# Package Health

Open-source package health: activity, abandonment, deprecation, license class, dependency weight and build provenance.

## How to pay

Machine-payable over x402. USDC on: Base (eip155:8453), Solana (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp), Polygon (eip155:137), Arbitrum One (eip155:42161).
No accounts. No API keys. No signup. The paying wallet is the account.

## Machine-readable

- OpenAPI: https://package-health.x402tookit.com/openapi.json
- x402 manifest: https://package-health.x402tookit.com/.well-known/x402
- Catalog (free): https://package-health.x402tookit.com/catalog
- Health (free): https://package-health.x402tookit.com/health
- Uptime (free): https://package-health.x402tookit.com/uptime

## Endpoints (8)

### GET /npm-downloads — $0.02
npm package adoption: downloads last week and month, plus trend within the month and a popularity band.
Params: name: string
Example: https://package-health.x402tookit.com/npm-downloads?name=express

### GET /package-deps — $0.02
Dependency weight of a package version: direct and transitive dependency counts and a light/moderate/heavy verdict.
Params: system: string, name: string, version?: string
Example: https://package-health.x402tookit.com/package-deps?system=npm&name=express&version=4.19.2

### GET /package-health — $0.03
Package health for npm, PyPI, Go, Maven, Cargo or NuGet: maintained, stale or abandoned, deprecation, license, adoption.
Params: system: string, name: string
Example: https://package-health.x402tookit.com/package-health?system=npm&name=express

### GET /package-license — $0.02
License of a package version classed as permissive, weak, strong or network copyleft, with commercial-use notes.
Params: system: string, name: string, version?: string
Example: https://package-health.x402tookit.com/package-license?system=npm&name=express&version=4.19.2

### GET /package-provenance — $0.02
Does a package version carry build provenance (SLSA/sigstore attestations)? Signals a verifiable build, not safety.
Params: system: string, name: string, version?: string
Example: https://package-health.x402tookit.com/package-provenance?system=npm&name=express&version=4.19.2

### GET /package-versions — $0.02
Recent versions of a package with publish dates, deprecation flags and release cadence in days between releases.
Params: system: string, name: string, n?: integer
Example: https://package-health.x402tookit.com/package-versions?system=pypi&name=requests&n=8

### GET /pypi-package — $0.02
PyPI project facts: latest version, Python requirement, license, release freshness and whether the latest is yanked.
Params: name: string
Example: https://package-health.x402tookit.com/pypi-package?name=requests

### GET /pypi-yanked — $0.02
Was a PyPI release yanked? Exact version check with the maintainer's reason, upload date and file count.
Params: name: string, version: string
Example: https://package-health.x402tookit.com/pypi-yanked?name=requests&version=2.19.0

## Terms

Package metadata computed from deps.dev (Google), the npm downloads API and the PyPI JSON API, provided as is. Activity and license signals are heuristics from public metadata, not legal advice, a license review or a security audit. License classes are simplified; read the actual license text before relying on it.