Every API, one clean contract.

ecosystem+package → registry metadata + downloads + maintainers + license + resolved repository health + vulnerabilities + partial trust score (with per-sub-score inputs)

{
  "ecosystem": "npm",
  "package": "lodash",
  "version": "4.17.15",
  "mode": "rich"
}

owner/repo → repository health + release cadence + bus-factor signal + repo-anchored trust sub-scores (popularity/maintenance), independent of any registry

{
  "owner": "facebook",
  "repo": "react"
}

manifest/lockfile text → dependency list + each dep's vuln/risk summary via one batched vuln scan (BOUNDED: direct + lockfile-pinned deps, max 100; truncated:true when capped). package.json/lock, requirements.txt, go.sum/mod, Cargo.lock, Gemfile.lock

{
  "content": "lodash\nflask==2.0.0\nrequests==2.20.0",
  "filename": "requirements.txt"
}

trust-score up to 10 packages in one call (basic depth, per-item ok/error)

{
  "items": [
    {
      "ecosystem": "npm",
      "package": "p0"
    },
    {
      "ecosystem": "npm",
      "package": "p1"
    },
    {
      "ecosystem": "npm",
      "package": "p2"
    },
    {
      "ecosystem": "npm",
      "package": "p3"
    },
    {
      "ecosystem": "npm",
      "package": "p4"
    },
    {
      "ecosystem": "npm",
      "package": "p5"
    },
    {
      "ecosystem": "npm",
      "package": "p6"
    },
    {
      "ecosystem": "npm",
      "package": "p7"
    },
    {
      "ecosystem": "npm",
      "package": "p8"
    },
    {
      "ecosystem": "npm",
      "package": "p9"
    },
    {
      "ecosystem": "npm",
      "package": "p10"
    }
  ]
}