# Package Evidence API

> Pay-per-request npm package evidence for coding agents: registry facts, distribution integrity, provenance, and factual flags.

Base URL: https://packages.melchiorlabs.com
OpenAPI: https://packages.melchiorlabs.com/openapi.json
Discovery: https://packages.melchiorlabs.com/.well-known/x402
Payment: x402 v2, Base or Solana mainnet USDC, no account or API key

## Paid resource

- POST https://packages.melchiorlabs.com/v1/npm/evidence — $0.003 after a successful response. Send JSON with a public npm `package` name; optional `version` (exact semver or dist-tag, defaults to `latest`) and `nodeVersion` (exact stable semver, enables the `node_engine_mismatch` flag).

An unpaid request returns HTTP 402 with a machine-readable PAYMENT-REQUIRED header. Retry with the x402 payment signature. Invalid input and unavailable upstream registry records are not settled. This service reports registry facts only: it does not scan for vulnerabilities, does not detect malware, and does not certify that a package is safe, trustworthy, or maintained.

## TypeScript paid quickstart

Install @x402/core, @x402/fetch, @x402/evm, and viem. Register an ExactEvmScheme for eip155:8453 with an EVM signer, wrap the native fetch function with wrapFetchWithPayment, and POST the request body normally. The client handles the HTTP 402 quote, payment signature, and retry. A complete copyable example is published on https://packages.melchiorlabs.com/#paid-quickstart. Official buyer documentation: https://docs.x402.org/getting-started/quickstart-for-buyers

## Free resources

- GET https://packages.melchiorlabs.com/openapi.json — complete OpenAPI 3.1 schema and payment metadata.
- GET https://packages.melchiorlabs.com/v1/health — service health and deployed revision.
- GET https://packages.melchiorlabs.com/.well-known/x402 and https://packages.melchiorlabs.com/.well-known/x402.json — Bazaar discovery manifest.