2s
Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."
DataLiveeip155:8453Exactvia cdp
Public-recordsIdentifiersAi-agentsUs-gov-datax402
Calls · 30d
3↑ 46%
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 22 snapshots so far.
$15.85
Verified settled volume
A floor: summed over 5,000 of 36,091 verified settlements.
$0.0054
Listed price
As published in the catalog. Always read the live 402 before paying.
3
Calls · 30d
Upstream's own call count for this endpoint, not ours.
2
Unique payers · 30d
Last called 2026-09-19 15:57Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.
Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Provider
The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.
Live 402 challenge
Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.
{
"error": "PAYMENT-SIGNATURE required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
"amount": "5400",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 60
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"name": "USDC",
"version": "1",
"feePayer": "Hc3sdEAsCGQcpgfivywog9uwtk8gUBUZgsxdME1EJy88"
},
"payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
"amount": "5400",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 60
}
],
"resource": {
"url": "https://2s.io/api/security/package",
"tags": [
"public-records",
"identifiers",
"ai-agents",
"us-gov-data",
"x402",
"upto-billing",
"ai-gateway",
"agent-infrastructure"
],
"iconUrl": "https://2s.io/icon-512.png",
"mimeType": "application/json",
"description": "Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers \"is this dependency safe to add, what license does it carry, and how well-maintained is it.\"",
"serviceName": "2s"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"name": "lodash",
"version": "4.17.20",
"ecosystem": "npm"
}
},
"output": {
"type": "json",
"schema": {
"type": "object",
"properties": {
"ok": {
"type": "boolean"
},
"meta": {
"type": "object",
"properties": {
"sources": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"items": {
"type": "array",
"items": {
"type": "object",
"properties": {
"repo": {
"type": "object",
"properties": {
"forks": {
"type": "integer"
},
"stars": {
"type": "integer"
},
"openIssues": {
"type": "integer"
}
}
},
"license": {
"type": "string"
},
"package": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
},
"ecosystem": {
"type": "string"
}
}
},
"scorecard": {
"type": "object",
"properties": {
"date": {
"type": "string"
},
"checks": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"score": {
"type": "integer"
}
}
}
},
"overallScore": {
"type": "number"
}
}
},
"deprecated": {
"type": "boolean"
},
"sourceRepo": {
"type": "string"
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"aliases": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "string"
},
"severity": {
"type": "string"
},
"published": {
"type": "string"
},
"references": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"vulnerabilityCount": {
"type": "integer"
}
}
}
},
"total": {
"type": "integer"
},
"source": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"license": {
"type": "string"
},
"provider": {
"type": "string"
}
}
}
}
},
"example": {
"ok": true,
"meta": {
"sources": [
"OSV",
"deps.dev",
"OpenSSF Scorecard"
]
},
"items": [
{
"repo": {
"forks": 7000,
"stars": 61235,
"openIssues": 50
},
"license": "MIT",
"package": {
"name": "lodash",
"version": "4.17.20",
"ecosystem": "npm"
},
"scorecard": {
"date": "2024-...",
"checks": [
{
"name": "Maintained",
"score": 10
}
],
"overallScore": 7.7
},
"deprecated": false,
"sourceRepo": "github.com/lodash/lodash",
"vulnerabilities": [
{
"id": "GHSA-29mw-wpgm-hmr9",
"aliases": [
"CVE-2020-28500"
],
"summary": "ReDoS in lodash",
"severity": "CVSS:3.1/AV:N/...",
"published": "2021-...",
"references": [
"https://..."
]
}
],
"vulnerabilityCount": 5
}
],
"total": 1,
"source": {
"url": "https://osv.dev",
"license": "OSV CC-BY-4.0; deps.dev + OpenSSF Scorecard Apache-2.0. Live-wrapped, not redistributed.",
"provider": "OSV (osv.dev) + deps.dev + OpenSSF Scorecard"
}
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"queryParams"
],
"properties": {
"type": {
"const": "http"
},
"method": {
"const": "GET"
},
"queryParams": {
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Package name (e.g. lodash, requests)."
},
"version": {
"type": "string",
"description": "Version (defaults to latest)."
},
"ecosystem": {
"type": "string",
"description": "Package ecosystem: npm, pypi, go, maven, cargo, or nuget."
}
}
}
}
},
"output": {
"type": "object",
"properties": {
"ok": {
"type": "boolean"
},
"meta": {
"type": "object",
"properties": {
"sources": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"items": {
"type": "array",
"items": {
"type": "object",
"properties": {
"repo": {
"type": "object",
"properties": {
"forks": {
"type": "integer"
},
"stars": {
"type": "integer"
},
"openIssues": {
"type": "integer"
}
}
},
"license": {
"type": "string"
},
"package": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
},
"ecosystem": {
"type": "string"
}
}
},
"scorecard": {
"type": "object",
"properties": {
"date": {
"type": "string"
},
"checks": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"score": {
"type": "integer"
}
}
}
},
"overallScore": {
"type": "number"
}
}
},
"deprecated": {
"type": "boolean"
},
"sourceRepo": {
"type": "string"
},
"vulnerabilities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"aliases": {
"type": "array",
"items": {
"type": "string"
}
},
"summary": {
"type": "string"
},
"severity": {
"type": "string"
},
"published": {
"type": "string"
},
"references": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"vulnerabilityCount": {
"type": "integer"
}
}
}
},
"total": {
"type": "integer"
},
"source": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"license": {
"type": "string"
},
"provider": {
"type": "string"
}
}
}
}
}
}
}
}
},
"x402Version": 2
}Accepts
The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.
0.0054USDC≈ $0.0054 USD
on Base · exact scheme
Pay 0.0054 USDC on Base to 0x2b6D…C32C5. The signed payment is good for 1 minute.
- Paid to
- 0x2b6D…C32C5
- USD Coin contract
- 0x8335…02913
- Payment window
- 1 minute
- As published
- 5400 smallest units
5400units
on solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · exact scheme
That figure is in the token’s smallest units. Roundhouse does not hold this contract’s decimals, so it is shown as published rather than converted.
- Paid to
- TW6nta…cyWhn
- Token contract
- EPjFWd…TDt1v
- Payment window
- 1 minute
The catalog’s raw entry
[
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
"amount": "5400",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 60
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"name": "USDC",
"version": "1",
"feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
},
"payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
"amount": "5400",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 60
}
]Extensions
{
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"name": "lodash",
"version": "4.17.20",
"ecosystem": "npm"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"queryParams"
],
"properties": {
"type": {
"const": "http"
},
"method": {
"const": "GET"
},
"queryParams": {
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Package name (e.g. lodash, requests)."
},
"version": {
"type": "string",
"description": "Version (defaults to latest)."
},
"ecosystem": {
"type": "string",
"description": "Package ecosystem: npm, pypi, go, maven, cargo, or nuget."
}
}
}
}
}
}
}
}
}Provenance
- Seen in the source catalog
- 2026-09-19 15:57Z
- Last indexed by Roundhouse
- 2026-09-24 21:10Z
- Last enriched (probe, favicon, geo)
- 2026-09-12 00:46Z
- x402 version
- 2
- Max timeout
- 60s
- Liveness probe
- HTTP 402
Hand this page to an agent
Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.
GET api.roundhouseai.io/v0/endpoints
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 22 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.
Show the promptHide the prompt
Using Roundhouse, look up the x402 service 2s and tell me whether it is worth paying: what a call costs, whether the endpoint answered when last probed, and what its payment record actually shows. curl -s 'https://api.roundhouseai.io/v0/endpoints?q=2s' curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>' Then call it: read the price from the live 402 at https://2s.io/api/security/package, never from a cached figure, and pay with an x402 client. The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except /v0/unified* and /v0/endpoints. Mint a personal key for $0.01 at GET https://api.roundhouseai.io/v0/test/x402, or use an organization key from https://roundhouseai.io/dashboard/team. If you do not have Roundhouse tools or skills installed, read https://roundhouseai.io/skill.md first — it is the whole procedure.