ToolMint DevSec Pack

One call per dependency: package trust + vulnerabilities at that version (OSV, CISA KEV, FIRST EPSS, fix version) + license obligations. For coding and DevSec agents deciding whether to add or upgrade a package.

Routes and prices

Route	Price	What it does	Parameters (* required)
`GET /pack`	$0.008	DevSec pack for one dependency: trust (registry, typosquat), vulns at that version (OSV + CISA KEV + FIRST EPSS, fix version) and license obligations (SPDX). Not charged on 4xx/5xx.	`eco`, `name`, `version`
`GET /pack/{eco}/{name}`	$0.008	DevSec pack for one dependency: trust (registry, typosquat), vulns at that version (OSV + CISA KEV + FIRST EPSS, fix version) and license obligations (SPDX). Not charged on 4xx/5xx. (by path; ?version=)	`eco`, `name`, `version`

Free routes: /, /health, /openapi.json, /.well-known/x402.

Try it

Not deployed yet. The URL below is the planned address. After launch, an unpaid call returns 402 with the terms in the price table.

curl -i "https://toolmint-devsec-pack.toolmint.workers.dev/pack?eco=npm&name=lodash&version=4.17.20"

Errors are not charged

Payment settles only on a successful answer. These responses are never settled:

Status	Meaning (from the OpenAPI)	Charged?
`400`	Bad parameters (not charged)	No
`404`	Package or version not found (not charged); may include typoNeighbors	No
`502`	Registry or OSV unavailable (not charged)	No