npm package quality check

deterministic eval-case generator for agents: creates happy-path, ambiguous-input and adversarial-instruction cases from a goal.

MCP tool risk scorer for agents: scans a tool JSON description for shell, filesystem, network and secret-access capabilities.

diff scan for planned tool calls: compares before and after snippets and flags destructive, network or secret-related actions.

trace brief for agent runs: scans trace JSON or log text for failures, timeouts and auth/payment errors and returns a compact risk report.

Current job openings for a given company: titles, locations, departments, posting dates, application URLs. Sourced from the company's official careers system (Greenhouse). Input: company board token (e.g. 'anthropic').

prelaunch audit for an agent spec or checklist: flags obvious launch risks around secrets, unsafe tools, missing evals and rate limits.

composed domain threat report from DNS infrastructure signals and high-abuse TLD heuristics for agent browsing decisions.

composed email trust report from MX, SPF and DMARC DNS records for outreach, onboarding and anti-spoofing agents.

repository health brief from a GitHub repo slug or pasted repository notes, returning concise risk flags for agent planning.

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoint for CVE checks.

Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Returns advisories with CVE aliases, severity, summary, fixed versions and reference links. Optional version narrows results to vulnerabilities affecting that exact version. Built for coding agents that install dependencies autonomously.

Resolves an EAN/UPC/GTIN barcode (8-14 digits) to product data: name, brands, quantity, categories, Nutri-Score and image, from the Open Food Facts database (3M+ products, ODbL). For commerce, inventory and shopping agents scanning or comparing physical products.

Official public holidays for any of 110+ countries and a given year: date, English and local name, nationwide flag and holiday type. For scheduling, logistics, payroll and commerce agents planning around non-working days worldwide.

Checks whether a given user agent may fetch a given path on a host, per the site's robots.txt (specific-agent groups, wildcard rules, Allow/Disallow longest-match). Also returns crawl-delay, sitemap URLs and whether the site publishes llms.txt or ai.txt. For scraping and research agents that want to crawl politely and prove compliance.

Screens a person or entity name against US OFAC sanctions lists: SDN (Specially Designated Nationals incl. aliases) and the Consolidated non-SDN list, refreshed daily from official Treasury sources. Returns match candidates with confidence scores and list references. Input: person, company or vessel name.

CVE lookup for agents: checks OSV.dev for a CVE identifier and returns severity, summary, references and a normalized risk report.

database migration risk scan for SQL migrations: flags destructive statements, unbounded updates and risky NOT NULL column additions.

deployment configuration risk scan for YAML, Docker Compose or Kubernetes snippets: flags privileged containers, latest tags, host networking and plaintext secrets.

public GitHub repository health check: archived status, recency, license, stars, forks, issues and risk flags for dependency or vendor review.

npm package risk report for coding agents: registry metadata, weekly downloads, license, repository, deprecation and install script risk signals.

prompt-injection risk scan: detects instruction override, tool abuse and secret exfiltration phrases before an agent consumes untrusted text.

PyPI package risk report for agents: package metadata, latest release recency, license, project links, yanked release and supply-chain risk flags.

local secret pattern scan for pasted files or diffs: detects common private keys, API keys, GitHub tokens and EVM private keys without sending data to an LLM.

Finds the closest archived snapshot of any public URL in the Internet Archive Wayback Machine. Returns the snapshot URL, capture timestamp and original HTTP status. Optional timestamp (YYYYMMDD or longer) targets a specific date. For research agents verifying past content, checking link rot, or citing sources as they appeared.

DMARC check for a domain: finds the TXT record, policy mode and aggregate-reporting signal for email trust decisions.

DNS-over-HTTPS lookup for common record types, normalized into a risk report for web and email agents.

domain risk report from DNS signals: address records, nameservers, MX records and high-abuse TLD heuristics.

email deliverability and spoofing check from DNS: MX, SPF and DMARC records with concise risk flags.

SSL certificate signal check using public Certificate Transparency records, including issuer and expiry risk where available.

website trust report from a direct HTTPS fetch: status, response headers, HSTS, CSP and clickjacking protection signals.