Does this package or repo actually exist and is it safe to depend on? Catches "slopsquatting" and dependency hallucination before an agent installs or recommends something that doesn't check out.
An LLM that hallucinates a plausible-sounding package name is a real, documented attack surface ("slopsquatting") — someone registers the hallucinated name with malware inside, and an agent that trusts its own suggestion installs it. The same applies to recommending or depending on a GitHub repo that's actually been renamed, abandoned, or taken down.
npm, PyPI, or crates.io, checked against the registry plus OSV.dev advisories. Flags packages that don't exist, are deprecated/yanked, or have known vulnerabilities.
Checked against the GitHub REST API. Flags repos that don't exist, are archived, or are disabled.
Every check is deterministic and evidence-backed — no LLM in the verification path. "Unknown" is a valid, honest answer when a source is down, and it's never charged.
curl -i https://goodsong.dev/verify/package \
-H "Content-Type: application/json" \
-d '{"ecosystem": "npm", "name": "left-pad"}'
# → 402 Payment Required, with the x402 payment challenge in the response body
Every endpoint takes the same call shape, just a different body:
POST /verify/package {"ecosystem": "npm", "name": "left-pad"}
POST /verify/repo {"owner": "expressjs", "repo": "express"}
package: ecosystem must be npm, pypi, or crates; version optional (defaults to latest).repo: owner and repo name, e.g. from github.com/{owner}/{repo}.Pay per call via x402 (USDC on Base) — no account, no key. A failed check (our source was down) is always free. Full field reference in the OpenAPI spec.