires_dist` entries not tied to an extra); null when undeclared metadata makes it unknown
`vulnerabilities`	Yes	Known vulnerabilities OSV.dev lists for THIS version, most severe first
`maintainersCount`	Yes	Accounts allowed to publish (npm's current maintainers; PyPI's owners and maintainers)
`downloadsLastWeek`	Yes	Downloads in the last 7 days (npm: api.npmjs.org; PyPI: pypistats.org last_week); null when the counter did not answer
`latestPublishedAt`	Yes	ISO time the latest release was published
`vulnerabilityCount`	Yes	Number of vulnerabilities listed (the same flaw published by two databases counts once)
`daysSinceLatestRelease`	Yes	Whole days since the latest release was published

Name

Required

Description

Default

asOf

Yes

ISO time of the oldest upstream read this answer used

name

Yes

The package name as the registry spells it

note

Yes

How to read the answer, its rules and limits, and the data attribution

source

Yes

Where the data came from

license

Yes

The declared licence (SPDX expression where given), or null when none is declared

version

Yes

The version analysed (the latest when none was named)

homepage

Yes

The declared homepage, or null

isLatest

Yes

True when the analysed version is the latest

defaulted

Present only when the body named no field: which package the answer is for, and why

ecosystem

Yes

The registry: npm or pypi

riskFlags

Yes

Flags from a stated rule list (see note): malicious_package, deprecated, yanked, known_vulnerabilities, high_or_critical_vulnerability, newer_version_available, no_release_in_2_years, very_low_downloads, no_license, no_repository

deprecated

Yes

npm: the deprecation message of this version; PyPI: 'yanked: <reason>' when the release is yanked; null otherwise

osvRecords

Yes

OSV records returned before the same flaw from two databases was folded into one row

repository

Yes

The declared source repository as an https URL, or null

description

Yes

The package's own one-line description

publishedAt

Yes

ISO time the analysed version was published (null when the registry could not be read for dates)

latestVersion

Yes

The registry's latest release (npm's `latest` dist-tag; PyPI's current version)

dependencyCount

Yes

Runtime dependencies this version declares (npm `dependencies`; PyPI `requires_dist` entries not tied to an extra); null when undeclared metadata makes it unknown

vulnerabilities

Yes

Known vulnerabilities OSV.dev lists for THIS version, most severe first

maintainersCount

Yes

Accounts allowed to publish (npm's current maintainers; PyPI's owners and maintainers)

downloadsLastWeek

Yes

Downloads in the last 7 days (npm: api.npmjs.org; PyPI: pypistats.org last_week); null when the counter did not answer

latestPublishedAt

Yes

ISO time the latest release was published

vulnerabilityCount

Yes

Number of vulnerabilities listed (the same flaw published by two databases counts once)

daysSinceLatestRelease

Yes

Whole days since the latest release was published

FiatDock

npm / PyPI package safety and maintenance ($0.0027)

Input Schema

Output Schema

Schema Changelog

TDQS

Glama MCP Gateway

Resources