Package exists on npm, PyPI or crates.io (hallucinated dependency check)

$0.005 USDC per call · Developer and security · POST /api/v1/package-exists · Id package-exists

Checks whether up to 10 package names (optionally with a version) exist in the live npm, PyPI or crates.io registry, for coding agents about to add a dependency they may have invented. Per package: exists, latest version, deprecated or yanked flag, and for a missing name the closest names the registry's own search returns (npm, crates.io; PyPI has no search API). Reads registry metadata only: never downloads or runs package code, and says nothing about whether a package is safe or the right one.

What you get

A hallucinated package name is a supply-chain attack waiting to be registered; one call checks the whole install list.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/package-exists. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/package-exists \
  -H 'content-type: application/json' \
  -d '{"ecosystem":"npm","items":[{"name":"left-pad"},{"name":"lef-pad"}]}'

Input

Field	Type	Required	Description
`ecosystem`	string; one of "npm", "pypi", "crates"	yes
`items`	array<object>; max 10 items	yes	At most 5 items for crates.io (its API policy allows one request per second).

Example request body

{
  "ecosystem": "npm",
  "items": [
    {
      "name": "left-pad"
    },
    {
      "name": "lef-pad"
    }
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`ecosystem`	string	no
`requests`	integer	no	Registry requests made.
`results`	array<object>	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent