Developer Tools

Package & Dependency Trust API API

The Package & Dependency Trust API scores open-source packages and repositories as clean JSON.

4 actionsLive JSON1,000 free creditsMCP-ready

🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.

The primary package_trust endpoint returns a package's metadata, license (SPDX, tier and risk note), maintainers and keywords alongside a trust assessment, and you can score a repo, scan a lockfile and batch many packages. It is built for supply-chain security, dependency review and license-compliance workflows that need a trust signal for open-source code without manual auditing. One ReefAPI key, one shared credit pool, the standard envelope.

Live example

Real request and response JSON

Captured from the indexed primary action, package_trust, on Jul 18, 2026, 5:19 PM UTC.

Captured request

{
  "method": "POST",
  "url": "https://api.reefapi.com/enrich-package/v1/package_trust",
  "headers": {
    "x-api-key": "$REEF_KEY",
    "content-type": "application/json"
  },
  "body": {
    "ecosystem": "npm",
    "package": "lodash",
    "version": "4.17.15",
    "mode": "rich"
  }
}

Captured response

{
  "ok": true,
  "meta": {
    "api": "enrich-package",
    "endpoint": "package_trust",
    "mode": "rich",
    "latency_ms": 4864.3,
    "record_count": 1,
    "bytes": 0,
    "cache_hit": false,
    "completeness_pct": 80,
    "subcalls": [
      {
        "api": "packages",
        "action": "downloads",
        "status": "ok",
        "latency_ms": 691
      },
      {
        "api": "vuln-intel",
        "action": "package_vulns",
        "status": "ok",
        "latency_ms": 882.9
      },
      {
        "api": "packages",
        "action": "maintainer",
        "status": "ok",
        "latency_ms": 991.2
      }
    ]
  },
  "data": {
    "provenance": {
      "registry": {
        "status": "matched",
        "engine": "packages"
      },
      "downloads": {
        "status": "matched",
        "engine": "packages"
      },
      "repo": {
        "status": "matched",
        "engine": "registry-metadata"
      },
      "vulnerabilities": {
        "status": "matched",
        "engine": "vuln-intel"
      },
      "repo_health": {
        "status": "matched",
        "engine": "github"
      },
      "community": {
        "status": "matched",
        "engine": "stackoverflow"
      }
    },
    "generated_at": "[redacted-phone]T17:19:42Z",
    "honesty": "trust score is a RISK SIGNAL, not a security guarantee; scores degrade to 'unknown' rather than show a clean-looking default when a source is missing or a repo match is low-confidence",
    "package": {
      "name": "lodash",
      "ecosystem": "npm",
      "version": "4.17.15",
      "latest_version": "4.18.1",
      "description": "Lodash modular utilities.",
      "homepage": "https://lodash.com/"
    },
    "metadata": {
      "license": {
        "value": "MIT",
        "raw": "MIT"
      },
      "keywords": [
        "modules",
        "stdlib",
        "util"
      ],
      "version_count": 117,
      "latest": "4.18.1",
      "maintainers": [
        {
          "name": "mathias",
          "email": "[redacted-email]"
        },
        {
          "name": "jdalton",
          "email": "[redacted-email]"
        },
        {
          "name": "bnjmnt4n",
          "email": "[redacted-email]"
        }
      ]
    },
    "downloads": {
      "registry": "npm",
      "period": "last-month",
      "downloads": 617129388,
      "start": "[redacted-phone]",
      "end": "[redacted-phone]"
    },
    "repo": {
      "found": true,
      "host": "github",
      "owner": "lodash",
      "repo": "lodash",
      "repo_url": "https://github.com/lodash/lodash",
      "match": {
        "confidence": 0.95,
        "class": "declared-exact",
        "source_field": "repository",
        "name_similarity": 1,
        "evidence": [
          "github owner/repo parsed from package `repository` field → lodash/lodash",
          "repo↔package name similarity = 1.00"
        ],
        "reason": null
      },
      "health": {
        "stars": 61242,
        "forks": 7182,
        "watchers": 803,
        "open_issues": 96,
        "archived": false,
        "license": "NOASSERTION",
        "pushed_at": "[redacted-phone]T19:48:01Z",
        "created_at": "[redacted-phone]T04:11:46Z",
        "default_branch": "main",
        "top_languages": [
          "JavaScript",
          "HTML",
          "EJS"
        ],
        "release_count_listed": 4,
        "last_release": "[redacted-phone]T21:01:28Z",
        "releases_12mo": 2,
        "contributors_listed": 30,
        "bus_factor": 30,
        "top_contributors": [
          {
            "login": "[trimmed-depth]",
            "contributions": "[trimmed-depth]"
          },
          {
            "login": "[trimmed-depth]",
            "contributions": "[trimmed-depth]"
          },
          {
            "login": "[trimmed-depth]",
            "contributions": "[trimmed-depth]"
          }
        ]
      }
    },
    "vulnerabilities": {
      "count": 6,
      "highest_severity": "high",
      "by_severity": {
        "critical": 0,
        "high": 3,
        "moderate": 3,
        "low": 0,
        "unknown": 0
      },
      "items": [
        {
          "id": "GHSA-29mw-wpgm-hmr9",
          "cve_ids": [
            "[trimmed-depth]"
          ],
          "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
          "severity": "MODERATE",
          "cvss_base_score": null,
          "fixed_versions": [
            "[trimmed-depth]"
          ]
        },
        {
          "id": "GHSA-35jh-r3h4-6jhm",
          "cve_ids": [
            "[trimmed-depth]",
            "[trimmed-depth]"
          ],
          "summary": "Command Injection in lodash",
          "severity": "HIGH",
          "cvss_base_score": null,
          "fixed_versions": [
            "[trimmed-depth]"
          ]
        },
        {
          "id": "GHSA-f23m-r3pf-42rh",
          "cve_ids": [
            "[trimmed-depth]",
            "[trimmed-depth]"
          ],
          "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
          "severity": "MODERATE",
          "cvss_base_score": null,
          "fixed_versions": [
            "[trimmed-depth]"
          ]
        }
      ]
    },
    "community": {
      "stackoverflow": {
        "questions_found": 5,
        "top": [
          {
            "title": "[trimmed-depth]",
            "score": "[trimmed-depth]",
            "is_answered": "[trimmed-depth]",
            "link": "[trimmed-depth]"
          },
          {
            "title": "[trimmed-depth]",
            "score": "[trimmed-depth]",
            "is_answered": "[trimmed-depth]",
            "link": "[trimmed-depth]"
          },
          {
            "title": "[trimmed-depth]",
            "score": "[trimmed-depth]",
            "is_answered": "[trimmed-depth]",
            "link": "[trimmed-depth]"
          }
        ]
      }
    },
    "score": {
      "popularity": {
        "score": 98,
        "inputs": {
          "monthly_downloads": 617129388,
          "stars": 61242
        },
        "method": "mean of log-scaled monthly-downloads (full≈50M) and github stars (full≈100k)"
      },
      "maintenance": {
        "score": 67,
        "inputs": {
          "days_since_last_release": 107,
          "days_since_last_repo_push": 14,
          "releases_last_12mo": 2,
          "archived": false,
          "contributors": 30
        },
        "method": "exp-decay release/push recency + release cadence + contributor bus-factor (equal-weighted over available signals)"
      },
      "security": {
        "score": 0,
        "inputs": {
          "vuln_query_ok": true,
          "vuln_count": 6,
          "severity_summary": {
            "by_severity": "[trimmed-depth]",
            "highest_severity": "[trimmed-depth]",
            "total": "[trimmed-depth]"
          },
          "version_pinned": true,
          "repo_match_trusted": true,
          "known_exploited_count": null
        },
        "note": "security score is a risk SIGNAL, not a guarantee of safety",
        "method": "100 − weighted severity penalty (crit45/high25/mod10/low4) for the PINNED version; KEV known-exploited floors the score to ≤10"
      },
      "license": {
        "score": "unknown",
        "inputs": {
          "license": "MIT",
          "spdx_id": "NOASSERTION"
        },
        "tier": "unknown",
        "method": "SPDX tier: permissive→90, weak-copyleft→55, strong-copyleft/SSPL→25, none/unknown→unknown",
        "missing_reason": "no license declared in registry/repo metadata",
        "note": "license tier reflects integration friction for an API/SaaS consumer, not legal advice"
      },
      "dependency_risk": {
        "score": 100,
        "inputs": {
          "direct_dependencies": 0,
          "vulnerable_dependencies": null,
          "dependencies_scanned": null
        },
        "method": "exp-decay fan-out penalty (direct deps) + clean-dependency ratio when deps were vuln-scanned"
      },
      "overall": {
        "trust_score": 56,
        "grade": "C",
        "scored_components": [
          "dependency_risk",
          "maintenance",
          "popularity"
        ],
        "unknown_components": [
          "license"
        ],
        "confidence": 0.85,
        "method": "weighted mean of resolved sub-scores (security0.30/pop0.20/maint0.20/license0.15/dep0.15), renormalized over available components — unknowns excluded, not treated as 0 or 100"
      }
    }
  }
}

Actions

What the Package & Dependency Trust API API does

Action	Description	Concrete use case	Key params
package_trust	ecosystem+package → registry metadata + downloads + maintainers + license + resolved repository health + vulnerabilities + partial trust score (with per-sub-score inputs)	Ops teams call package_trust to get ecosystem+package → registry metadata + downloads + maintainers + license + resolved reposito….	ecosystem, package, version, mode
repo_trust	owner/repo → repository health + release cadence + bus-factor signal + repo-anchored trust sub-scores (popularity/maintenance), independent of any registry	Developer tools call repo_trust to get owner/repo → repository health + release cadence + bus-factor signal + repo-anchored trust su….	owner, repo
lockfile_scan	manifest/lockfile text → dependency list + each dep's vuln/risk summary via one batched vuln scan (BOUNDED: direct + lockfile-pinned deps, max 100; truncated:true when capped). package.json/lock, requirements.txt, go.sum/mod, Cargo.lock, Gemfile.lock	Validation workflows call lockfile_scan to get manifest/lockfile text → dependency list + each dep's vuln/risk summary via one batched vuln….	content, filename, ecosystem
batch	trust-score up to 10 packages in one call (basic depth, per-item ok/error)	Data-quality teams call batch to get trust-score up to 10 packages in one call (basic depth, per-item ok/error).	items

Code samples

Call package_trust from your stack

curl -X POST https://api.reefapi.com/enrich-package/v1/package_trust \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"ecosystem":"npm","package":"lodash","version":"4.17.15","mode":"rich"}'

import requests

r = requests.post(
    "https://api.reefapi.com/enrich-package/v1/package_trust",
    headers={"x-api-key": REEF_KEY},
    json={
  "ecosystem": "npm",
  "package": "lodash",
  "version": "4.17.15",
  "mode": "rich"
},
)
print(r.json()["data"])

const res = await fetch("https://api.reefapi.com/enrich-package/v1/package_trust", {
  method: "POST",
  headers: {
    "x-api-key": process.env.REEF_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({
  "ecosystem": "npm",
  "package": "lodash",
  "version": "4.17.15",
  "mode": "rich"
}),
});
const { ok, data, meta, error } = await res.json();

MCP one-liner

Ask your MCP-connected assistant: call reefapi.enrich-package.package_trust with {"ecosystem":"npm","package":"lodash","version":"4.17.15","mode":"rich"}.

Use cases

Who uses this API and why

Security teams call lockfile_scan to trust-score every dependency in a project at once.
License-compliance tools use package_trust to catch copyleft or risky licenses before adoption.
Engineering teams use repo_trust to vet a library's maintenance and health before depending on it.

FAQ

Questions developers ask before integrating

What is the Package & Dependency Trust API API?

Package & Dependency Trust API API is a ReefAPI endpoint group for package & dependency trust api It returns live JSON through POST requests under /enrich-package/v1.

Is the Package & Dependency Trust API API free to try?

Yes. ReefAPI starts with 1,000 free credits, no card required. Package & Dependency Trust API calls use the same shared credit balance as every other ReefAPI engine.

Do I need a Package & Dependency Trust API login or account?

No login to Package & Dependency Trust API is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.

How fresh is the Package & Dependency Trust API data?

The page example is captured from a live package_trust call, and production requests fetch live data through ReefAPI rather than a static sample.

How many credits does the Package & Dependency Trust API API use?

Package & Dependency Trust API actions currently cost 2-5 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.

Can I call Package & Dependency Trust API from an AI assistant or MCP client?

Yes. Connect ReefAPI once through MCP and your assistant can call enrich-package actions with the same key, credit pool and JSON envelope used by normal REST requests.

Is the Package & Dependency Trust API API a Package & Dependency Trust API scraper?

It is the managed alternative to a DIY Package & Dependency Trust API scraper. Instead of building and maintaining your own scraper — proxies, headless browsers, captcha and constant breakage — you call one ReefAPI endpoint and get the same package & dependency trust api back as clean JSON.

Why does my Package & Dependency Trust API scraper keep getting blocked?

Most Package & Dependency Trust API scrapers break on anti-bot defenses, rate limits and IP bans that need rotating residential proxies and browser fingerprinting to clear. ReefAPI handles all of that for you — no proxies, no captchas, no maintenance — and returns live JSON. Blocked or failed calls are free.

docs / enrich-package

Package & Dependency Trust API

base /enrich-package/v14 endpoints

post/enrich-package/v1/package_trust3 credits

ecosystem+package → registry metadata + downloads + maintainers + license + resolved repository health + vulnerabilities + partial trust score (with per-sub-score inputs)

Parameter		Allowed / range	Description
ecosystem	required	npm · pypi · maven · rubygems · crates · go	Package ecosystem. npm/pypi get full registry metadata + downloads; maven/rubygems/crates/go get vulnerabilities + declared-repository health (the wider OSV ecosystem set).
package	required	—	Package name as published in its registry (npm 'lodash', PyPI 'requests', Maven 'group:artifact', Go import path). Scoped npm names like '@scope/pkg' are supported.
version	optional	—	Exact installed version to assess for vulnerabilities. Omit to assess the latest published version + ALL known vulns of the package.
mode = rich	optional	basic · rich	basic = registry metadata + license + repo health + score; rich (default) adds the full vulnerability scan, release cadence, contributor bus-factor and a stackoverflow community signal.

Try in playground →

post/enrich-package/v1/repo_trust3 credits

owner/repo → repository health + release cadence + bus-factor signal + repo-anchored trust sub-scores (popularity/maintenance), independent of any registry

Parameter		Allowed / range	Description
owner	required	—	GitHub repository owner / org (e.g. 'facebook').
repo	required	—	GitHub repository name (e.g. 'react').

Try in playground →

post/enrich-package/v1/lockfile_scan5 credits

manifest/lockfile text → dependency list + each dep's vuln/risk summary via one batched vuln scan (BOUNDED: direct + lockfile-pinned deps, max 100; truncated:true when capped). package.json/lock, requirements.txt, go.sum/mod, Cargo.lock, Gemfile.lock

Parameter		Allowed / range	Description
content	required	—	Raw manifest/lockfile text: package.json, package-lock.json, requirements.txt, go.sum/go.mod, Cargo.lock, or Gemfile.lock. Direct (+ lockfile-pinned) deps are scanned; bounded to 100 deps.
filename	optional	—	Optional filename hint to disambiguate the manifest format (e.g. 'package-lock.json', 'go.sum'). Auto-detected if omitted.
ecosystem	optional	npm · pypi · maven · rubygems · crates · go	Optional ecosystem hint when the manifest format is ambiguous.

Try in playground →

post/enrich-package/v1/batch2 credits

trust-score up to 10 packages in one call (basic depth, per-item ok/error)

Parameter		Allowed / range	Description
items	required	—	Up to 10 {ecosystem, package, version?} objects. Each is trust-scored like package_trust (basic depth); per-item ok/error.

Try in playground →

Example request · package_trust

curl -X POST https://api.reefapi.com/enrich-package/v1/package_trust \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"ecosystem":"npm","package":"lodash","version":"4.17.15","mode":"rich"}'

Response shape

{
  "ok": true,
  "data": { /* the result */ },
  "meta": {
    "latency_ms": 240,
    "record_count": 12,
    "completeness_pct": 100
  },
  "error": null
}