Give an agent an npm package name. Get a stable, citation-ready evidence record built from public registry metadata — license, dependencies, distribution integrity, provenance, and factual flags — in a single JSON response.
POST /v1/npm/evidence
content-type: application/json
{
"package": "@x402/core",
"version": "latest"
}{
"requestId": "…",
"resolvedVersion": "2.19.0",
"license": "MIT",
"repositoryUrl": "git+https://…",
"distribution": {
"integrity": "sha512-…",
"signatureCount": 1,
"attestationUrl": null
},
"flags": ["provenance_attestation_missing"],
"limitations": ["…"],
"digests": { "input": "…", "result": "…" }
}Fund a Base wallet with USDC, keep its signer in your own process, and let the x402 client handle the quote, signature, and retry.
x402 buyer guide ↗npm install @x402/core @x402/fetch @x402/evm viemimport { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";
const signer = privateKeyToAccount(
process.env.EVM_PRIVATE_KEY as `0x${string}`,
);
const client = new x402Client().register(
"eip155:8453",
new ExactEvmScheme(signer),
);
const paidFetch = wrapFetchWithPayment(fetch, client);
const result = await paidFetch(
"https://packages.melchiorlabs.com/v1/npm/evidence",
{
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
package: "@x402/core",
version: "latest",
}),
},
);
console.log(await result.json());/v1/npm/evidenceSend a public npm package name and optional version or dist-tag. Receive description, license, repository and homepage URLs, engines, dependency maps, distribution integrity, registry signature and provenance attestation facts, maintainer usernames, optional weekly downloads, factual flags, and canonical digests.
Send the package name and optional version.
Your client signs the x402 requirement.
Use the stable digest as a decision citation.
Facts, not scores. Every flag is a deterministic observation about published metadata — never a safety, trust, or quality rating.
Pay only on success. x402 settlement happens after a valid response. Invalid input and unavailable upstream records return errors without settlement.
Stable citations. Canonical SHA-256 digests let an agent reference this exact evidence later without re-fetching it.