{ "openapi": "3.0.3", "info": { "title": "Code Review and Software Supply Chain Security API", "version": "2.0.0", "description": "Gate pull requests, scan hidden Unicode, audit dependencies, prove logic and check EU CRA readiness.", "contact": { "name": "WritersLogic", "url": "https://writerslogic.com/agents" }, "termsOfService": "https://writerslogic.com/terms", "x-category": "cybersecurity", "x-long-description": "Merge-time and release-time checks for software teams and coding agents. Gate a pull request on a verdict with file and line findings and a SARIF log, catch Trojan Source and hidden Unicode, audit dependencies for unused, vulnerable and deprecated packages, resolve AI model license chains, compute EU Cyber Resilience Act reporting deadlines, audit a page for WCAG failures, and prove properties of contracts, policies and state machines with a solver. Every successful response is signed.\n\nEndpoints: Pull Request Merge Gate; Dependency Risk and Underuse Audit; Trojan Source and Hidden Unicode Scanner; Pre-Merge Review Pack; EU CRA Readiness Check; EU CRA Exploited Vulnerability Clock; AI Model License Chain Resolver; WCAG Accessibility Audit and HTML Patch; Contract and Policy Logic Prover; State Machine Model Checker; Verify a Signed Result.\n\nEvery successful response is signed, and the Verify a Signed Result endpoint checks any of them. Documentation for every endpoint: https://writerslogic.com/agents/", "x-website": "https://writerslogic.com/agents/", "x-public": false, "x-thumbnail": "https://agents.writerslogic.com/logos/code.png", "x-version-lifecycle": "active" }, "servers": [ { "url": "https://agents.writerslogic.com/api", "description": "Base URL" } ], "components": {}, "paths": { "/v1/gatekeep-diff": { "post": { "operationId": "diffGatekeeper", "summary": "Pull Request Merge Gate", "description": "`POST /v1/gatekeep-diff`\n\nGates a pull request: pass, warn or fail verdict, 0-100 risk score, top findings with file and line and a fix, patches, GitHub Checks annotations and a SARIF 2.1.0 log. Accepts a unified diff or a GitHub PR, commit or compare URL. Deterministic scanners cover secrets, injection, weak crypto and risky package.json changes; model findings must point at a line in the diff or they are marked ungrounded and never block.\n\n**What you get:** A CI-ready merge gate: stops a leaked secret, an injection bug or a silent API break before it ships, and hands the author the file, line and fix.\n\n### Use it for\n\n- Gate a pull request in CI with a pass, warn or fail verdict and a 0-100 risk score.\n- Catch leaked secrets, SQL and command injection, weak crypto and risky package.json changes before merge.\n- Hand the author the file, line and a drop-in patch, and publish GitHub Checks annotations or a SARIF log.\n\n### Details and limits\n\nMerge gate for a pull request: pass/warn/fail verdict, 0-100 risk score, the top findings with file:line and a fix, drop-in patches, GitHub Checks annotations and a SARIF 2.1.0 log. Accepts a raw unified diff, a GitHub PR, commit or compare URL, or per-file patches. Deterministic scanners (secrets, SQL and command injection, weak crypto, risky package.json changes) run beside a model review for bugs, race conditions and silent API breaks, and every model finding must point at a line inside the diff or it is marked ungrounded and never blocks. Large diffs are reviewed in up to 4 parts and anything beyond is reported as unreviewed. A review aid, not a replacement for tests or human review.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `gitDiff` | string | no | Raw unified diff (git diff output). Provide exactly one of gitDiff, prUrl or files. |\n| `prUrl` | string | no | Alternative to gitDiff: a public GitHub pull request, commit or compare URL (github.com/owner/repo/pull/123). Its .diff is downloaded; a diff over 300,000 characters is cut at a file boundary and the rest reported as unreviewed. |\n| `files` | array of object | no | Alternative to gitDiff: changed files with their patch hunks, as returned by GitHub's pull request files API. |\n| `packageJsonDiff` | string | no | Package JSON diff. Up to 50,000 characters. |\n| `context` | string | no | What the PR is supposed to do. |\n\n### Example request body\n\n```json\n{\n \"gitDiff\": \"diff --git a/src/users.ts b/src/users.ts\\n--- a/src/users.ts\\n+++ b/src/users.ts\\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\\n+ const id = req.params.id;\\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\\n }\\n\",\n \"context\": \"Refactor user lookup for readability.\"\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/gatekeep-diff\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"gitDiff\":\"diff --git a/src/users.ts b/src/users.ts\\n--- a/src/users.ts\\n+++ b/src/users.ts\\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\\n+ const id = req.params.id;\\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\\n }\\n\",\"context\":\"Refactor user lookup for readability.\"}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `summary` | string | Summary. |\n| `intent_alignment` | string | Does the diff do what the context says, and anything it does beyond that. |\n| `breakingChanges` | array of object | Breaking changes, a list of objects. |\n| `securityFlaws` | array of object | Security flaws, a list of objects. |\n| `bugs` | array of object | Bugs, a list of objects. |\n| `dependency_risks` | array of object | Dependency risks, a list of objects. |\n| `riskScore` | integer | 0-100 overall merge risk. |\n| `verdict` | enum | fail: a secret or a grounded critical or high finding blocks the merge. inconclusive: part of the diff was not reviewed. warn: only non-blocking findings. pass: none. |\n| `verdictReason` | string | Verdict reason. |\n| `status` | enum | partial when part of the diff was not reviewed or an over-long added line was pattern-scanned only in part; the result is still signed. |\n| `nextStep` | string | Next step. |\n| `topFindings` | array of object | Top findings, a list of objects. |\n| `annotations` | array of object | Annotations, a list of objects. |\n| `sarif` | object | SARIF 2.1.0 log of every grounded finding at its file and line; uploads to GitHub code scanning as-is. |\n| `mergeApproved` | boolean | True when no secret and no grounded critical or high finding was found and the whole diff was reviewed. |\n| `modelRiskScore` | integer | The model's own 0-100 estimate; advisory. riskScore is computed from grounded findings (critical 40, high 20, medium 8, low 2, capped at 100) with scanner floors. |\n| `blockers` | array of string | Blockers, a list of strings. |\n| `dependencyRisks` | object | Dependency risks, an object. |\n| `secretsDetected` | array of object | Secrets detected, a list of objects. |\n| `suggestedPatches` | array of object | Suggested patches, a list of objects. |\n| `stats` | object | Stats, an object. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"verdict\": \"fail\",\n \"verdictReason\": \"3 blocking findings: SQL statement built by interpolating values into a template literal (src/users.ts:11); Interpolating the raw id without quoting or casti...\",\n \"mergeApproved\": false,\n \"riskScore\": 65,\n \"status\": \"complete\",\n \"nextStep\": \"Do not merge. Fix SAST-01 at src/users.ts:11: Restores the parameterized query so the id is bound as a value by the driver rather than interpolated into the ...\",\n \"topFindings\": [\n {\n \"rank\": 1,\n \"id\": \"SAST-01\",\n \"kind\": \"security\",\n \"severity\": \"high\",\n \"file\": \"src/users.ts\",\n \"line\": 11,\n \"title\": \"SQL statement built by interpolating values into a template literal\",\n \"fix\": \"Restores the parameterized query so the id is bound as a value by the driver rather than interpolated into the SQL text, eliminating SQL injection.\",\n \"blocking\": true\n },\n {\n \"rank\": 2,\n \"id\": \"BUG-01\",\n \"kind\": \"bug\",\n \"severity\": \"high\",\n \"file\": \"src/users.ts\",\n \"line\": 11,\n \"title\": \"Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` iden...\",\n \"fix\": \"Fix the defect described and add a regression test.\",\n \"blocking\": true\n },\n {\n \"rank\": 3,\n \"id\": \"BC-01\",\n \"kind\": \"breaking_change\",\n \"severity\": \"high\",\n \"file\": \"src/users.ts\",\n \"line\": 11,\n \"title\": \"The id is now inlined unquoted into the SQL text instead of being bound as $1.\",\n \"fix\": \"Restore the previous contract, or version the change and update consumers.\",\n \"blocking\": true\n }\n ],\n \"annotations\": [\n {\n \"path\": \"src/users.ts\",\n \"start_line\": 11,\n \"end_line\": 11,\n \"annotation_level\": \"failure\",\n \"title\": \"SAST-01 SQL statement built by interpolating values into a template literal\",\n \"message\": \"SQL statement built by interpolating values into a template literal A value containing SQL syntax changes the statement, enabling data theft or modification....\"\n },\n {\n \"path\": \"src/users.ts\",\n \"start_line\": 11,\n \"end_line\": 11,\n \"annotation_level\": \"failure\",\n \"title\": \"BUG-01 Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefine...\",\n \"message\": \"Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` iden...\"\n },\n {\n \"path\": \"src/users.ts\",\n \"start_line\": 11,\n \"end_line\": 11,\n \"annotation_level\": \"failure\",\n \"title\": \"BC-01 The id is now inlined unquoted into the SQL text instead of being bound as $1.\",\n \"message\": \"The id is now inlined unquoted into the SQL text instead of being bound as $1. For non-numeric ids (UUIDs, slugs, strings), the generated SQL is invalid or r...\"\n }\n ],\n \"sarif\": {\n \"$schema\": \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json\",\n \"version\": \"2.1.0\",\n \"runs\": [\n \"...\"\n ]\n },\n \"modelRiskScore\": 92,\n \"blockers\": [\n \"high SAST-01 in src/users.ts\",\n \"high BUG-01 in src/users.ts\",\n \"high BC-01 in src/users.ts\"\n ],\n \"summary\": \"The diff replaces a parameterized query in findUser with a template-literal query that interpolates req.params.id directly. It is described as a readability ...\",\n \"intent_alignment\": \"Does not match the stated intent. 'Refactor for readability' should preserve behavior, but this removes parameter binding and changes how ids are interpreted...\",\n \"breakingChanges\": [\n {\n \"id\": \"BC-01\",\n \"file\": \"src/users.ts\",\n \"location\": \"findUser, query construction (line 11)\",\n \"severity\": \"high\",\n \"description\": \"The id is now inlined unquoted into the SQL text instead of being bound as $1. For non-numeric ids (UUIDs, slugs, strings), the generated SQL is invalid or r...\",\n \"affected_consumers\": \"All callers of findUser, including route handlers that pass req.params.id, and any client relying on 404 or empty results for unknown or malformed ids, which...\",\n \"source\": \"model\",\n \"grounded\": true\n }\n ]\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/diff-gatekeeper/\nMachine-readable input and result schemas: https://writerslogic.com/agents/diff-gatekeeper.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/diff-gatekeeper", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "gitDiff": { "type": "string", "minLength": 1, "maxLength": 300000, "description": "Raw unified diff (git diff output). Provide exactly one of gitDiff, prUrl or files." }, "prUrl": { "type": "string", "minLength": 20, "maxLength": 300, "description": "Alternative to gitDiff: a public GitHub pull request, commit or compare URL (github.com/owner/repo/pull/123). Its .diff is downloaded; a diff over 300,000 characters is cut at a file boundary and the rest reported as unreviewed." }, "files": { "type": "array", "maxItems": 300, "description": "Alternative to gitDiff: changed files with their patch hunks, as returned by GitHub's pull request files API.", "items": { "type": "object", "additionalProperties": false, "required": [ "path", "patch" ], "properties": { "path": { "type": "string", "minLength": 1, "maxLength": 500, "description": "Path. Up to 500 characters." }, "patch": { "type": "string", "maxLength": 300000, "description": "Patch. Up to 300,000 characters." }, "status": { "type": "string", "enum": [ "added", "modified", "removed", "renamed" ], "description": "One of: added, modified, removed, renamed." }, "previousPath": { "type": "string", "maxLength": 500, "description": "Previous path. Up to 500 characters." } } } }, "packageJsonDiff": { "type": "string", "maxLength": 50000, "description": "Package JSON diff. Up to 50,000 characters." }, "context": { "type": "string", "maxLength": 4000, "description": "What the PR is supposed to do." } }, "description": "Input payload for PR / Dependency Breaking-Change & Exploit Gatekeeper. Required fields: none. Optional fields: `gitDiff`, `prUrl`, `files`, `packageJsonDiff`, `context`.", "externalDocs": { "url": "https://writerslogic.com/agents/diff-gatekeeper.json", "description": "Machine-readable record for PR / Dependency Breaking-Change & Exploit Gatekeeper: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for PR / Dependency Breaking-Change & Exploit Gatekeeper", "description": "A complete valid request body for Pull Request Merge Gate.", "value": { "gitDiff": "diff --git a/src/users.ts b/src/users.ts\n--- a/src/users.ts\n+++ b/src/users.ts\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\n+ const id = req.params.id;\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\n }\n", "context": "Refactor user lookup for readability." } } } } }, "description": "JSON request body for PR / Dependency Breaking-Change & Exploit Gatekeeper. Required fields: none. Optional fields: `gitDiff`, `prUrl`, `files`, `packageJsonDiff`, `context`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "summary": { "type": "string", "description": "Summary." }, "intent_alignment": { "type": "string", "description": "Does the diff do what the context says, and anything it does beyond that." }, "breakingChanges": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "file", "location", "severity", "description", "affected_consumers", "grounded", "source" ], "properties": { "id": { "type": "string", "description": "BC-01, BC-02..." }, "file": { "type": "string", "description": "File." }, "location": { "type": "string", "description": "Location." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "description": { "type": "string", "description": "Description." }, "affected_consumers": { "type": "string", "description": "Affected consumers." }, "grounded": { "type": "boolean", "description": "False when the file or line is not in the diff; ungrounded findings never block." }, "source": { "type": "string", "enum": [ "model", "rule" ], "description": "One of: model, rule." } } }, "description": "Breaking changes, a list of objects." }, "securityFlaws": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "file", "line", "category", "severity", "description", "exploit_scenario", "grounded", "source" ], "properties": { "id": { "type": "string", "description": "SEC-01, SEC-02..." }, "file": { "type": "string", "description": "File." }, "line": { "type": "integer", "description": "Line, a whole number." }, "category": { "type": "string", "enum": [ "sql_injection", "nosql_injection", "command_injection", "xss", "ssrf", "path_traversal", "authz_bypass", "secret_exposure", "insecure_crypto", "deserialization", "supply_chain", "other" ], "description": "One of: sql_injection, nosql_injection, command_injection, xss, ssrf, path_traversal, authz_bypass, secret_exposure, insecure_crypto, deserialization, supply_chain, other." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "description": { "type": "string", "description": "Description." }, "exploit_scenario": { "type": "string", "description": "Exploit scenario." }, "grounded": { "type": "boolean", "description": "False when the file or line is not in the diff; ungrounded findings never block." }, "source": { "type": "string", "enum": [ "model", "rule" ], "description": "One of: model, rule." } } }, "description": "Security flaws, a list of objects." }, "bugs": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "file", "line", "category", "severity", "description", "grounded", "source" ], "properties": { "id": { "type": "string", "description": "BUG-01, BUG-02..." }, "file": { "type": "string", "description": "File." }, "line": { "type": "integer", "description": "Line, a whole number." }, "category": { "type": "string", "enum": [ "race_condition", "state_mutation", "error_handling", "logic_error", "resource_leak", "null_handling", "performance", "other" ], "description": "One of: race_condition, state_mutation, error_handling, logic_error, resource_leak, null_handling, performance, other." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "description": { "type": "string", "description": "Description." }, "grounded": { "type": "boolean", "description": "False when the file or line is not in the diff; ungrounded findings never block." }, "source": { "type": "string", "enum": [ "model", "rule" ], "description": "One of: model, rule." } } }, "description": "Bugs, a list of objects." }, "dependency_risks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "package", "risk", "severity" ], "properties": { "package": { "type": "string", "description": "Package." }, "risk": { "type": "string", "description": "Risk." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." } } }, "description": "Dependency risks, a list of objects." }, "riskScore": { "type": "integer", "description": "0-100 overall merge risk." }, "verdict": { "type": "string", "enum": [ "fail", "warn", "pass", "inconclusive" ], "description": "fail: a secret or a grounded critical or high finding blocks the merge. inconclusive: part of the diff was not reviewed. warn: only non-blocking findings. pass: none." }, "verdictReason": { "type": "string", "description": "Verdict reason." }, "status": { "type": "string", "enum": [ "complete", "partial" ], "description": "partial when part of the diff was not reviewed or an over-long added line was pattern-scanned only in part; the result is still signed." }, "nextStep": { "type": "string", "description": "Next step." }, "topFindings": { "type": "array", "items": { "type": "object", "description": "Up to 5, most severe first: rank, id, kind (secret, security, bug, breaking_change, dependency), severity, file, line, title, fix, blocking." }, "description": "Top findings, a list of objects." }, "annotations": { "type": "array", "items": { "type": "object", "description": "GitHub Checks API annotations: path, start_line, end_line, annotation_level (failure, warning, notice), title, message." }, "description": "Annotations, a list of objects." }, "sarif": { "type": "object", "description": "SARIF 2.1.0 log of every grounded finding at its file and line; uploads to GitHub code scanning as-is." }, "mergeApproved": { "type": "boolean", "description": "True when no secret and no grounded critical or high finding was found and the whole diff was reviewed." }, "modelRiskScore": { "type": "integer", "description": "The model's own 0-100 estimate; advisory. riskScore is computed from grounded findings (critical 40, high 20, medium 8, low 2, capped at 100) with scanner floors." }, "blockers": { "type": "array", "items": { "type": "string" }, "description": "Blockers, a list of strings." }, "dependencyRisks": { "type": "object", "description": "Dependency risks, an object." }, "secretsDetected": { "type": "array", "items": { "type": "object" }, "description": "Secrets detected, a list of objects." }, "suggestedPatches": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "finding_id", "file", "original_code", "corrected_code", "explanation" ], "properties": { "finding_id": { "type": "string", "description": "Finding ID." }, "file": { "type": "string", "description": "File." }, "original_code": { "type": "string", "description": "The exact lines from the diff being replaced." }, "corrected_code": { "type": "string", "description": "Drop-in replacement code." }, "explanation": { "type": "string", "description": "Explanation." }, "also_fixes": { "type": "array", "items": { "type": "string" }, "description": "Other finding ids this same patch resolves." } } }, "description": "Suggested patches, a list of objects." }, "stats": { "type": "object", "description": "Stats, an object." } }, "required": [ "summary", "intent_alignment", "breakingChanges", "securityFlaws", "bugs", "riskScore", "verdict", "verdictReason", "status", "nextStep", "topFindings", "annotations", "sarif", "mergeApproved", "modelRiskScore", "blockers", "dependencyRisks", "secretsDetected", "suggestedPatches", "stats" ], "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "verdict": "fail", "verdictReason": "3 blocking findings: SQL statement built by interpolating values into a template literal (src/users.ts:11); Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` identifier). (src/users.ts:11); The ...", "mergeApproved": false, "riskScore": 65, "status": "complete", "nextStep": "Do not merge. Fix SAST-01 at src/users.ts:11: Restores the parameterized query so the id is bound as a value by the driver rather than interpolated into the SQL text, eliminating SQL injection. Then re-run on the updated diff.", "topFindings": [ { "rank": 1, "id": "SAST-01", "kind": "security", "severity": "high", "file": "src/users.ts", "line": 11, "title": "SQL statement built by interpolating values into a template literal", "fix": "Restores the parameterized query so the id is bound as a value by the driver rather than interpolated into the SQL text, eliminating SQL injection.", "blocking": true }, { "rank": 2, "id": "BUG-01", "kind": "bug", "severity": "high", "file": "src/users.ts", "line": 11, "title": "Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` identifier).", "fix": "Fix the defect described and add a regression test.", "blocking": true }, { "rank": 3, "id": "BC-01", "kind": "breaking_change", "severity": "high", "file": "src/users.ts", "line": 11, "title": "The id is now inlined unquoted into the SQL text instead of being bound as $1.", "fix": "Restore the previous contract, or version the change and update consumers.", "blocking": true } ], "annotations": [ { "path": "src/users.ts", "start_line": 11, "end_line": 11, "annotation_level": "failure", "title": "SAST-01 SQL statement built by interpolating values into a template literal", "message": "SQL statement built by interpolating values into a template literal A value containing SQL syntax changes the statement, enabling data theft or modification. Fix: Restores the parameterized query so the id is bound as a value by the driver rather than interpolated into the SQL text, eliminating S..." }, { "path": "src/users.ts", "start_line": 11, "end_line": 11, "annotation_level": "failure", "title": "BUG-01 Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` identifier).", "message": "Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` identifier). The query no longer passes a values array, so the driver's type handling is bypassed. Errors are not caught, so they propagate as u..." }, { "path": "src/users.ts", "start_line": 11, "end_line": 11, "annotation_level": "failure", "title": "BC-01 The id is now inlined unquoted into the SQL text instead of being bound as $1.", "message": "The id is now inlined unquoted into the SQL text instead of being bound as $1. For non-numeric ids (UUIDs, slugs, strings), the generated SQL is invalid or resolves identifiers, so lookups that used to succeed now throw a syntax or column error. Type coercion semantics also change, and an empty o..." } ], "sarif": { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "writerslogic-diff-gatekeeper", "version": "1.0.0", "semanticVersion": "1.0.0", "informationUri": "https://agents.writerslogic.com", "rules": [ { "id": "diff/security", "name": "security", "shortDescription": { "text": "Security flaw in added code" }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "code-review" ], "security-severity": "8.0" } }, { "id": "diff/bug", "name": "bug", "shortDescription": { "text": "Likely bug in added code" }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "code-review" ], "security-severity": "8.0" } }, { "id": "diff/breaking_change", "name": "breaking_change", "shortDescription": { "text": "Silent breaking change" }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "code-review" ], "security-severity": "8.0" } } ] } }, "results": [ { "ruleId": "diff/security", "ruleIndex": 0, "level": "error", "message": { "text": "SQL statement built by interpolating values into a template literal. SQL statement built by interpolating values into a template literal A value containing SQL syntax changes the statement, enabling data theft or modification. Fix: Restores the parameterized query so the id is bound as a value by..." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/users.ts", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 11 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "SAST-01" }, "properties": { "severity": "high", "source": "rule", "blocking": true } }, { "ruleId": "diff/bug", "ruleIndex": 1, "level": "error", "message": { "text": "Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` identifier).. Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL synta..." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/users.ts", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 11 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "BUG-01" }, "properties": { "severity": "high", "source": "model", "blocking": true } }, { "ruleId": "diff/breaking_change", "ruleIndex": 2, "level": "error", "message": { "text": "The id is now inlined unquoted into the SQL text instead of being bound as $1.. The id is now inlined unquoted into the SQL text instead of being bound as $1. For non-numeric ids (UUIDs, slugs, strings), the generated SQL is invalid or resolves identifiers, so lookups that used to succeed now thr..." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/users.ts", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 11 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "BC-01" }, "properties": { "severity": "high", "source": "model", "blocking": true } } ] } ] }, "modelRiskScore": 92, "blockers": [ "high SAST-01 in src/users.ts", "high BUG-01 in src/users.ts", "high BC-01 in src/users.ts" ], "summary": "The diff replaces a parameterized query in findUser with a template-literal query that interpolates req.params.id directly. It is described as a readability refactor but changes query semantics and removes parameter binding. The resulting SQL injection is already flagged by the scanner (sql-templ...", "intent_alignment": "Does not match the stated intent. 'Refactor for readability' should preserve behavior, but this removes parameter binding and changes how ids are interpreted by the database, so non-numeric ids now behave differently. The change is a behavioral and security regression disguised as a refactor.", "breakingChanges": [ { "id": "BC-01", "file": "src/users.ts", "location": "findUser, query construction (line 11)", "severity": "high", "description": "The id is now inlined unquoted into the SQL text instead of being bound as $1. For non-numeric ids (UUIDs, slugs, strings), the generated SQL is invalid or resolves identifiers, so lookups that used to succeed now throw a syntax or column error. Type coercion semantics also change, and an empty o...", "affected_consumers": "All callers of findUser, including route handlers that pass req.params.id, and any client relying on 404 or empty results for unknown or malformed ids, which will now receive 500 errors.", "source": "model", "grounded": true } ], "securityFlaws": [ { "id": "SAST-01", "file": "src/users.ts", "line": 11, "category": "sql_injection", "severity": "high", "description": "SQL statement built by interpolating values into a template literal", "exploit_scenario": "A value containing SQL syntax changes the statement, enabling data theft or modification.", "source": "rule", "grounded": true } ], "bugs": [ { "id": "BUG-01", "file": "src/users.ts", "line": 11, "category": "logic_error", "severity": "high", "description": "Interpolating the raw id without quoting or casting breaks lookups for string-typed ids and for missing or empty params (SQL syntax error or `undefined` identifier). The query no longer passes a values array, so the driver's type handling is bypassed. Errors are not caught, so they propagate as u...", "source": "model", "grounded": true } ], "dependencyRisks": { "scanner": [], "model": [] }, "secretsDetected": [], "suggestedPatches": [ { "finding_id": "SAST-01", "file": "src/users.ts", "original_code": " const id = req.params.id;\n return db.query(`SELECT * FROM users WHERE id = ${id}`);", "corrected_code": " const id = req.params.id;\n return db.query('SELECT * FROM users WHERE id = $1', [id]);", "explanation": "Restores the parameterized query so the id is bound as a value by the driver rather than interpolated into the SQL text, eliminating SQL injection.", "also_fixes": [ "BUG-01", "BC-01" ] } ], "stats": { "filesChanged": 1, "linesAdded": 2, "diffTruncatedForModel": false, "modelChunks": 1, "unreviewed": [], "sastPartialLines": 0, "sastPartial": [], "ungroundedFindings": 0 } }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:34588ed3-f810-40d7-ba7a-440f9fa6ad6e", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "PR / Dependency Breaking-Change & Exploit Gatekeeper", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-06T17:55:58.729Z", "softwareAgent": { "name": "writerslogic-agent-hub/diff-gatekeeper", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia", "parameters": { "endpoint": "POST /api/v1/gatekeep-diff", "inputDigest": { "alg": "sha256", "hash": "46311fb109aa9f895e2c85d39d087fa124a8a5c0e341fb87506e86c10aef5685", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "aaa96d7de86bd40b44f929403e882a87fc97c8f15bee24de534adb694e70bbca", "name": "jcs-canonical-json(data)" } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:e8a51136-4878-4f62-82a2-32bdece297b4", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-06T17:55:58.729Z", "credentialSubject": { "id": "urn:sha256:aaa96d7de86bd40b44f929403e882a87fc97c8f15bee24de534adb694e70bbca", "agent": "diff-gatekeeper", "endpoint": "POST /api/v1/gatekeep-diff", "outputDigest": { "alg": "sha256", "value": "aaa96d7de86bd40b44f929403e882a87fc97c8f15bee24de534adb694e70bbca", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "46311fb109aa9f895e2c85d39d087fa124a8a5c0e341fb87506e86c10aef5685", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "4d31eb59fc40a77edf40e6a6ff95b23b3c89db5503007e4b0c5ec21ecf4473ac", "canonicalization": "JCS" }, "ingredients": [], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-06T17:55:58.729Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "z2Eo4HM81T4KKeKvNzV7ejBiHm3fSXHP2NnpNLxY3G5GPWQzRG7LnRt6P62UGUjsgAmWrpXBxfpTBu9yaKvLv6SUn" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:c269c3a316f790c575b04a030b921eef61fc6c266c91ff63f2f9bcfbad82d05a", "signature": "0x5756b3e66653cb7757d18d867c74d63021d2bc00a6984e977b02d80cc80898bd0ed8b40d15668f174f9aec8db640aef9803b1b2fd63838045c000b35c29b92f51b" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/diff-gatekeeper/", "description": "Documentation for PR / Dependency Breaking-Change & Exploit Gatekeeper: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "diff-gatekeeper: unknown field is rejected", "method": "POST", "path": "/v1/gatekeep-diff", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "diff-gatekeeper: example returns a signed result", "method": "POST", "path": "/v1/gatekeep-diff", "body": { "gitDiff": "diff --git a/src/users.ts b/src/users.ts\n--- a/src/users.ts\n+++ b/src/users.ts\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\n+ const id = req.params.id;\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\n }\n", "context": "Refactor user lookup for readability." }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "summary": { "type": "string" }, "intent_alignment": { "type": "string" }, "breakingChanges": { "type": "array", "items": { "type": "object", "required": [ "id", "file", "location", "severity", "description", "affected_consumers", "grounded", "source" ], "properties": { "id": { "type": "string" }, "file": { "type": "string" }, "location": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": { "type": "string" }, "affected_consumers": { "type": "string" }, "grounded": { "type": "boolean" }, "source": { "type": "string", "enum": [ "model", "rule" ] } } } }, "securityFlaws": { "type": "array", "items": { "type": "object", "required": [ "id", "file", "line", "category", "severity", "description", "exploit_scenario", "grounded", "source" ], "properties": { "id": { "type": "string" }, "file": { "type": "string" }, "line": { "type": "integer" }, "category": { "type": "string", "enum": [ "sql_injection", "nosql_injection", "command_injection", "xss", "ssrf", "path_traversal", "authz_bypass", "secret_exposure", "insecure_crypto", "deserialization", "supply_chain", "other" ] }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": { "type": "string" }, "exploit_scenario": { "type": "string" }, "grounded": { "type": "boolean" }, "source": { "type": "string", "enum": [ "model", "rule" ] } } } }, "bugs": { "type": "array", "items": { "type": "object", "required": [ "id", "file", "line", "category", "severity", "description", "grounded", "source" ], "properties": { "id": { "type": "string" }, "file": { "type": "string" }, "line": { "type": "integer" }, "category": { "type": "string", "enum": [ "race_condition", "state_mutation", "error_handling", "logic_error", "resource_leak", "null_handling", "performance", "other" ] }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": { "type": "string" }, "grounded": { "type": "boolean" }, "source": { "type": "string", "enum": [ "model", "rule" ] } } } }, "dependency_risks": { "type": "array", "items": { "type": "object", "required": [ "package", "risk", "severity" ], "properties": { "package": { "type": "string" }, "risk": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] } } } }, "riskScore": { "type": "integer" }, "verdict": { "type": "string", "enum": [ "fail", "warn", "pass", "inconclusive" ] }, "verdictReason": { "type": "string" }, "status": { "type": "string", "enum": [ "complete", "partial" ] }, "nextStep": { "type": "string" }, "topFindings": { "type": "array", "items": { "type": "object" } }, "annotations": { "type": "array", "items": { "type": "object" } }, "sarif": { "type": "object" }, "mergeApproved": { "type": "boolean" }, "modelRiskScore": { "type": "integer" }, "blockers": { "type": "array", "items": { "type": "string" } }, "dependencyRisks": { "type": "object" }, "secretsDetected": { "type": "array", "items": { "type": "object" } }, "suggestedPatches": { "type": "array", "items": { "type": "object", "required": [ "finding_id", "file", "original_code", "corrected_code", "explanation" ], "properties": { "finding_id": { "type": "string" }, "file": { "type": "string" }, "original_code": { "type": "string" }, "corrected_code": { "type": "string" }, "explanation": { "type": "string" }, "also_fixes": { "type": "array", "items": { "type": "string" } } } } }, "stats": { "type": "object" } }, "required": [ "summary", "intent_alignment", "breakingChanges", "securityFlaws", "bugs", "riskScore", "verdict", "verdictReason", "status", "nextStep", "topFindings", "annotations", "sarif", "mergeApproved", "modelRiskScore", "blockers", "dependencyRisks", "secretsDetected", "suggestedPatches", "stats" ] }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/audit-dependencies": { "post": { "operationId": "dependencyAdvisor", "summary": "Dependency Risk and Underuse Audit", "description": "`POST /v1/audit-dependencies`\n\nAudits the dependencies of a public GitHub repo, commit or pull request, or of uploaded manifests: pass, warn or fail verdict, risk score, findings with manifest file and line, and a SARIF log. Maps JS/TS, Python and Rust imports to declared npm, PyPI and crates.io dependencies and flags unused, undeclared and trivially used packages, plus deprecation, advisories and staleness.\n\n**What you get:** A CI-ready dependency gate: fails the build on known high-severity advisories and lists the packages a repo no longer needs, has outgrown, or should replace, with proof from its own imports.\n\n### Use it for\n\n- Fail a build on known advisories in a repository's declared npm, PyPI or crates.io dependencies.\n- List packages a repository declares but does not use, uses only in dev, or uses trivially, with proof from its own imports.\n- Upload findings to GitHub code scanning as SARIF with the manifest file and line.\n\n### Details and limits\n\nAudits the dependencies of a public GitHub repo, commit or pull request (or uploaded manifests and sources) and returns a pass/warn/fail verdict, a 0-100 risk score, the top findings with manifest file:line and the fix, and a SARIF 2.1.0 log for GitHub code scanning. Parses JS/TS, Python and Rust imports with a tokenizer-level scanner and maps them to declared npm, PyPI and crates.io dependencies. Flags unused, dev-only, undeclared and trivially used packages; checks deps.dev, the npm registry and OSV for deprecation, advisories, staleness and OpenSSF Scorecard; matches a cited table of platform replacements (fetch, crypto.randomUUID, optional chaining) and ranks alternatives in code by Scorecard, recency, dependents, size and license compatibility. Reads repos through GitHub's API and falls back to the source archive when the API is rate limited; when some lookups still fail, it returns a signed partial result that lists what is missing. At most one optional model call maps used symbols to a replacement; deterministic mode makes none. Advisory data comes from OSV and deps.dev and can lag; findings are leads to verify, not a certification.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `repo` | string | no | Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head). |\n| `ref` | string | no | Branch, tag or commit; defaults to the default branch. |\n| `files` | array of object | no | Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths. |\n| `ecosystems` | array of string | no | Restrict the analysis; default all detected. |\n| `mode` | enum | no | deterministic makes no model call; auto makes at most one, only for symbols the curated table cannot decide. |\n| `repoLicense` | string | no | SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent. |\n\n### Example request body\n\n```json\n{\n \"repo\": \"star7th/htq\",\n \"mode\": \"auto\"\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/audit-dependencies\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"repo\":\"star7th/htq\",\"mode\":\"auto\"}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `verdict` | enum | fail: a declared package has a high or critical known advisory. warn: high or medium priority findings. pass: none. inconclusive: nothing found but coverage was partial. |\n| `riskScore` | integer | 0-100, computed in code from the top finding scores. |\n| `verdictReason` | string | Verdict reason. |\n| `status` | enum | partial when source or registry lookups failed or were capped; the result is still signed and lists what is missing. |\n| `missing` | array of string | What a partial result could not read or look up. |\n| `topFindings` | array of object | Top findings, a list of objects. |\n| `nextStep` | string | Next step. |\n| `sarif` | object | SARIF 2.1.0 log, one result per finding located at its manifest line; uploads to GitHub code scanning as-is. |\n| `source` | object | Repo, pinned commit, tree size, files read, bytes, skipped files, license and where it came from. |\n| `ecosystems` | array of object | Ecosystems, a list of objects. |\n| `summary` | object | Counts of declared and flagged packages, findings by category (underused, outgrown, replace) and kind, high-severity count. |\n| `findings` | array of object | Findings, a list of objects. |\n| `replacements` | array of object | Replacements, a list of objects. |\n| `dependencies` | array of object | Dependencies, a list of objects. |\n| `coverage` | object | complete, notes, files scanned, health checked/skipped, upstream calls, failed sources. |\n| `llmCalls` | integer | 0 in deterministic mode or when the curated table decided every symbol; otherwise 1. |\n| `decidedBy` | object | findings: code. replacementCoverage: symbol counts decided by the curated table, by the model, or left unreviewed. |\n| `versions` | object | Version of the curated replacements table. |\n| `thresholds` | object | The numeric thresholds the findings were computed with. |\n| `wouldChangeVerdict` | array of string | Evidence that would raise confidence or change a finding. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"source\": {\n \"kind\": \"github\",\n \"repo\": \"star7th/htq\",\n \"commit\": \"c64ac96becf9d0003774094bc5ff192bec8c70be\",\n \"treeEntries\": 12,\n \"treeTruncated\": false,\n \"filesRead\": 6,\n \"bytesRead\": 52035,\n \"sourceFilesRead\": 4,\n \"skippedBySize\": [],\n \"skippedByCap\": 0,\n \"license\": \"apache2.0\",\n \"licenseSource\": \"manifest\"\n },\n \"ecosystems\": [\n {\n \"ecosystem\": \"npm\",\n \"manifests\": [\n \"...\"\n ],\n \"sourceFilesScanned\": 4\n }\n ],\n \"summary\": {\n \"declaredPackages\": 9,\n \"flaggedPackages\": 11,\n \"findings\": 19,\n \"byCategory\": {\n \"underused\": 4,\n \"outgrown\": 12,\n \"replace\": 3\n },\n \"byKind\": {\n \"vulnerable\": 6,\n \"deprecated\": 2,\n \"redundant-dependency\": 1,\n \"undeclared\": 1,\n \"unused\": 1,\n \"dev-only-in-dependencies\": 1,\n \"native-replacement\": 1,\n \"trivial-use\": 1,\n \"stale\": 3,\n \"overlap\": 1,\n \"behind-major\": 1\n },\n \"high\": 8,\n \"replacementsReviewed\": 4\n },\n \"findings\": [\n {\n \"ecosystem\": \"npm\",\n \"package\": \"node-fetch\",\n \"manifest\": \"package.json\",\n \"kind\": \"vulnerable\",\n \"confidence\": \"high\",\n \"summary\": \"node-fetch@2.6.1 has 1 known advisory (GHSA-r683-j2x4-v87g).\",\n \"evidence\": \"...\",\n \"action\": \"Upgrade node-fetch (latest is 3.3.2) and re-check advisories.\",\n \"id\": \"vulnerable:npm:node-fetch:package.json\",\n \"category\": \"outgrown\",\n \"score\": 91,\n \"severity\": \"high\"\n },\n {\n \"ecosystem\": \"npm\",\n \"package\": \"body-parser\",\n \"manifest\": \"package.json\",\n \"kind\": \"vulnerable\",\n \"confidence\": \"high\",\n \"summary\": \"body-parser@1.18.3 has 3 known advisories (GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6).\",\n \"evidence\": \"...\",\n \"action\": \"Upgrade body-parser (latest is 2.4.0) and re-check advisories.\",\n \"id\": \"vulnerable:npm:body-parser:package.json\",\n \"category\": \"outgrown\",\n \"score\": 88,\n \"severity\": \"high\"\n },\n {\n \"ecosystem\": \"npm\",\n \"package\": \"connect-multiparty\",\n \"manifest\": \"package.json\",\n \"kind\": \"vulnerable\",\n \"confidence\": \"high\",\n \"summary\": \"connect-multiparty@2.2.0 has 1 known advisory (GHSA-w2xw-44r3-4v9g).\",\n \"evidence\": \"...\",\n \"action\": \"No newer release; replace connect-multiparty.\",\n \"id\": \"vulnerable:npm:connect-multiparty:package.json\",\n \"category\": \"outgrown\",\n \"score\": 88,\n \"severity\": \"high\"\n }\n ],\n \"replacements\": [\n {\n \"package\": \"connect-multiparty\",\n \"ecosystem\": \"npm\",\n \"manifest\": \"package.json\",\n \"flaggedBy\": [\n \"deprecated\"\n ],\n \"files\": 1,\n \"symbols\": [\n \"default\"\n ],\n \"migrationEffort\": \"low\",\n \"current\": \"...\",\n \"table\": null,\n \"alternatives\": [],\n \"candidates\": [],\n \"reviewedAlternative\": null,\n \"coverage\": null\n },\n {\n \"package\": \"request\",\n \"ecosystem\": \"npm\",\n \"manifest\": \"package.json\",\n \"flaggedBy\": [\n \"deprecated\",\n \"trivial-use\"\n ],\n \"files\": 2,\n \"symbols\": [\n \"default\"\n ],\n \"migrationEffort\": \"low\",\n \"current\": \"...\",\n \"table\": \"...\",\n \"alternatives\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"candidates\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"reviewedAlternative\": \"global fetch\",\n \"coverage\": \"...\"\n },\n {\n \"package\": \"body-parser\",\n \"ecosystem\": \"npm\",\n \"manifest\": \"package.json\",\n \"flaggedBy\": [\n \"redundant-dependency\"\n ],\n \"files\": 1,\n \"symbols\": [\n \"default\"\n ],\n \"migrationEffort\": \"low\",\n \"current\": \"...\",\n \"table\": \"...\",\n \"alternatives\": [\n \"...\"\n ],\n \"candidates\": [],\n \"reviewedAlternative\": \"express built-in body parsers\",\n \"coverage\": \"...\"\n }\n ],\n \"dependencies\": [\n {\n \"ecosystem\": \"npm\",\n \"name\": \"async-redis\",\n \"sections\": [\n \"dependencies\"\n ],\n \"manifest\": \"package.json\",\n \"range\": \"^1.1.7\",\n \"version\": \"1.1.7\",\n \"versionSource\": \"lockfile\",\n \"usage\": \"...\",\n \"health\": \"...\"\n },\n {\n \"ecosystem\": \"npm\",\n \"name\": \"body-parser\",\n \"sections\": [\n \"dependencies\"\n ],\n \"manifest\": \"package.json\",\n \"range\": \"^1.18.3\",\n \"version\": \"1.18.3\",\n \"versionSource\": \"lockfile\",\n \"usage\": \"...\",\n \"health\": \"...\"\n },\n {\n \"ecosystem\": \"npm\",\n \"name\": \"connect-multiparty\",\n \"sections\": [\n \"dependencies\"\n ],\n \"manifest\": \"package.json\",\n \"range\": \"^2.2.0\",\n \"version\": \"2.2.0\",\n \"versionSource\": \"lockfile\",\n \"usage\": \"...\",\n \"health\": \"...\"\n }\n ],\n \"coverage\": {\n \"complete\": true,\n \"notes\": [],\n \"sourceFilesScanned\": 4,\n \"health\": {\n \"checked\": 9,\n \"skipped\": 0\n },\n \"upstreamCalls\": {\n \"github\": 8,\n \"registries\": 76\n },\n \"failures\": []\n },\n \"llmCalls\": 1,\n \"decidedBy\": {\n \"findings\": \"code\",\n \"replacementCoverage\": {\n \"table\": 1,\n \"model\": 2,\n \"unreviewed\": 0\n }\n },\n \"versions\": {\n \"replacementsTable\": \"2026-11-04.1\"\n },\n \"thresholds\": {\n \"trivialMaxSymbols\": 2,\n \"trivialMaxFiles\": 2,\n \"trivialMinSizeBytes\": 200000,\n \"effortLowFiles\": 2,\n \"effortMediumFiles\": 8,\n \"heavyUseFiles\": 5,\n \"staleMonths\": 24,\n \"majorsBehind\": 2\n },\n \"wouldChangeVerdict\": []\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/dependency-advisor/\nMachine-readable input and result schemas: https://writerslogic.com/agents/dependency-advisor.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/dependency-advisor", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "repo": { "type": "string", "minLength": 3, "maxLength": 200, "description": "Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head)." }, "ref": { "type": "string", "maxLength": 200, "description": "Branch, tag or commit; defaults to the default branch." }, "files": { "type": "array", "maxItems": 600, "description": "Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths.", "items": { "type": "object", "additionalProperties": false, "required": [ "path", "content" ], "properties": { "path": { "type": "string", "minLength": 1, "maxLength": 300, "description": "Path. Up to 300 characters." }, "content": { "type": "string", "maxLength": 400000, "description": "Content. Up to 400,000 characters." } } } }, "ecosystems": { "type": "array", "maxItems": 3, "items": { "type": "string", "enum": [ "npm", "pypi", "cargo" ] }, "description": "Restrict the analysis; default all detected." }, "mode": { "type": "string", "enum": [ "auto", "deterministic" ], "description": "deterministic makes no model call; auto makes at most one, only for symbols the curated table cannot decide." }, "repoLicense": { "type": "string", "maxLength": 100, "description": "SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent." } }, "description": "Input payload for Dependency Underuse & Replacement Advisor. Required fields: none. Optional fields: `repo`, `ref`, `files`, `ecosystems`, `mode`, `repoLicense`.", "externalDocs": { "url": "https://writerslogic.com/agents/dependency-advisor.json", "description": "Machine-readable record for Dependency Underuse & Replacement Advisor: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for Dependency Underuse & Replacement Advisor", "description": "A complete valid request body for Dependency Risk and Underuse Audit.", "value": { "repo": "star7th/htq", "mode": "auto" } } } } }, "description": "JSON request body for Dependency Underuse & Replacement Advisor. Required fields: none. Optional fields: `repo`, `ref`, `files`, `ecosystems`, `mode`, `repoLicense`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "fail", "warn", "pass", "inconclusive" ], "description": "fail: a declared package has a high or critical known advisory. warn: high or medium priority findings. pass: none. inconclusive: nothing found but coverage was partial." }, "riskScore": { "type": "integer", "description": "0-100, computed in code from the top finding scores." }, "verdictReason": { "type": "string", "description": "Verdict reason." }, "status": { "type": "string", "enum": [ "complete", "partial" ], "description": "partial when source or registry lookups failed or were capped; the result is still signed and lists what is missing." }, "missing": { "type": "array", "items": { "type": "string" }, "description": "What a partial result could not read or look up." }, "topFindings": { "type": "array", "items": { "type": "object", "description": "Up to 5, highest priority first: rank, id, package, ecosystem, kind, severity, score, confidence, file, line (in the manifest), summary, fix." }, "description": "Top findings, a list of objects." }, "nextStep": { "type": "string", "description": "Next step." }, "sarif": { "type": "object", "description": "SARIF 2.1.0 log, one result per finding located at its manifest line; uploads to GitHub code scanning as-is." }, "source": { "type": "object", "description": "Repo, pinned commit, tree size, files read, bytes, skipped files, license and where it came from." }, "ecosystems": { "type": "array", "items": { "type": "object", "description": "Per ecosystem: manifests (path, lockfile kind, minimum runtime, declared count) and source files scanned." }, "description": "Ecosystems, a list of objects." }, "summary": { "type": "object", "description": "Counts of declared and flagged packages, findings by category (underused, outgrown, replace) and kind, high-severity count." }, "findings": { "type": "array", "items": { "type": "object", "description": "id, kind (unused, dev-only-in-dependencies, dev-dependency-in-production, undeclared, trivial-use, native-replacement, redundant-dependency, deprecated, superseded, overlap, stale, vulnerable, behind-major), category, severity, score 0-100 (computed in code), confidence, ecosystem, package, manifest, summary, evidence, action, migrationEffort, citations." }, "description": "Findings, a list of objects." }, "replacements": { "type": "array", "items": { "type": "object", "description": "Per flagged package: symbols the repo imports, the curated table entry with citations and runtime applicability, ranked alternatives (Scorecard, recency, dependents, size, license compatibility), and a per-symbol coverage check. coverage.status is FULL_COVERAGE only when every used symbol is accounted for and covered; decidedBy is table, model or none." }, "description": "Replacements, a list of objects." }, "dependencies": { "type": "array", "items": { "type": "object", "description": "Every declared package: sections, range, resolved version and its source, usage footprint, and registry health." }, "description": "Dependencies, a list of objects." }, "coverage": { "type": "object", "description": "complete, notes, files scanned, health checked/skipped, upstream calls, failed sources." }, "llmCalls": { "type": "integer", "description": "0 in deterministic mode or when the curated table decided every symbol; otherwise 1." }, "decidedBy": { "type": "object", "description": "findings: code. replacementCoverage: symbol counts decided by the curated table, by the model, or left unreviewed." }, "versions": { "type": "object", "description": "Version of the curated replacements table." }, "thresholds": { "type": "object", "description": "The numeric thresholds the findings were computed with." }, "wouldChangeVerdict": { "type": "array", "items": { "type": "string" }, "description": "Evidence that would raise confidence or change a finding." } }, "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "source": { "kind": "github", "repo": "star7th/htq", "commit": "c64ac96becf9d0003774094bc5ff192bec8c70be", "treeEntries": 12, "treeTruncated": false, "filesRead": 6, "bytesRead": 52035, "sourceFilesRead": 4, "skippedBySize": [], "skippedByCap": 0, "license": "apache2.0", "licenseSource": "manifest" }, "ecosystems": [ { "ecosystem": "npm", "manifests": [ { "path": "package.json", "lockfile": "package-lock v1", "runtimeMin": null, "declared": 9 } ], "sourceFilesScanned": 4 } ], "summary": { "declaredPackages": 9, "flaggedPackages": 11, "findings": 19, "byCategory": { "underused": 4, "outgrown": 12, "replace": 3 }, "byKind": { "vulnerable": 6, "deprecated": 2, "redundant-dependency": 1, "undeclared": 1, "unused": 1, "dev-only-in-dependencies": 1, "native-replacement": 1, "trivial-use": 1, "stale": 3, "overlap": 1, "behind-major": 1 }, "high": 8, "replacementsReviewed": 4 }, "findings": [ { "ecosystem": "npm", "package": "node-fetch", "manifest": "package.json", "kind": "vulnerable", "confidence": "high", "summary": "node-fetch@2.6.1 has 1 known advisory (GHSA-r683-j2x4-v87g).", "evidence": { "version": "2.6.1", "versionSource": "lockfile", "source": "osv", "advisories": [ { "id": "GHSA-r683-j2x4-v87g", "cvss": 8.8, "severity": "high", "summary": "node-fetch forwards secure headers to untrusted sites" } ], "total": 1, "latestVersion": "3.3.2" }, "action": "Upgrade node-fetch (latest is 3.3.2) and re-check advisories.", "id": "vulnerable:npm:node-fetch:package.json", "category": "outgrown", "score": 91, "severity": "high" }, { "ecosystem": "npm", "package": "body-parser", "manifest": "package.json", "kind": "vulnerable", "confidence": "high", "summary": "body-parser@1.18.3 has 3 known advisories (GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6).", "evidence": { "version": "1.18.3", "versionSource": "lockfile", "source": "osv", "advisories": [ { "id": "GHSA-27r3-jxmh-p828", "cvss": 7.5, "severity": "high", "summary": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body" }, { "id": "GHSA-qwcr-r2fm-qrc7", "cvss": 7.5, "severity": "high", "summary": "body-parser vulnerable to denial of service when url encoding is enabled" }, { "id": "GHSA-v422-hmwv-36x6", "cvss": 3.7, "severity": "low", "summary": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement" } ], "total": 3, "latestVersion": "2.4.0" }, "action": "Upgrade body-parser (latest is 2.4.0) and re-check advisories.", "id": "vulnerable:npm:body-parser:package.json", "category": "outgrown", "score": 88, "severity": "high" }, { "ecosystem": "npm", "package": "connect-multiparty", "manifest": "package.json", "kind": "vulnerable", "confidence": "high", "summary": "connect-multiparty@2.2.0 has 1 known advisory (GHSA-w2xw-44r3-4v9g).", "evidence": { "version": "2.2.0", "versionSource": "lockfile", "source": "osv", "advisories": [ { "id": "GHSA-w2xw-44r3-4v9g", "cvss": 7.8, "severity": "high", "summary": "Connect-Multiparty allows arbitrary file upload" } ], "total": 1, "latestVersion": "2.2.0" }, "action": "No newer release; replace connect-multiparty.", "id": "vulnerable:npm:connect-multiparty:package.json", "category": "outgrown", "score": 88, "severity": "high" } ], "replacements": [ { "package": "connect-multiparty", "ecosystem": "npm", "manifest": "package.json", "flaggedBy": [ "deprecated" ], "files": 1, "symbols": [ "default" ], "migrationEffort": "low", "current": { "version": "2.2.0", "scorecard": 3, "dependents": 423, "monthsSinceLatestRelease": 97.7, "unpackedSize": 8691, "licenses": [ "MIT" ] }, "table": null, "alternatives": [], "candidates": [], "reviewedAlternative": null, "coverage": null }, { "package": "request", "ecosystem": "npm", "manifest": "package.json", "flaggedBy": [ "deprecated", "trivial-use" ], "files": 2, "symbols": [ "default" ], "migrationEffort": "low", "current": { "version": "2.88.0", "scorecard": 3.4, "dependents": 4587, "monthsSinceLatestRelease": 80.8, "unpackedSize": 206894, "licenses": [ "Apache-2.0" ] }, "table": { "entry": "npm:request", "tableVersion": "2026-11-04.1", "reason": "deprecated", "summary": "request is deprecated by its maintainers and receives no fixes; the callback and stream API has no drop-in replacement.", "applicability": "unknown-runtime", "note": "requires runtime >= 18; the repo does not declare its minimum runtime", "citations": [ { "title": "request/request#3142: Request is officially deprecated", "url": "https://github.com/request/request/issues/3142" }, { "title": "MDN: Fetch API", "url": "https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API" } ] }, "alternatives": [ { "kind": "platform", "name": "global fetch", "applicability": "unknown-runtime" }, { "kind": "package", "name": "axios" }, { "kind": "package", "name": "undici" } ], "candidates": [ { "name": "axios", "source": "curated", "score": 84.9, "components": { "scorecard": 0.77, "recency": 1, "dependents": 1, "size": 0.177, "license": 1 }, "licenseCompat": "compatible", "version": "1.21.0", "licenses": [ "MIT" ], "scorecard": 7.7, "monthsSinceLatestRelease": 0.3, "dependents": 174259, "unpackedSize": 2215223 }, { "name": "undici", "source": "curated", "score": 82.5, "components": { "scorecard": 0.81, "recency": 1, "dependents": 0.817, "size": 0.182, "license": 1 }, "licenseCompat": "compatible", "version": "8.12.3", "licenses": [ "MIT" ], "scorecard": 8.1, "monthsSinceLatestRelease": 0.5, "dependents": 12137, "unpackedSize": 2167341 }, { "name": "got", "source": "curated", "score": 70.1, "components": { "scorecard": 0.55, "recency": 1, "dependents": 0.427, "size": 0.502, "license": 1 }, "licenseCompat": "compatible", "version": "16.2.0", "licenses": [ "MIT" ], "scorecard": 5.5, "monthsSinceLatestRelease": 0.2, "dependents": 135, "unpackedSize": 495293 } ], "reviewedAlternative": "global fetch", "coverage": { "status": "NO_COVERAGE", "symbols": [ { "symbol": "default", "covered": false, "replacement": "", "decidedBy": "model", "caveat": "The listed sites only show the import, not how request is called, so same arguments and result handling cannot be confirmed. Global fetch differs from request in several ways: it is promise-based rather than callback-based, it has no options such as qs, form, json, auth or pool, it does not rejec...", "quoteVerified": true } ], "unaccounted": [], "decidedBy": "model" } }, { "package": "body-parser", "ecosystem": "npm", "manifest": "package.json", "flaggedBy": [ "redundant-dependency" ], "files": 1, "symbols": [ "default" ], "migrationEffort": "low", "current": { "version": "1.18.3", "scorecard": 7.4, "dependents": 3545, "monthsSinceLatestRelease": 0.4, "unpackedSize": 55897, "licenses": [ "MIT" ] }, "table": { "entry": "npm:body-parser", "tableVersion": "2026-11-04.1", "reason": "redundant", "summary": "Express exposes json and urlencoded (4.16.0), raw and text (4.17.0) built in.", "applicability": "applies", "citations": [ { "title": "Express History.md (4.16.0 adds express.json and express.urlencoded; 4.17.0 adds raw and text)", "url": "https://github.com/expressjs/express/blob/master/History.md" } ] }, "alternatives": [ { "kind": "dependency", "name": "express built-in body parsers", "applicability": "applies" } ], "candidates": [], "reviewedAlternative": "express built-in body parsers", "coverage": { "status": "FULL_COVERAGE", "symbols": [ { "symbol": "default", "covered": true, "replacement": "const express = require('express'); app.use(express.json()); app.use(express.urlencoded({ extended: true }))", "decidedBy": "model", "caveat": "Express 4.16+ is required. Only the json and urlencoded parsers are built in; bodyParser.raw and bodyParser.text are also exposed as express.raw and express.text in 4.17+. Set the urlencoded extended option explicitly, because the default differs from older bodyParser usage.", "quoteVerified": true } ], "unaccounted": [], "decidedBy": "model" } } ], "dependencies": [ { "ecosystem": "npm", "name": "async-redis", "sections": [ "dependencies" ], "manifest": "package.json", "range": "^1.1.7", "version": "1.1.7", "versionSource": "lockfile", "usage": { "files": 2, "filesByClass": { "prod": 1, "test": 1, "tooling": 0 }, "symbols": [ "createClient" ], "symbolCount": 1, "typeOnly": false, "referencedByTooling": false }, "health": { "deprecated": false, "latestVersion": "2.0.0", "monthsSinceLatestRelease": 65.3, "licenses": [ "MIT" ], "advisories": 0, "unpackedSize": 104783, "maintainers": 1, "scorecard": 3, "dependents": 127 } }, { "ecosystem": "npm", "name": "body-parser", "sections": [ "dependencies" ], "manifest": "package.json", "range": "^1.18.3", "version": "1.18.3", "versionSource": "lockfile", "usage": { "files": 1, "filesByClass": { "prod": 0, "test": 1, "tooling": 0 }, "symbols": [ "default" ], "symbolCount": 1, "typeOnly": false, "referencedByTooling": false }, "health": { "deprecated": false, "latestVersion": "2.4.0", "monthsSinceLatestRelease": 0.4, "licenses": [ "MIT" ], "advisories": 3, "unpackedSize": 55897, "maintainers": 1, "scorecard": 7.4, "dependents": 3545 } }, { "ecosystem": "npm", "name": "connect-multiparty", "sections": [ "dependencies" ], "manifest": "package.json", "range": "^2.2.0", "version": "2.2.0", "versionSource": "lockfile", "usage": { "files": 1, "filesByClass": { "prod": 1, "test": 0, "tooling": 0 }, "symbols": [ "default" ], "symbolCount": 1, "typeOnly": false, "referencedByTooling": false }, "health": { "deprecated": true, "latestVersion": "2.2.0", "monthsSinceLatestRelease": 97.7, "licenses": [ "MIT" ], "advisories": 1, "unpackedSize": 8691, "maintainers": 2, "scorecard": 3, "dependents": 423 } } ], "coverage": { "complete": true, "notes": [], "sourceFilesScanned": 4, "health": { "checked": 9, "skipped": 0 }, "upstreamCalls": { "github": 8, "registries": 76 }, "failures": [] }, "llmCalls": 1, "decidedBy": { "findings": "code", "replacementCoverage": { "table": 1, "model": 2, "unreviewed": 0 } }, "versions": { "replacementsTable": "2026-11-04.1" }, "thresholds": { "trivialMaxSymbols": 2, "trivialMaxFiles": 2, "trivialMinSizeBytes": 200000, "effortLowFiles": 2, "effortMediumFiles": 8, "heavyUseFiles": 5, "staleMonths": 24, "majorsBehind": 2 }, "wouldChangeVerdict": [] }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:447a9b83-8854-4da8-9ffb-0f7c6d7ff969", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "Dependency Underuse & Replacement Advisor", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-04T20:33:43.865Z", "softwareAgent": { "name": "writerslogic-agent-hub/dependency-advisor", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia", "parameters": { "endpoint": "POST /api/v1/audit-dependencies", "inputDigest": { "alg": "sha256", "hash": "37c095cb60d6201d577c99d5034f0bbca358960f712c9b38f8b4d1a614736151", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "dcfab7d7452c0e2f571525b0d85b0c119db070316b81a3031f950262b84bfa6f", "name": "jcs-canonical-json(data)" } }, { "label": "c2pa.ingredient.v3", "data": { "title": "https://api.github.com/repos/star7th/htq/commits/HEAD", "format": "application/json", "relationship": "inputTo", "dc": { "source": "https://api.github.com/repos/star7th/htq/commits/HEAD", "date": "2026-11-04T20:33:36.979Z" }, "hash": { "alg": "sha256", "hash": "4bd55e22578cbe3b02e15b73bcb3d6f24c81e015ed9b9cfaddb1ca41f760e631", "basis": "body" } } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:deed797e-c9d0-43aa-a6a7-fc4bcabee1a6", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-04T20:33:43.865Z", "credentialSubject": { "id": "urn:sha256:dcfab7d7452c0e2f571525b0d85b0c119db070316b81a3031f950262b84bfa6f", "agent": "dependency-advisor", "endpoint": "POST /api/v1/audit-dependencies", "outputDigest": { "alg": "sha256", "value": "dcfab7d7452c0e2f571525b0d85b0c119db070316b81a3031f950262b84bfa6f", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "37c095cb60d6201d577c99d5034f0bbca358960f712c9b38f8b4d1a614736151", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "07bf96c99ae85e67dd4a99f644d07268f101356a85e8ed9433ecdf5ccda62e28", "canonicalization": "JCS" }, "ingredients": [ { "url": "https://api.github.com/repos/star7th/htq/commits/HEAD", "sha256": "4bd55e22578cbe3b02e15b73bcb3d6f24c81e015ed9b9cfaddb1ca41f760e631" }, { "url": "https://api.github.com/repos/star7th/htq/git/trees/c64ac96becf9d0003774094bc5ff192bec8c70be?recursive=1", "sha256": "e43c95e9a6f0f020ba2a4c998d85d9a0c0820581d639df1b4ce4be1cdbd89d20" }, { "url": "https://raw.githubusercontent.com/star7th/htq/c64ac96becf9d0003774094bc5ff192bec8c70be/devTest.js", "sha256": "8bdbba07149f6755f29a6836f01f0cb0ac14aad8a19196ea2c1eb0fb261b784b" } ], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-04T20:33:43.865Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "z5oAD6Mdk6kHJ2KhBczLJjtWQs9TLZhpmpUP7ZMcoA4z4GBy3z98dQH2hXSv6F39BzYx6tNXka65urrDLMBq1Wxhn" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:897109e7992244cb34d6d405bcf91758b2951138e7d3ab0b26d92358d60680d5", "signature": "0x839dd153b3c1d52383365240fd79e55b671231a34cc1fe935232d06c6c8d99453c1150714afaf9aa305a34f0cf7d9a35ae7dd537468daba225f59d382f8de6da1c" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/dependency-advisor/", "description": "Documentation for Dependency Underuse & Replacement Advisor: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "dependency-advisor: unknown field is rejected", "method": "POST", "path": "/v1/audit-dependencies", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "dependency-advisor: example returns a signed result", "method": "POST", "path": "/v1/audit-dependencies", "body": { "repo": "star7th/htq", "mode": "auto" }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "fail", "warn", "pass", "inconclusive" ] }, "riskScore": { "type": "integer" }, "verdictReason": { "type": "string" }, "status": { "type": "string", "enum": [ "complete", "partial" ] }, "missing": { "type": "array", "items": { "type": "string" } }, "topFindings": { "type": "array", "items": { "type": "object" } }, "nextStep": { "type": "string" }, "sarif": { "type": "object" }, "source": { "type": "object" }, "ecosystems": { "type": "array", "items": { "type": "object" } }, "summary": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "replacements": { "type": "array", "items": { "type": "object" } }, "dependencies": { "type": "array", "items": { "type": "object" } }, "coverage": { "type": "object" }, "llmCalls": { "type": "integer" }, "decidedBy": { "type": "object" }, "versions": { "type": "object" }, "thresholds": { "type": "object" }, "wouldChangeVerdict": { "type": "array", "items": { "type": "string" } } } }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/unicode-safety-gate": { "post": { "operationId": "unicodeSafetyGate", "summary": "Trojan Source and Hidden Unicode Scanner", "description": "`POST /v1/unicode-safety-gate`\n\nScans a public GitHub repo, pull request, diff or file list for adversarial Unicode using 19 rules. Covers bidi controls (Trojan Source), invisible characters, variation-selector and tag-character payloads, private-use code points, and homoglyph and mixed-script identifiers. Returns a block, warn or pass verdict, a 0-100 risk score and locations as file, line and column.\n\n**What you get:** A single invisible or reordering character can hide a backdoor from every human reviewer. This gate finds it in a PR or repo before merge and returns the exact line and fix.\n\n### Use it for\n\n- Scan a pull request or repository for Trojan Source bidi controls and invisible characters before merge.\n- Find homoglyph and mixed-script identifiers and variation-selector payloads that human reviewers cannot see.\n- Get the exact file, line and column of each finding with a block, warn or pass verdict.\n\n### Details and limits\n\nScans a public GitHub repo, a pull request, a unified diff or a list of files for adversarial Unicode with the 19 rules (USC001-USC019) of dcondrey/unicode-safety-check: bidi controls (Trojan Source), invisible and default-ignorable characters, variation-selector and tag-character payloads (Glassworm), private-use code points, homoglyph and mixed-script identifiers, confusable collisions, misplaced BOM and control characters. Leads with a block/warn/pass verdict, a 0-100 risk score, the top locations (file:line:column) grouped so one trick reads as one finding, and the fix; also returns every finding, a SARIF 2.1.0 log for GitHub code scanning, and model-written exploit explanations that are checked against the findings. Findings and verdict come from deterministic rules; only the explanations use a model. Repo scans read up to 1,000,000 characters, shallowest files first, and list what they skipped.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `files` | array of object | no | Files to scan in full. Provide exactly one of files, diff, repo or prUrl; total content is capped at 1000000 characters. |\n| `diff` | string | no | Unified diff (git diff output). Only added lines are scanned; findings carry new-file line numbers. |\n| `repo` | string | no | Alternative to files and diff: a public GitHub repository, owner/repo or https://github.com/owner/repo[/tree/ref]. Read from its source archive; files are scanned shallowest first up to the character cap and the rest are listed as skipped. |\n| `ref` | string | no | Branch, tag or commit for repo; defaults to the default branch. |\n| `prUrl` | string | no | Alternative to files and diff: a public GitHub pull request, commit or compare URL. Only added lines are scanned. |\n| `identifierPolicy` | enum | no | Default ascii-only: any non-ASCII identifier is flagged (USC019). |\n| `permittedScripts` | array of string | no | Used with permitted-scripts. Default Latin, Common, Inherited. |\n| `scanExcluded` | boolean | no | Also scan paths the upstream scanner skips (node_modules/, vendor/, dist/, build/, .lock, .min.js, images, archives). Default false. |\n\n### Example request body\n\n```json\n{\n \"files\": [\n {\n \"path\": \"src/auth.js\",\n \"content\": \"const isAdmin = false;\\nif (isAdmin‮ ⁦// check later⁩ ⁦) {\\n grant();\\n}\\n\"\n }\n ]\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/unicode-safety-gate\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"files\":[{\"path\":\"src/auth.js\",\"content\":\"const isAdmin = false;\\nif (isAdmin‮ ⁦// check later⁩ ⁦) {\\n grant();\\n}\\n\"}]}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `verdict` | enum | block: a critical finding, or a high finding in a code or config file. warn: other findings. pass: none. |\n| `verdictReason` | string | Verdict reason. |\n| `riskScore` | integer | 0-100: worst severity (critical 90, high 70, medium 40, low 15) plus 1 per further affected line, at most 10. |\n| `status` | enum | partial when files were skipped for size or findings were capped; the result is still signed. |\n| `nextStep` | string | Next step. |\n| `topFindings` | array of object | Top findings, a list of objects. |\n| `source` | object | Where the input came from: kind (files, diff, repo, pr), and for repo the owner/repo, ref and commit scanned. |\n| `mode` | enum | One of: files, diff. |\n| `summary` | object | Summary, an object. |\n| `findings` | array of object | Findings, a list of objects. |\n| `sarif` | object | SARIF 2.1.0 log; columnKind unicodeCodePoints. |\n| `skipped` | array of object | Skipped, a list of objects. |\n| `warnings` | array of string | Warnings, a list of strings. |\n| `explanations` | array of object | Model-written, each verified against the finding it names (id, ruleId and codePoints must match). |\n| `llm` | enum | One of: ok, unavailable, skipped. |\n| `deterministic` | object | Engine, finding count, verdict basis and known limits. Findings and verdict involve no model. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"verdict\": \"block\",\n \"verdictReason\": \"6 finding(s) fail the policy\",\n \"mode\": \"files\",\n \"summary\": {\n \"total\": 8,\n \"returned\": 8,\n \"truncated\": false,\n \"bySeverity\": {\n \"critical\": 6,\n \"high\": 0,\n \"medium\": 2,\n \"low\": 0\n },\n \"byRule\": {\n \"USC001\": 4,\n \"USC002\": 0,\n \"USC003\": 0,\n \"USC004\": 0,\n \"USC005\": 0,\n \"USC006\": 0,\n \"USC007\": 0,\n \"USC008\": 0,\n \"USC009\": 0,\n \"USC010\": 0,\n \"USC011\": 0,\n \"USC012\": 0,\n \"USC013\": 0,\n \"USC014\": 0\n },\n \"blocking\": 6,\n \"filesScanned\": 1,\n \"filesSkipped\": 0\n },\n \"findings\": [\n {\n \"id\": \"F1\",\n \"ruleId\": \"USC001\",\n \"ruleName\": \"bidi-control\",\n \"severity\": \"critical\",\n \"path\": \"src/auth.js\",\n \"line\": 2,\n \"column\": 12,\n \"codePoints\": \"U+202E\",\n \"snippet\": \"if (isAdmin\\\\u{202E} \\\\u{2066}// check later\\\\u{2069} \\\\u{2066}...\",\n \"message\": \"Bidirectional control character U+202E RIGHT-TO-LEFT OVERRIDE in identifier\",\n \"charInfo\": \"U+202E RIGHT-TO-LEFT OVERRIDE\"\n },\n {\n \"id\": \"F2\",\n \"ruleId\": \"USC001\",\n \"ruleName\": \"bidi-control\",\n \"severity\": \"critical\",\n \"path\": \"src/auth.js\",\n \"line\": 2,\n \"column\": 14,\n \"codePoints\": \"U+2066\",\n \"snippet\": \"if (isAdmin\\\\u{202E} \\\\u{2066}// check later\\\\u{2069} \\\\u{2066}) ...\",\n \"message\": \"Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier\",\n \"charInfo\": \"U+2066 LEFT-TO-RIGHT ISOLATE\"\n },\n {\n \"id\": \"F3\",\n \"ruleId\": \"USC001\",\n \"ruleName\": \"bidi-control\",\n \"severity\": \"critical\",\n \"path\": \"src/auth.js\",\n \"line\": 2,\n \"column\": 29,\n \"codePoints\": \"U+2069\",\n \"snippet\": \"...min\\\\u{202E} \\\\u{2066}// check later\\\\u{2069} \\\\u{2066}) {\",\n \"message\": \"Bidirectional control character U+2069 POP DIRECTIONAL ISOLATE in identifier\",\n \"charInfo\": \"U+2069 POP DIRECTIONAL ISOLATE\"\n }\n ],\n \"sarif\": {\n \"$schema\": \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json\",\n \"version\": \"2.1.0\",\n \"runs\": [\n \"...\"\n ]\n },\n \"skipped\": [],\n \"warnings\": [],\n \"explanations\": [\n {\n \"id\": \"F1\",\n \"ruleId\": \"USC001\",\n \"codePoints\": \"U+202E\",\n \"attackVector\": \"A right-to-left override placed right after isAdmin in an if condition can reorder how the line renders, so the visible text no longer matches the token orde...\",\n \"impact\": \"A reviewer may read the condition as a benign check while the compiler evaluates different logic, which can bypass or invert the admin authorization gate.\",\n \"remediation\": \"Remove the bidi control character, then verify the condition's logic against the raw token sequence rather than the rendered view.\"\n },\n {\n \"id\": \"F2\",\n \"ruleId\": \"USC001\",\n \"codePoints\": \"U+2066\",\n \"attackVector\": \"A left-to-right isolate inside the condition, followed by a comment and a closing isolate, lets the displayed order differ from the parsed order of the if ex...\",\n \"impact\": \"The rendered line can look like a finished check while the parser evaluates a different expression, so the authorization decision is hidden from review.\",\n \"remediation\": \"Strip the isolate control, then re-read the condition with bidi characters shown explicitly and confirm the parsed expression matches intent.\"\n },\n {\n \"id\": \"F3\",\n \"ruleId\": \"USC001\",\n \"codePoints\": \"U+2069\",\n \"attackVector\": \"A pop-directional-isolate closes the earlier isolate near a line comment, so text that looks commented out may actually be parsed as code, or the reverse.\",\n \"impact\": \"A reviewer can be shown a comment or inert text that the compiler treats as live logic, enabling a hidden condition change in the auth path.\",\n \"remediation\": \"Remove the isolate terminator and check that the comment boundary and the code tokens are the same as the raw source shows.\"\n }\n ],\n \"llm\": \"ok\",\n \"deterministic\": {\n \"engine\": \"unicode-safety-check 3.0.0, rules USC001-USC019 (github.com/dcondrey/unicode-safety-check, rust/)\",\n \"findings\": 8,\n \"verdictBasis\": \"block: any critical finding, or a high finding in a code/config file; warn: any other finding (including high findings in .md/.txt/.html/.css/.xml/.csv files...\",\n \"notes\": [\n \"USC008 (invalid UTF-8) is detected as an unpaired surrogate only: request bodies are decoded before scanning\"\n ]\n }\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/unicode-safety-gate/\nMachine-readable input and result schemas: https://writerslogic.com/agents/unicode-safety-gate.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/unicode-safety-gate", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "files": { "type": "array", "minItems": 1, "maxItems": 500, "description": "Files to scan in full. Provide exactly one of files, diff, repo or prUrl; total content is capped at 1000000 characters.", "items": { "type": "object", "additionalProperties": false, "required": [ "path", "content" ], "properties": { "path": { "type": "string", "minLength": 1, "maxLength": 500, "description": "Repository-relative path; its extension selects the language and the file risk level." }, "content": { "type": "string", "maxLength": 1000000, "description": "Content. Up to 1,000,000 characters." } } } }, "diff": { "type": "string", "minLength": 1, "maxLength": 1000000, "description": "Unified diff (git diff output). Only added lines are scanned; findings carry new-file line numbers." }, "repo": { "type": "string", "minLength": 3, "maxLength": 200, "description": "Alternative to files and diff: a public GitHub repository, owner/repo or https://github.com/owner/repo[/tree/ref]. Read from its source archive; files are scanned shallowest first up to the character cap and the rest are listed as skipped." }, "ref": { "type": "string", "maxLength": 200, "description": "Branch, tag or commit for repo; defaults to the default branch." }, "prUrl": { "type": "string", "minLength": 20, "maxLength": 300, "description": "Alternative to files and diff: a public GitHub pull request, commit or compare URL. Only added lines are scanned." }, "identifierPolicy": { "type": "string", "enum": [ "ascii-only", "permitted-scripts" ], "description": "Default ascii-only: any non-ASCII identifier is flagged (USC019)." }, "permittedScripts": { "type": "array", "maxItems": 40, "items": { "type": "string", "maxLength": 40 }, "description": "Used with permitted-scripts. Default Latin, Common, Inherited." }, "scanExcluded": { "type": "boolean", "description": "Also scan paths the upstream scanner skips (node_modules/, vendor/, dist/, build/, .lock, .min.js, images, archives). Default false." } }, "description": "Input payload for Adversarial Unicode & Trojan Source gatekeeper. Required fields: none. Optional fields: `files`, `diff`, `repo`, `ref`, `prUrl`, `identifierPolicy`, `permittedScripts`, `scanExcluded`.", "externalDocs": { "url": "https://writerslogic.com/agents/unicode-safety-gate.json", "description": "Machine-readable record for Adversarial Unicode & Trojan Source gatekeeper: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for Adversarial Unicode & Trojan Source gatekeeper", "description": "A complete valid request body for Trojan Source and Hidden Unicode Scanner.", "value": { "files": [ { "path": "src/auth.js", "content": "const isAdmin = false;\nif (isAdmin‮ ⁦// check later⁩ ⁦) {\n grant();\n}\n" } ] } } } } }, "description": "JSON request body for Adversarial Unicode & Trojan Source gatekeeper. Required fields: none. Optional fields: `files`, `diff`, `repo`, `ref`, `prUrl`, `identifierPolicy`, `permittedScripts`, `scanExcluded`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "block", "warn", "pass" ], "description": "block: a critical finding, or a high finding in a code or config file. warn: other findings. pass: none." }, "verdictReason": { "type": "string", "description": "Verdict reason." }, "riskScore": { "type": "integer", "description": "0-100: worst severity (critical 90, high 70, medium 40, low 15) plus 1 per further affected line, at most 10." }, "status": { "type": "string", "enum": [ "complete", "partial" ], "description": "partial when files were skipped for size or findings were capped; the result is still signed." }, "nextStep": { "type": "string", "description": "Next step." }, "topFindings": { "type": "array", "items": { "type": "object", "description": "Up to 5 locations, blocking first: rank, path, line, column, severity, blocking, findings (count at that line), ruleIds, codePoints, title, fix." }, "description": "Top findings, a list of objects." }, "source": { "type": "object", "description": "Where the input came from: kind (files, diff, repo, pr), and for repo the owner/repo, ref and commit scanned." }, "mode": { "type": "string", "enum": [ "files", "diff" ], "description": "One of: files, diff." }, "summary": { "type": "object", "properties": { "total": { "type": "integer", "description": "Total, a whole number." }, "returned": { "type": "integer", "description": "Returned, a whole number." }, "truncated": { "type": "boolean", "description": "Truncated, true or false." }, "bySeverity": { "type": "object", "properties": { "critical": { "type": "integer", "description": "Critical, a whole number." }, "high": { "type": "integer", "description": "High, a whole number." }, "medium": { "type": "integer", "description": "Medium, a whole number." }, "low": { "type": "integer", "description": "Low, a whole number." } }, "description": "By severity, an object." }, "byRule": { "type": "object", "description": "Count per rule id, all 19 rules present." }, "blocking": { "type": "integer", "description": "Blocking, a whole number." }, "filesScanned": { "type": "integer", "description": "Files scanned, a whole number." }, "filesSkipped": { "type": "integer", "description": "Files skipped, a whole number." } }, "description": "Summary, an object." }, "findings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Stable within this response, F1, F2, ..." }, "ruleId": { "type": "string", "description": "USC001-USC019" }, "ruleName": { "type": "string", "description": "Rule name." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "path": { "type": "string", "description": "Path." }, "line": { "type": "integer", "description": "Line, a whole number." }, "column": { "type": "integer", "description": "1-based, in code points." }, "codePoints": { "type": "string", "description": "Space-separated, e.g. \"U+202E\"." }, "snippet": { "type": "string", "description": "Surrounding text with invisible, control and lookalike characters shown as \\u{XXXX}." }, "message": { "type": "string", "description": "Message." }, "charInfo": { "type": "string", "description": "Char info." } } }, "description": "Findings, a list of objects." }, "sarif": { "type": "object", "description": "SARIF 2.1.0 log; columnKind unicodeCodePoints." }, "skipped": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string", "description": "Path." }, "reason": { "type": "string", "description": "Reason." } } }, "description": "Skipped, a list of objects." }, "warnings": { "type": "array", "items": { "type": "string" }, "description": "Warnings, a list of strings." }, "explanations": { "type": "array", "description": "Model-written, each verified against the finding it names (id, ruleId and codePoints must match).", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "ruleId", "codePoints", "attackVector", "impact", "remediation" ], "properties": { "id": { "type": "string", "description": "Finding id exactly as given, e.g. F3." }, "ruleId": { "type": "string", "description": "The finding's ruleId, copied exactly." }, "codePoints": { "type": "string", "description": "The finding's codePoints, copied exactly." }, "attackVector": { "type": "string", "description": "How this specific construct is exploited." }, "impact": { "type": "string", "description": "What an attacker gains if it is merged." }, "remediation": { "type": "string", "description": "What the reviewer should do." } } } }, "llm": { "type": "string", "enum": [ "ok", "unavailable", "skipped" ], "description": "One of: ok, unavailable, skipped." }, "deterministic": { "type": "object", "description": "Engine, finding count, verdict basis and known limits. Findings and verdict involve no model." } }, "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "verdict": "block", "verdictReason": "6 finding(s) fail the policy", "mode": "files", "summary": { "total": 8, "returned": 8, "truncated": false, "bySeverity": { "critical": 6, "high": 0, "medium": 2, "low": 0 }, "byRule": { "USC001": 4, "USC002": 0, "USC003": 0, "USC004": 0, "USC005": 0, "USC006": 0, "USC007": 0, "USC008": 0, "USC009": 0, "USC010": 0, "USC011": 0, "USC012": 0, "USC013": 0, "USC014": 0, "USC015": 2, "USC016": 0, "USC017": 0, "USC018": 0, "USC019": 2 }, "blocking": 6, "filesScanned": 1, "filesSkipped": 0 }, "findings": [ { "id": "F1", "ruleId": "USC001", "ruleName": "bidi-control", "severity": "critical", "path": "src/auth.js", "line": 2, "column": 12, "codePoints": "U+202E", "snippet": "if (isAdmin\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}...", "message": "Bidirectional control character U+202E RIGHT-TO-LEFT OVERRIDE in identifier", "charInfo": "U+202E RIGHT-TO-LEFT OVERRIDE" }, { "id": "F2", "ruleId": "USC001", "ruleName": "bidi-control", "severity": "critical", "path": "src/auth.js", "line": 2, "column": 14, "codePoints": "U+2066", "snippet": "if (isAdmin\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) ...", "message": "Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier", "charInfo": "U+2066 LEFT-TO-RIGHT ISOLATE" }, { "id": "F3", "ruleId": "USC001", "ruleName": "bidi-control", "severity": "critical", "path": "src/auth.js", "line": 2, "column": 29, "codePoints": "U+2069", "snippet": "...min\\u{202E} \\u{2066}// check later\\u{2069} \\u{2066}) {", "message": "Bidirectional control character U+2069 POP DIRECTIONAL ISOLATE in identifier", "charInfo": "U+2069 POP DIRECTIONAL ISOLATE" } ], "sarif": { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "unicode-safety-check", "informationUri": "https://github.com/dcondrey/unicode-safety-check", "version": "3.0.0", "semanticVersion": "3.0.0", "rules": [ { "id": "USC001", "name": "bidi-control", "shortDescription": { "text": "Bidirectional control character" }, "defaultConfiguration": { "level": "error" }, "helpUri": "https://github.com/dcondrey/unicode-safety-check#what-it-detects", "properties": { "tags": [ "security", "unicode", "supply-chain" ] } }, { "id": "USC002", "name": "invisible-format", "shortDescription": { "text": "Invisible formatting character" }, "defaultConfiguration": { "level": "error" }, "helpUri": "https://github.com/dcondrey/unicode-safety-check#what-it-detects", "properties": { "tags": [ "security", "unicode", "supply-chain" ] } }, { "id": "USC003", "name": "mixed-script", "shortDescription": { "text": "Mixed-script identifier" }, "defaultConfiguration": { "level": "error" }, "helpUri": "https://github.com/dcondrey/unicode-safety-check#what-it-detects", "properties": { "tags": [ "security", "unicode", "supply-chain" ] } } ] } }, "columnKind": "unicodeCodePoints", "results": [ { "ruleId": "USC001", "level": "error", "message": { "text": "U+202E RIGHT-TO-LEFT OVERRIDE -- Bidirectional control character U+202E RIGHT-TO-LEFT OVERRIDE in identifier" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/auth.js", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 2, "startColumn": 12 } } } ], "properties": { "findingId": "F1", "severity": "critical", "codePoints": "U+202E" } }, { "ruleId": "USC001", "level": "error", "message": { "text": "U+2066 LEFT-TO-RIGHT ISOLATE -- Bidirectional control character U+2066 LEFT-TO-RIGHT ISOLATE in identifier" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/auth.js", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 2, "startColumn": 14 } } } ], "properties": { "findingId": "F2", "severity": "critical", "codePoints": "U+2066" } }, { "ruleId": "USC001", "level": "error", "message": { "text": "U+2069 POP DIRECTIONAL ISOLATE -- Bidirectional control character U+2069 POP DIRECTIONAL ISOLATE in identifier" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/auth.js", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 2, "startColumn": 29 } } } ], "properties": { "findingId": "F3", "severity": "critical", "codePoints": "U+2069" } } ] } ] }, "skipped": [], "warnings": [], "explanations": [ { "id": "F1", "ruleId": "USC001", "codePoints": "U+202E", "attackVector": "A right-to-left override placed right after isAdmin in an if condition can reorder how the line renders, so the visible text no longer matches the token order the parser reads. This is the Trojan Source pattern (CVE-2021-42574) in a JavaScript auth check.", "impact": "A reviewer may read the condition as a benign check while the compiler evaluates different logic, which can bypass or invert the admin authorization gate.", "remediation": "Remove the bidi control character, then verify the condition's logic against the raw token sequence rather than the rendered view." }, { "id": "F2", "ruleId": "USC001", "codePoints": "U+2066", "attackVector": "A left-to-right isolate inside the condition, followed by a comment and a closing isolate, lets the displayed order differ from the parsed order of the if expression.", "impact": "The rendered line can look like a finished check while the parser evaluates a different expression, so the authorization decision is hidden from review.", "remediation": "Strip the isolate control, then re-read the condition with bidi characters shown explicitly and confirm the parsed expression matches intent." }, { "id": "F3", "ruleId": "USC001", "codePoints": "U+2069", "attackVector": "A pop-directional-isolate closes the earlier isolate near a line comment, so text that looks commented out may actually be parsed as code, or the reverse.", "impact": "A reviewer can be shown a comment or inert text that the compiler treats as live logic, enabling a hidden condition change in the auth path.", "remediation": "Remove the isolate terminator and check that the comment boundary and the code tokens are the same as the raw source shows." } ], "llm": "ok", "deterministic": { "engine": "unicode-safety-check 3.0.0, rules USC001-USC019 (github.com/dcondrey/unicode-safety-check, rust/)", "findings": 8, "verdictBasis": "block: any critical finding, or a high finding in a code/config file; warn: any other finding (including high findings in .md/.txt/.html/.css/.xml/.csv files); pass: no findings", "notes": [ "USC008 (invalid UTF-8) is detected as an unpaired surrogate only: request bodies are decoded before scanning" ] } }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:96a5131a-d19d-4828-a7dc-498f46bbd938", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "Adversarial Unicode & Trojan Source gatekeeper", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-04T20:24:45.352Z", "softwareAgent": { "name": "writerslogic-agent-hub/unicode-safety-gate", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia", "parameters": { "endpoint": "POST /api/v1/unicode-safety-gate", "inputDigest": { "alg": "sha256", "hash": "0faa5c20c662e5fb96b1506539ecb79b2e3c061f140c6fa4d887c55e437c1d96", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "c6bf87e7bb646588c3b29005eb3434b51f05cd2395f239f98e630cf4c3c80912", "name": "jcs-canonical-json(data)" } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:b689815e-1627-4f4f-81b3-6fda048d9292", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-04T20:24:45.352Z", "credentialSubject": { "id": "urn:sha256:c6bf87e7bb646588c3b29005eb3434b51f05cd2395f239f98e630cf4c3c80912", "agent": "unicode-safety-gate", "endpoint": "POST /api/v1/unicode-safety-gate", "outputDigest": { "alg": "sha256", "value": "c6bf87e7bb646588c3b29005eb3434b51f05cd2395f239f98e630cf4c3c80912", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "0faa5c20c662e5fb96b1506539ecb79b2e3c061f140c6fa4d887c55e437c1d96", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "343b683ff0fc6ad3d9ed3980a6155acf29a8c227c9a2aa11f419be7503bfcb5f", "canonicalization": "JCS" }, "ingredients": [], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-04T20:24:45.352Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "z4boU4m9NTV9d2j62YQigWikmKvJd7Aukc8sFTnPVrCKk6gA6L4RAPre8w5w2EfWqVuZigH7EHsp6KZtNtJW4wWoF" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:dd89cd75587bbf271781d3630766d8aa50cc7b70fd114b875979dd8eeaa0ee2c", "signature": "0x36d0ec430e235bc243b37ac67f6ddde3cf45d2533bf9f3cefcd09c7afd6b58415f624957b8f27608281b764386d58ff45308fa0d2cab1cc3350276866a75f2d71b" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/unicode-safety-gate/", "description": "Documentation for Adversarial Unicode & Trojan Source gatekeeper: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "unicode-safety-gate: unknown field is rejected", "method": "POST", "path": "/v1/unicode-safety-gate", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "unicode-safety-gate: example returns a signed result", "method": "POST", "path": "/v1/unicode-safety-gate", "body": { "files": [ { "path": "src/auth.js", "content": "const isAdmin = false;\nif (isAdmin‮ ⁦// check later⁩ ⁦) {\n grant();\n}\n" } ] }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "block", "warn", "pass" ] }, "verdictReason": { "type": "string" }, "riskScore": { "type": "integer" }, "status": { "type": "string", "enum": [ "complete", "partial" ] }, "nextStep": { "type": "string" }, "topFindings": { "type": "array", "items": { "type": "object" } }, "source": { "type": "object" }, "mode": { "type": "string", "enum": [ "files", "diff" ] }, "summary": { "type": "object", "properties": { "total": { "type": "integer" }, "returned": { "type": "integer" }, "truncated": { "type": "boolean" }, "bySeverity": { "type": "object", "properties": { "critical": { "type": "integer" }, "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" } } }, "byRule": { "type": "object" }, "blocking": { "type": "integer" }, "filesScanned": { "type": "integer" }, "filesSkipped": { "type": "integer" } } }, "findings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "ruleId": { "type": "string" }, "ruleName": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "path": { "type": "string" }, "line": { "type": "integer" }, "column": { "type": "integer" }, "codePoints": { "type": "string" }, "snippet": { "type": "string" }, "message": { "type": "string" }, "charInfo": { "type": "string" } } } }, "sarif": { "type": "object" }, "skipped": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string" }, "reason": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "explanations": { "type": "array", "items": { "type": "object", "required": [ "id", "ruleId", "codePoints", "attackVector", "impact", "remediation" ], "properties": { "id": { "type": "string" }, "ruleId": { "type": "string" }, "codePoints": { "type": "string" }, "attackVector": { "type": "string" }, "impact": { "type": "string" }, "remediation": { "type": "string" } } } }, "llm": { "type": "string", "enum": [ "ok", "unavailable", "skipped" ] }, "deterministic": { "type": "object" } } }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/bundles/pre-merge-review": { "post": { "operationId": "preMergeReview", "summary": "Pre-Merge Review Pack", "description": "`POST /v1/bundles/pre-merge-review`\n\nOne unified diff in, one merge decision out: the pull request merge gate (bug review, patches, secret, dependency and SAST scans) plus the hidden Unicode and Trojan Source scan, in one call.\n\n**What you get:** One call per pull request covers logic exploits, leaked secrets, dependency breaks and invisible-character backdoors; built for CI.\n\n### Use it for\n\n- Run one call per pull request that covers logic exploits, secrets, dependency breaks and invisible-character backdoors.\n- Use it as a single merge decision in CI instead of wiring two checks together.\n- Review a unified diff without cloning the repository.\n\n### Details and limits\n\nOne unified diff in, one merge decision out: the PR exploit gatekeeper (bug hunter, patch synthesizer, secret/dependency/SAST scans) plus the adversarial Unicode / Trojan Source gate.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `diff` | string | yes | Unified diff of the change (git diff / PR .diff). |\n| `packageJsonDiff` | string | no | Package JSON diff. Up to 50,000 characters. |\n| `context` | string | no | What the PR is supposed to do. |\n\n### Example request body\n\n```json\n{\n \"diff\": \"diff --git a/src/users.ts b/src/users.ts\\n--- a/src/users.ts\\n+++ b/src/users.ts\\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\\n+ const id = req.params.id;\\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\\n }\\n\"\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/bundles/pre-merge-review\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"diff\":\"diff --git a/src/users.ts b/src/users.ts\\n--- a/src/users.ts\\n+++ b/src/users.ts\\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\\n+ const id = req.params.id;\\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\\n }\\n\"}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `results` | object | Each member agent's full result, keyed by agent id. |\n| `deterministic` | boolean | True only when every member answered without a model. |\n| `mergeApproved` | boolean | Merge approved, true or false. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"mergeApproved\": false,\n \"results\": {\n \"diff-gatekeeper\": {\n \"verdict\": \"fail\",\n \"verdictReason\": \"2 blocking findings: SQL statement built by interpolating values into a template literal (src/users.ts:11); Unquoted interpolation of req.params.id produces ...\",\n \"mergeApproved\": false,\n \"riskScore\": 65,\n \"status\": \"complete\",\n \"nextStep\": \"Do not merge. Fix SAST-01 at src/users.ts:11: Restores the parameterized query so the id value is passed as a bound parameter instead of being interpolated i...\",\n \"topFindings\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"annotations\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"sarif\": \"...\",\n \"modelRiskScore\": 92,\n \"blockers\": [\n \"high SAST-01 in src/users.ts\",\n \"high BUG-01 in src/users.ts\"\n ],\n \"summary\": \"The diff replaces a parameterized query in findUser with a template-string interpolation of req.params.id. This is a regression with no stated purpose. The S...\",\n \"intent_alignment\": \"No context was provided, so the intent is unknown. The diff makes a functionally unnecessary change that removes parameter binding and the safety it gave. It...\",\n \"breakingChanges\": [\n \"...\"\n ]\n },\n \"unicode-safety-gate\": {\n \"verdict\": \"pass\",\n \"verdictReason\": \"no findings\",\n \"riskScore\": 0,\n \"status\": \"complete\",\n \"nextStep\": \"No adversarial Unicode found in the scanned input.\",\n \"topFindings\": [],\n \"source\": \"...\",\n \"mode\": \"diff\",\n \"summary\": \"...\",\n \"findings\": [],\n \"sarif\": \"...\",\n \"skipped\": [],\n \"warnings\": [],\n \"explanations\": []\n }\n },\n \"deterministic\": false\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/pre-merge-review/\nMachine-readable input and result schemas: https://writerslogic.com/agents/pre-merge-review.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/pre-merge-review", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "required": [ "diff" ], "properties": { "diff": { "type": "string", "minLength": 1, "maxLength": 300000, "description": "Unified diff of the change (git diff / PR .diff)." }, "packageJsonDiff": { "type": "string", "maxLength": 50000, "description": "Package JSON diff. Up to 50,000 characters." }, "context": { "type": "string", "maxLength": 4000, "description": "What the PR is supposed to do." } }, "description": "Input payload for Pre-merge Review Pack. Required fields: `diff`. Optional fields: `packageJsonDiff`, `context`.", "externalDocs": { "url": "https://writerslogic.com/agents/pre-merge-review.json", "description": "Machine-readable record for Pre-merge Review Pack: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for Pre-merge Review Pack", "description": "A complete valid request body for Pre-Merge Review Pack.", "value": { "diff": "diff --git a/src/users.ts b/src/users.ts\n--- a/src/users.ts\n+++ b/src/users.ts\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\n+ const id = req.params.id;\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\n }\n" } } } } }, "description": "JSON request body for Pre-merge Review Pack. Required fields: `diff`. Optional fields: `packageJsonDiff`, `context`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "results": { "type": "object", "description": "Each member agent's full result, keyed by agent id.", "properties": { "diff-gatekeeper": { "type": "object", "properties": { "summary": { "type": "string", "description": "Summary." }, "intent_alignment": { "type": "string", "description": "Does the diff do what the context says, and anything it does beyond that." }, "breakingChanges": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "file", "location", "severity", "description", "affected_consumers", "grounded", "source" ], "properties": { "id": { "type": "string", "description": "BC-01, BC-02..." }, "file": { "type": "string", "description": "File." }, "location": { "type": "string", "description": "Location." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "description": { "type": "string", "description": "Description." }, "affected_consumers": { "type": "string", "description": "Affected consumers." }, "grounded": { "type": "boolean", "description": "False when the file or line is not in the diff; ungrounded findings never block." }, "source": { "type": "string", "enum": [ "model", "rule" ], "description": "One of: model, rule." } } }, "description": "Breaking changes, a list of objects." }, "securityFlaws": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "file", "line", "category", "severity", "description", "exploit_scenario", "grounded", "source" ], "properties": { "id": { "type": "string", "description": "SEC-01, SEC-02..." }, "file": { "type": "string", "description": "File." }, "line": { "type": "integer", "description": "Line, a whole number." }, "category": { "type": "string", "enum": [ "sql_injection", "nosql_injection", "command_injection", "xss", "ssrf", "path_traversal", "authz_bypass", "secret_exposure", "insecure_crypto", "deserialization", "supply_chain", "other" ], "description": "One of: sql_injection, nosql_injection, command_injection, xss, ssrf, path_traversal, authz_bypass, secret_exposure, insecure_crypto, deserialization, supply_chain, other." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "description": { "type": "string", "description": "Description." }, "exploit_scenario": { "type": "string", "description": "Exploit scenario." }, "grounded": { "type": "boolean", "description": "False when the file or line is not in the diff; ungrounded findings never block." }, "source": { "type": "string", "enum": [ "model", "rule" ], "description": "One of: model, rule." } } }, "description": "Security flaws, a list of objects." }, "bugs": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "file", "line", "category", "severity", "description", "grounded", "source" ], "properties": { "id": { "type": "string", "description": "BUG-01, BUG-02..." }, "file": { "type": "string", "description": "File." }, "line": { "type": "integer", "description": "Line, a whole number." }, "category": { "type": "string", "enum": [ "race_condition", "state_mutation", "error_handling", "logic_error", "resource_leak", "null_handling", "performance", "other" ], "description": "One of: race_condition, state_mutation, error_handling, logic_error, resource_leak, null_handling, performance, other." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "description": { "type": "string", "description": "Description." }, "grounded": { "type": "boolean", "description": "False when the file or line is not in the diff; ungrounded findings never block." }, "source": { "type": "string", "enum": [ "model", "rule" ], "description": "One of: model, rule." } } }, "description": "Bugs, a list of objects." }, "dependency_risks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "package", "risk", "severity" ], "properties": { "package": { "type": "string", "description": "Package." }, "risk": { "type": "string", "description": "Risk." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." } } }, "description": "Dependency risks, a list of objects." }, "riskScore": { "type": "integer", "description": "0-100 overall merge risk." }, "verdict": { "type": "string", "enum": [ "fail", "warn", "pass", "inconclusive" ], "description": "fail: a secret or a grounded critical or high finding blocks the merge. inconclusive: part of the diff was not reviewed. warn: only non-blocking findings. pass: none." }, "verdictReason": { "type": "string", "description": "Verdict reason." }, "status": { "type": "string", "enum": [ "complete", "partial" ], "description": "partial when part of the diff was not reviewed or an over-long added line was pattern-scanned only in part; the result is still signed." }, "nextStep": { "type": "string", "description": "Next step." }, "topFindings": { "type": "array", "items": { "type": "object", "description": "Up to 5, most severe first: rank, id, kind (secret, security, bug, breaking_change, dependency), severity, file, line, title, fix, blocking." }, "description": "Top findings, a list of objects." }, "annotations": { "type": "array", "items": { "type": "object", "description": "GitHub Checks API annotations: path, start_line, end_line, annotation_level (failure, warning, notice), title, message." }, "description": "Annotations, a list of objects." }, "sarif": { "type": "object", "description": "SARIF 2.1.0 log of every grounded finding at its file and line; uploads to GitHub code scanning as-is." }, "mergeApproved": { "type": "boolean", "description": "True when no secret and no grounded critical or high finding was found and the whole diff was reviewed." }, "modelRiskScore": { "type": "integer", "description": "The model's own 0-100 estimate; advisory. riskScore is computed from grounded findings (critical 40, high 20, medium 8, low 2, capped at 100) with scanner floors." }, "blockers": { "type": "array", "items": { "type": "string" }, "description": "Blockers, a list of strings." }, "dependencyRisks": { "type": "object", "description": "Dependency risks, an object." }, "secretsDetected": { "type": "array", "items": { "type": "object" }, "description": "Secrets detected, a list of objects." }, "suggestedPatches": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "finding_id", "file", "original_code", "corrected_code", "explanation" ], "properties": { "finding_id": { "type": "string", "description": "Finding ID." }, "file": { "type": "string", "description": "File." }, "original_code": { "type": "string", "description": "The exact lines from the diff being replaced." }, "corrected_code": { "type": "string", "description": "Drop-in replacement code." }, "explanation": { "type": "string", "description": "Explanation." }, "also_fixes": { "type": "array", "items": { "type": "string" }, "description": "Other finding ids this same patch resolves." } } }, "description": "Suggested patches, a list of objects." }, "stats": { "type": "object", "description": "Stats, an object." } }, "required": [ "summary", "intent_alignment", "breakingChanges", "securityFlaws", "bugs", "riskScore", "verdict", "verdictReason", "status", "nextStep", "topFindings", "annotations", "sarif", "mergeApproved", "modelRiskScore", "blockers", "dependencyRisks", "secretsDetected", "suggestedPatches", "stats" ], "description": "Diff gatekeeper, an object." }, "unicode-safety-gate": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "block", "warn", "pass" ], "description": "block: a critical finding, or a high finding in a code or config file. warn: other findings. pass: none." }, "verdictReason": { "type": "string", "description": "Verdict reason." }, "riskScore": { "type": "integer", "description": "0-100: worst severity (critical 90, high 70, medium 40, low 15) plus 1 per further affected line, at most 10." }, "status": { "type": "string", "enum": [ "complete", "partial" ], "description": "partial when files were skipped for size or findings were capped; the result is still signed." }, "nextStep": { "type": "string", "description": "Next step." }, "topFindings": { "type": "array", "items": { "type": "object", "description": "Up to 5 locations, blocking first: rank, path, line, column, severity, blocking, findings (count at that line), ruleIds, codePoints, title, fix." }, "description": "Top findings, a list of objects." }, "source": { "type": "object", "description": "Where the input came from: kind (files, diff, repo, pr), and for repo the owner/repo, ref and commit scanned." }, "mode": { "type": "string", "enum": [ "files", "diff" ], "description": "One of: files, diff." }, "summary": { "type": "object", "properties": { "total": { "type": "integer", "description": "Total, a whole number." }, "returned": { "type": "integer", "description": "Returned, a whole number." }, "truncated": { "type": "boolean", "description": "Truncated, true or false." }, "bySeverity": { "type": "object", "properties": { "critical": { "type": "integer", "description": "Critical, a whole number." }, "high": { "type": "integer", "description": "High, a whole number." }, "medium": { "type": "integer", "description": "Medium, a whole number." }, "low": { "type": "integer", "description": "Low, a whole number." } }, "description": "By severity, an object." }, "byRule": { "type": "object", "description": "Count per rule id, all 19 rules present." }, "blocking": { "type": "integer", "description": "Blocking, a whole number." }, "filesScanned": { "type": "integer", "description": "Files scanned, a whole number." }, "filesSkipped": { "type": "integer", "description": "Files skipped, a whole number." } }, "description": "Summary, an object." }, "findings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Stable within this response, F1, F2, ..." }, "ruleId": { "type": "string", "description": "USC001-USC019" }, "ruleName": { "type": "string", "description": "Rule name." }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ], "description": "One of: critical, high, medium, low." }, "path": { "type": "string", "description": "Path." }, "line": { "type": "integer", "description": "Line, a whole number." }, "column": { "type": "integer", "description": "1-based, in code points." }, "codePoints": { "type": "string", "description": "Space-separated, e.g. \"U+202E\"." }, "snippet": { "type": "string", "description": "Surrounding text with invisible, control and lookalike characters shown as \\u{XXXX}." }, "message": { "type": "string", "description": "Message." }, "charInfo": { "type": "string", "description": "Char info." } } }, "description": "Findings, a list of objects." }, "sarif": { "type": "object", "description": "SARIF 2.1.0 log; columnKind unicodeCodePoints." }, "skipped": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string", "description": "Path." }, "reason": { "type": "string", "description": "Reason." } } }, "description": "Skipped, a list of objects." }, "warnings": { "type": "array", "items": { "type": "string" }, "description": "Warnings, a list of strings." }, "explanations": { "type": "array", "description": "Model-written, each verified against the finding it names (id, ruleId and codePoints must match).", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "ruleId", "codePoints", "attackVector", "impact", "remediation" ], "properties": { "id": { "type": "string", "description": "Finding id exactly as given, e.g. F3." }, "ruleId": { "type": "string", "description": "The finding's ruleId, copied exactly." }, "codePoints": { "type": "string", "description": "The finding's codePoints, copied exactly." }, "attackVector": { "type": "string", "description": "How this specific construct is exploited." }, "impact": { "type": "string", "description": "What an attacker gains if it is merged." }, "remediation": { "type": "string", "description": "What the reviewer should do." } } } }, "llm": { "type": "string", "enum": [ "ok", "unavailable", "skipped" ], "description": "One of: ok, unavailable, skipped." }, "deterministic": { "type": "object", "description": "Engine, finding count, verdict basis and known limits. Findings and verdict involve no model." } }, "description": "Unicode safety gate, an object." } }, "required": [ "diff-gatekeeper", "unicode-safety-gate" ] }, "deterministic": { "type": "boolean", "description": "True only when every member answered without a model." }, "mergeApproved": { "type": "boolean", "description": "Merge approved, true or false." } }, "required": [ "results", "deterministic" ], "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "mergeApproved": false, "results": { "diff-gatekeeper": { "verdict": "fail", "verdictReason": "2 blocking findings: SQL statement built by interpolating values into a template literal (src/users.ts:11); Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number. (src/users.ts:11)", "mergeApproved": false, "riskScore": 65, "status": "complete", "nextStep": "Do not merge. Fix SAST-01 at src/users.ts:11: Restores the parameterized query so the id value is passed as a bound parameter instead of being interpolated into the SQL string, preventing SQL injection. Then re-run on the updated diff.", "topFindings": [ { "rank": 1, "id": "SAST-01", "kind": "security", "severity": "high", "file": "src/users.ts", "line": 11, "title": "SQL statement built by interpolating values into a template literal", "fix": "Restores the parameterized query so the id value is passed as a bound parameter instead of being interpolated into the SQL string, preventing SQL injection.", "blocking": true }, { "rank": 2, "id": "BUG-01", "kind": "bug", "severity": "high", "file": "src/users.ts", "line": 11, "title": "Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number.", "fix": "Fix the defect described and add a regression test.", "blocking": true }, { "rank": 3, "id": "BC-01", "kind": "breaking_change", "severity": "medium", "file": "src/users.ts", "line": 11, "title": "The id was previously bound as a parameter, so any value was safely compared.", "fix": "Restore the previous contract, or version the change and update consumers.", "blocking": false } ], "annotations": [ { "path": "src/users.ts", "start_line": 11, "end_line": 11, "annotation_level": "failure", "title": "SAST-01 SQL statement built by interpolating values into a template literal", "message": "SQL statement built by interpolating values into a template literal A value containing SQL syntax changes the statement, enabling data theft or modification. Fix: Restores the parameterized query so the id value is passed as a bound parameter instead of being interpolated into the SQL string, pre..." }, { "path": "src/users.ts", "start_line": 11, "end_line": 11, "annotation_level": "failure", "title": "BUG-01 Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number.", "message": "Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number. UUID values such as 123e4567-... cause syntax errors, and values like 'abc' are parsed as column identifiers. Malformed input now throws database errors that can leak schema details through unhandl..." }, { "path": "src/users.ts", "start_line": 11, "end_line": 11, "annotation_level": "warning", "title": "BC-01 The id was previously bound as a parameter, so any value was safely compared.", "message": "The id was previously bound as a parameter, so any value was safely compared. It is now spliced unquoted into the SQL text. Lookups with UUID or other string ids now fail with a SQL syntax or unknown-column error instead of returning a row or null. The failure mode changes from an empty result to..." } ], "sarif": { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "writerslogic-diff-gatekeeper", "version": "1.0.0", "semanticVersion": "1.0.0", "informationUri": "https://agents.writerslogic.com", "rules": [ { "id": "diff/security", "name": "security", "shortDescription": { "text": "Security flaw in added code" }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "code-review" ], "security-severity": "8.0" } }, { "id": "diff/bug", "name": "bug", "shortDescription": { "text": "Likely bug in added code" }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "code-review" ], "security-severity": "8.0" } }, { "id": "diff/breaking_change", "name": "breaking_change", "shortDescription": { "text": "Silent breaking change" }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "code-review" ], "security-severity": "5.5" } } ] } }, "results": [ { "ruleId": "diff/security", "ruleIndex": 0, "level": "error", "message": { "text": "SQL statement built by interpolating values into a template literal. SQL statement built by interpolating values into a template literal A value containing SQL syntax changes the statement, enabling data theft or modification. Fix: Restores the parameterized query so the id value is passed as a b..." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/users.ts", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 11 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "SAST-01" }, "properties": { "severity": "high", "source": "rule", "blocking": true } }, { "ruleId": "diff/bug", "ruleIndex": 1, "level": "error", "message": { "text": "Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number.. Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number. UUID values such as 123e4567-... cause syntax errors, and values like 'abc' are parsed as column..." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/users.ts", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 11 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "BUG-01" }, "properties": { "severity": "high", "source": "model", "blocking": true } }, { "ruleId": "diff/breaking_change", "ruleIndex": 2, "level": "warning", "message": { "text": "The id was previously bound as a parameter, so any value was safely compared.. The id was previously bound as a parameter, so any value was safely compared. It is now spliced unquoted into the SQL text. Lookups with UUID or other string ids now fail with a SQL syntax or unknown-column error inste..." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "src/users.ts", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 11 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "BC-01" }, "properties": { "severity": "medium", "source": "model", "blocking": false } } ] } ] }, "modelRiskScore": 92, "blockers": [ "high SAST-01 in src/users.ts", "high BUG-01 in src/users.ts" ], "summary": "The diff replaces a parameterized query in findUser with a template-string interpolation of req.params.id. This is a regression with no stated purpose. The SQL injection is already reported by the scanner (sql-template-interpolation, src/users.ts:11), so it is not repeated as a separate finding. ...", "intent_alignment": "No context was provided, so the intent is unknown. The diff makes a functionally unnecessary change that removes parameter binding and the safety it gave. It looks like an unrelated or regressive edit rather than a fix.", "breakingChanges": [ { "id": "BC-01", "file": "src/users.ts", "location": "findUser, line 11", "severity": "medium", "description": "The id was previously bound as a parameter, so any value was safely compared. It is now spliced unquoted into the SQL text. Lookups with UUID or other string ids now fail with a SQL syntax or unknown-column error instead of returning a row or null. The failure mode changes from an empty result to...", "affected_consumers": "Any caller or route using findUser with non-integer ids (UUIDs, slugs, or malformed input), and API clients that expect a 404 or empty result for unknown ids.", "source": "model", "grounded": true } ], "securityFlaws": [ { "id": "SAST-01", "file": "src/users.ts", "line": 11, "category": "sql_injection", "severity": "high", "description": "SQL statement built by interpolating values into a template literal", "exploit_scenario": "A value containing SQL syntax changes the statement, enabling data theft or modification.", "source": "rule", "grounded": true } ], "bugs": [ { "id": "BUG-01", "file": "src/users.ts", "line": 11, "category": "logic_error", "severity": "high", "description": "Unquoted interpolation of req.params.id produces invalid SQL for any id that is not a plain number. UUID values such as 123e4567-... cause syntax errors, and values like 'abc' are parsed as column identifiers. Malformed input now throws database errors that can leak schema details through unhandl...", "source": "model", "grounded": true } ], "dependencyRisks": { "scanner": [], "model": [] }, "secretsDetected": [], "suggestedPatches": [ { "finding_id": "SAST-01", "file": "src/users.ts", "original_code": " const id = req.params.id;\n return db.query(`SELECT * FROM users WHERE id = ${id}`);", "corrected_code": " const id = req.params.id;\n return db.query('SELECT * FROM users WHERE id = $1', [id]);", "explanation": "Restores the parameterized query so the id value is passed as a bound parameter instead of being interpolated into the SQL string, preventing SQL injection.", "also_fixes": [ "BUG-01" ] } ], "stats": { "filesChanged": 1, "linesAdded": 2, "diffTruncatedForModel": false, "modelChunks": 1, "unreviewed": [], "sastPartialLines": 0, "sastPartial": [], "ungroundedFindings": 0 } }, "unicode-safety-gate": { "verdict": "pass", "verdictReason": "no findings", "riskScore": 0, "status": "complete", "nextStep": "No adversarial Unicode found in the scanned input.", "topFindings": [], "source": { "kind": "diff" }, "mode": "diff", "summary": { "total": 0, "returned": 0, "truncated": false, "bySeverity": { "critical": 0, "high": 0, "medium": 0, "low": 0 }, "byRule": { "USC001": 0, "USC002": 0, "USC003": 0, "USC004": 0, "USC005": 0, "USC006": 0, "USC007": 0, "USC008": 0, "USC009": 0, "USC010": 0, "USC011": 0, "USC012": 0, "USC013": 0, "USC014": 0, "USC015": 0, "USC016": 0, "USC017": 0, "USC018": 0, "USC019": 0 }, "blocking": 0, "filesScanned": 1, "filesSkipped": 0 }, "findings": [], "sarif": { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "unicode-safety-check", "version": "3.0.0", "semanticVersion": "3.0.0", "informationUri": "https://github.com/dcondrey/unicode-safety-check", "rules": [ { "id": "USC001", "name": "bidi-control", "shortDescription": { "text": "Bidirectional control character" }, "helpUri": "https://github.com/dcondrey/unicode-safety-check#what-it-detects", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "unicode", "supply-chain" ], "security-severity": "9.5" } }, { "id": "USC002", "name": "invisible-format", "shortDescription": { "text": "Invisible formatting character" }, "helpUri": "https://github.com/dcondrey/unicode-safety-check#what-it-detects", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "unicode", "supply-chain" ], "security-severity": "9.5" } }, { "id": "USC003", "name": "mixed-script", "shortDescription": { "text": "Mixed-script identifier" }, "helpUri": "https://github.com/dcondrey/unicode-safety-check#what-it-detects", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "unicode", "supply-chain" ], "security-severity": "8.0" } } ] } }, "columnKind": "unicodeCodePoints", "results": [] } ] }, "skipped": [], "warnings": [], "explanations": [], "llm": "skipped", "deterministic": { "engine": "unicode-safety-check 3.0.0, rules USC001-USC019 (github.com/dcondrey/unicode-safety-check, rust/)", "findings": 0, "verdictBasis": "block: any critical finding, or a high finding in a code/config file; warn: any other finding (including high findings in .md/.txt/.html/.css/.xml/.csv files); pass: no findings", "notes": [ "USC008 (invalid UTF-8) is detected as an unpaired surrogate only: request bodies are decoded before scanning", "diff mode scans added lines only; context lines feed the tokenizer state; USC018 (mixed line endings) is not evaluated" ] } } }, "deterministic": false }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:327843e7-b0c9-4632-bd11-acd86cb6c663", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "Pre-merge Review Pack", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-06T17:56:53.694Z", "softwareAgent": { "name": "writerslogic-agent-hub/pre-merge-review", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia", "parameters": { "endpoint": "POST /api/v1/bundles/pre-merge-review", "inputDigest": { "alg": "sha256", "hash": "d57fe008fff0758aea0c2025fc48607efab9140dd986a01bef311d4c57bc5fee", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "29e1d314846f88424aa7809b138c4f491e2c9b6257876e6003694a6769c38920", "name": "jcs-canonical-json(data)" } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:ceab7e83-1015-419e-977e-e2b61c297eaa", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-06T17:56:53.694Z", "credentialSubject": { "id": "urn:sha256:29e1d314846f88424aa7809b138c4f491e2c9b6257876e6003694a6769c38920", "agent": "pre-merge-review", "endpoint": "POST /api/v1/bundles/pre-merge-review", "outputDigest": { "alg": "sha256", "value": "29e1d314846f88424aa7809b138c4f491e2c9b6257876e6003694a6769c38920", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "d57fe008fff0758aea0c2025fc48607efab9140dd986a01bef311d4c57bc5fee", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "c5b3d03699bb441163b72308ddf641450d61f5efd182303d715636e20cb91dce", "canonicalization": "JCS" }, "ingredients": [], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-06T17:56:53.694Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "z2DdeBsAuFzkYRKSM3snTCE47z91nZYgfPSTxAZ2PGp11EjKtijwJ5PTfp2j783HvoGbfjsTMHZ7mYVizaEWKqm2c" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:c48814f2e79afc17d58e54265ac0cb7a3dd413b46ad612b5651e174d2a6536cf", "signature": "0xc354bffeb50446d53da9e52b6a560293a441049102cf7855e86bb45253ea94464a9a6c28437de1e50c057f230de9d5206b83b07deab7e56ee579967c4818f9101b" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/pre-merge-review/", "description": "Documentation for Pre-merge Review Pack: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "pre-merge-review: unknown field is rejected", "method": "POST", "path": "/v1/bundles/pre-merge-review", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "pre-merge-review: example returns a signed result", "method": "POST", "path": "/v1/bundles/pre-merge-review", "body": { "diff": "diff --git a/src/users.ts b/src/users.ts\n--- a/src/users.ts\n+++ b/src/users.ts\n@@ -10,3 +10,4 @@ export async function findUser(db, req) {\n- return db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);\n+ const id = req.params.id;\n+ return db.query(`SELECT * FROM users WHERE id = ${id}`);\n }\n" }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "results": { "type": "object", "properties": { "diff-gatekeeper": { "type": "object", "properties": { "summary": { "type": "string" }, "intent_alignment": { "type": "string" }, "breakingChanges": { "type": "array", "items": { "type": "object", "required": [ "id", "file", "location", "severity", "description", "affected_consumers", "grounded", "source" ], "properties": { "id": { "type": "string" }, "file": { "type": "string" }, "location": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": { "type": "string" }, "affected_consumers": { "type": "string" }, "grounded": { "type": "boolean" }, "source": { "type": "string", "enum": [ "model", "rule" ] } } } }, "securityFlaws": { "type": "array", "items": { "type": "object", "required": [ "id", "file", "line", "category", "severity", "description", "exploit_scenario", "grounded", "source" ], "properties": { "id": { "type": "string" }, "file": { "type": "string" }, "line": { "type": "integer" }, "category": { "type": "string", "enum": [ "sql_injection", "nosql_injection", "command_injection", "xss", "ssrf", "path_traversal", "authz_bypass", "secret_exposure", "insecure_crypto", "deserialization", "supply_chain", "other" ] }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": { "type": "string" }, "exploit_scenario": { "type": "string" }, "grounded": { "type": "boolean" }, "source": { "type": "string", "enum": [ "model", "rule" ] } } } }, "bugs": { "type": "array", "items": { "type": "object", "required": [ "id", "file", "line", "category", "severity", "description", "grounded", "source" ], "properties": { "id": { "type": "string" }, "file": { "type": "string" }, "line": { "type": "integer" }, "category": { "type": "string", "enum": [ "race_condition", "state_mutation", "error_handling", "logic_error", "resource_leak", "null_handling", "performance", "other" ] }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "description": { "type": "string" }, "grounded": { "type": "boolean" }, "source": { "type": "string", "enum": [ "model", "rule" ] } } } }, "dependency_risks": { "type": "array", "items": { "type": "object", "required": [ "package", "risk", "severity" ], "properties": { "package": { "type": "string" }, "risk": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] } } } }, "riskScore": { "type": "integer" }, "verdict": { "type": "string", "enum": [ "fail", "warn", "pass", "inconclusive" ] }, "verdictReason": { "type": "string" }, "status": { "type": "string", "enum": [ "complete", "partial" ] }, "nextStep": { "type": "string" }, "topFindings": { "type": "array", "items": { "type": "object" } }, "annotations": { "type": "array", "items": { "type": "object" } }, "sarif": { "type": "object" }, "mergeApproved": { "type": "boolean" }, "modelRiskScore": { "type": "integer" }, "blockers": { "type": "array", "items": { "type": "string" } }, "dependencyRisks": { "type": "object" }, "secretsDetected": { "type": "array", "items": { "type": "object" } }, "suggestedPatches": { "type": "array", "items": { "type": "object", "required": [ "finding_id", "file", "original_code", "corrected_code", "explanation" ], "properties": { "finding_id": { "type": "string" }, "file": { "type": "string" }, "original_code": { "type": "string" }, "corrected_code": { "type": "string" }, "explanation": { "type": "string" }, "also_fixes": { "type": "array", "items": { "type": "string" } } } } }, "stats": { "type": "object" } }, "required": [ "summary", "intent_alignment", "breakingChanges", "securityFlaws", "bugs", "riskScore", "verdict", "verdictReason", "status", "nextStep", "topFindings", "annotations", "sarif", "mergeApproved", "modelRiskScore", "blockers", "dependencyRisks", "secretsDetected", "suggestedPatches", "stats" ] }, "unicode-safety-gate": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "block", "warn", "pass" ] }, "verdictReason": { "type": "string" }, "riskScore": { "type": "integer" }, "status": { "type": "string", "enum": [ "complete", "partial" ] }, "nextStep": { "type": "string" }, "topFindings": { "type": "array", "items": { "type": "object" } }, "source": { "type": "object" }, "mode": { "type": "string", "enum": [ "files", "diff" ] }, "summary": { "type": "object", "properties": { "total": { "type": "integer" }, "returned": { "type": "integer" }, "truncated": { "type": "boolean" }, "bySeverity": { "type": "object", "properties": { "critical": { "type": "integer" }, "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" } } }, "byRule": { "type": "object" }, "blocking": { "type": "integer" }, "filesScanned": { "type": "integer" }, "filesSkipped": { "type": "integer" } } }, "findings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "ruleId": { "type": "string" }, "ruleName": { "type": "string" }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "path": { "type": "string" }, "line": { "type": "integer" }, "column": { "type": "integer" }, "codePoints": { "type": "string" }, "snippet": { "type": "string" }, "message": { "type": "string" }, "charInfo": { "type": "string" } } } }, "sarif": { "type": "object" }, "skipped": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string" }, "reason": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "explanations": { "type": "array", "items": { "type": "object", "required": [ "id", "ruleId", "codePoints", "attackVector", "impact", "remediation" ], "properties": { "id": { "type": "string" }, "ruleId": { "type": "string" }, "codePoints": { "type": "string" }, "attackVector": { "type": "string" }, "impact": { "type": "string" }, "remediation": { "type": "string" } } } }, "llm": { "type": "string", "enum": [ "ok", "unavailable", "skipped" ] }, "deterministic": { "type": "object" } } } }, "required": [ "diff-gatekeeper", "unicode-safety-gate" ] }, "deterministic": { "type": "boolean" }, "mergeApproved": { "type": "boolean" } }, "required": [ "results", "deterministic" ] }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/pipelines/cra-readiness": { "post": { "operationId": "craReadiness", "summary": "EU CRA Readiness Check", "description": "`POST /v1/pipelines/cra-readiness`\n\nRepository or manifests in, EU Cyber Resilience Act Article 14 position out. Resolves every declared package to its locked version, checks each against OSV, CISA KEV, EPSS and ENISA EUVD, and joins each actively exploited component back to the manifest that declares it with the fixed versions. Reports the 24 hour, 72 hour and 14 day deadlines from the awareness time.\n\n**What you get:** One call tells a manufacturer whether an exploited vulnerability in its own dependency tree starts the CRA reporting clock, and which manifest line to change.\n\n### Use it for\n\n- Learn whether an exploited vulnerability in your dependency tree starts the EU Cyber Resilience Act reporting clock.\n- Find which manifest declares each actively exploited component, with the fixed versions.\n- Get the 24 hour, 72 hour and 14 day reporting deadlines computed from your awareness time.\n\n### Details and limits\n\nRepository or manifests in, EU Cyber Resilience Act Art. 14 position out: dependency-advisor resolves every declared package to its locked version (deterministic, no model), those versions go to cra-exploit-clock as package URLs (OSV, CISA KEV, EPSS, EUVD), and each actively exploited component is joined back to the manifest that declares it with the fixed versions and the advisor's findings. Reports the 24 h / 72 h / 14 day reporting deadlines from the awareness time.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `repo` | string | no | Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head). |\n| `ref` | string | no | Branch, tag or commit; defaults to the default branch. |\n| `files` | array of object | no | Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths. |\n| `ecosystems` | array of string | no | Restrict the analysis; default all detected. |\n| `repoLicense` | string | no | SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent. |\n| `product` | object | no | Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name). |\n| `awareness_time` | string | no | When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it. |\n| `fix_available_at` | string | no | When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date. |\n\n### Example request body\n\n```json\n{\n \"repo\": \"star7th/htq\",\n \"product\": {\n \"name\": \"htq\"\n }\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/pipelines/cra-readiness\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"repo\":\"star7th/htq\",\"product\":{\"name\":\"htq\"}}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `readiness` | enum | REPORTABLE_CANDIDATES when an exploited vulnerability affects a resolved dependency; NO_EXPLOITED_EVIDENCE only when every resolved dependency was fully checked and none was unresolved. |\n| `fixPlan` | array of object | Fix plan, a list of objects. |\n| `deadlines` | object, nullable | cra-exploit-clock's Art. 14(2) deadlines, or null when it did not run. |\n| `nextStep` | any | cra-exploit-clock's next_step, or null. |\n| `unresolved` | array of object | Unresolved, a list of objects. |\n| `results` | object | Each executed member step's full result, keyed by step id (forEach steps: one entry per item). |\n| `steps` | object | Per step: status (ok \\| skipped \\| failed), reason, attempts, ms, inputSha256, outputSha256, and the output hashes of the upstream steps its input was derived from. |\n| `partial` | boolean | True when an optional step was missing or a member returned its own partial result. |\n| `missing` | array of object | Missing, a list of objects. |\n| `deterministic` | boolean | True only when every executed member answered without a model. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"readiness\": \"NO_EXPLOITED_EVIDENCE\",\n \"fixPlan\": [],\n \"deadlines\": {\n \"early_warning_due\": \"2026-11-07T01:30:35.929Z\",\n \"notification_due\": \"2026-11-09T01:30:35.929Z\",\n \"final_report_due\": null,\n \"final_report_basis\": \"Not computable: runs 14 days from the time a corrective or mitigating measure is available (fix_available_at not supplied).\",\n \"early_warning_hours_remaining\": 24,\n \"notification_hours_remaining\": 72,\n \"final_report_hours_remaining\": null,\n \"applies\": false,\n \"art14_in_force_at_awareness\": true,\n \"evaluated_at\": \"2026-11-06T01:30:38.377Z\",\n \"legal_basis\": {\n \"regulation\": \"Regulation (EU) 2024/2847 (Cyber Resilience Act)\",\n \"article\": \"Article 14(2)\",\n \"source_url\": \"https://eur-lex.europa.eu/eli/reg/2024/2847/oj\",\n \"applies_from\": \"2026-09-11\",\n \"applies_from_basis\": \"Art. 71(2): Article 14 shall apply from 11 September 2026.\",\n \"early_warning\": \"Art. 14(2)(a): early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer be...\",\n \"notification\": \"Art. 14(2)(b): vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware, unless the relevant infor...\",\n \"final_report\": \"Art. 14(2)(c): final report no later than 14 days after a corrective or mitigating measure is available, unless the relevant information has already been pro...\",\n \"severe_incident_final_report\": \"Art. 14(4)(c): for a severe incident the final report is due within one month after the submission of the incident notification under Art. 14(4)(b); this age...\",\n \"actively_exploited_definition\": \"Art. 3(42): a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner.\"\n }\n },\n \"nextStep\": {\n \"code\": \"MONITOR_FEEDS\",\n \"by\": null,\n \"detail\": \"No KEV or EUVD exploitation evidence for any matched advisory at the snapshot times below. Rerun when the SBOM or the feeds change; feeds lag disclosure.\"\n },\n \"unresolved\": [],\n \"results\": {\n \"advisor\": {\n \"verdict\": \"fail\",\n \"riskScore\": 90,\n \"verdictReason\": \"4 declared packages with a high or critical known advisory: node-fetch, body-parser, connect-multiparty\",\n \"status\": \"complete\",\n \"missing\": [],\n \"topFindings\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"nextStep\": \"Block the release until node-fetch is fixed: Upgrade node-fetch (latest is 3.3.2) and re-check advisories.\",\n \"source\": \"...\",\n \"ecosystems\": [\n \"...\"\n ],\n \"summary\": \"...\",\n \"findings\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"replacements\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"dependencies\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"coverage\": \"...\"\n },\n \"cra\": {\n \"deterministic\": true,\n \"verdict\": \"NO_EXPLOITED_EVIDENCE\",\n \"confidence\": \"...\",\n \"exposure\": \"...\",\n \"next_step\": \"...\",\n \"top_evidence\": [],\n \"summary\": \"All 9 entries were checked; none has an OSV-matched advisory listed in CISA KEV or ENISA EUVD at the snapshot times.\",\n \"not_legal_advice\": \"Not legal advice. This report lists feed evidence and arithmetic on the timestamps you supply. Whether a vulnerability is 'actively exploited' under Art. 3(4...\",\n \"product\": \"...\",\n \"sbom\": \"...\",\n \"awareness\": \"...\",\n \"deadlines\": \"...\",\n \"counts\": \"...\",\n \"exploited_vulnerabilities\": []\n }\n },\n \"steps\": {\n \"advisor\": {\n \"id\": \"advisor\",\n \"agentId\": \"dependency-advisor\",\n \"attempts\": 1,\n \"status\": \"ok\",\n \"ms\": 2116,\n \"inputSha256\": \"c30a61927aede25f53ef6dec45b095294f3d6826c540454eddbcd33e36d046df\",\n \"outputSha256\": \"2f64012aa205f47bceaa4220a525c2cfddff1bcf54f1f53209dcac481e786bb5\",\n \"partial\": false\n },\n \"purls\": {\n \"id\": \"purls\",\n \"attempts\": 0,\n \"status\": \"ok\",\n \"ms\": 0,\n \"outputSha256\": \"c9be27e39ca485c355f33047d36dcfd26e231fc39c4332983dff95e5ff48a0f6\",\n \"reads\": \"...\",\n \"partial\": false\n },\n \"cra\": {\n \"id\": \"cra\",\n \"agentId\": \"cra-exploit-clock\",\n \"attempts\": 1,\n \"status\": \"ok\",\n \"ms\": 2448,\n \"inputSha256\": \"0525805d54eb312219d15bf760b90c4480f8587775c4ef857fdbef34a46e998b\",\n \"outputSha256\": \"18450b147f3ad01511f05f2735b7bfc514b27dfb8263fdeba88ff29334432688\",\n \"reads\": \"...\",\n \"partial\": false\n }\n },\n \"partial\": false,\n \"missing\": [],\n \"deterministic\": true\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/cra-readiness/\nMachine-readable input and result schemas: https://writerslogic.com/agents/cra-readiness.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/cra-readiness", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "repo": { "type": "string", "minLength": 3, "maxLength": 200, "description": "Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head)." }, "ref": { "type": "string", "maxLength": 200, "description": "Branch, tag or commit; defaults to the default branch." }, "files": { "type": "array", "maxItems": 600, "description": "Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths.", "items": { "type": "object", "additionalProperties": false, "required": [ "path", "content" ], "properties": { "path": { "type": "string", "minLength": 1, "maxLength": 300, "description": "Path. Up to 300 characters." }, "content": { "type": "string", "maxLength": 400000, "description": "Content. Up to 400,000 characters." } } } }, "ecosystems": { "type": "array", "maxItems": 3, "items": { "type": "string", "enum": [ "npm", "pypi", "cargo" ] }, "description": "Restrict the analysis; default all detected." }, "repoLicense": { "type": "string", "maxLength": 100, "description": "SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent." }, "product": { "type": "object", "additionalProperties": false, "required": [ "name" ], "description": "Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200, "description": "Name. Up to 200 characters." }, "version": { "type": "string", "maxLength": 100, "description": "Version. Up to 100 characters." } } }, "awareness_time": { "type": "string", "maxLength": 40, "description": "When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it." }, "fix_available_at": { "type": "string", "maxLength": 40, "description": "When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date." } }, "description": "Input payload for EU CRA Readiness Check. Required fields: none. Optional fields: `repo`, `ref`, `files`, `ecosystems`, `repoLicense`, `product`, `awareness_time`, `fix_available_at`.", "externalDocs": { "url": "https://writerslogic.com/agents/cra-readiness.json", "description": "Machine-readable record for EU CRA Readiness Check: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for EU CRA Readiness Check", "description": "A complete valid request body for EU CRA Readiness Check.", "value": { "repo": "star7th/htq", "product": { "name": "htq" } } } } } }, "description": "JSON request body for EU CRA Readiness Check. Required fields: none. Optional fields: `repo`, `ref`, `files`, `ecosystems`, `repoLicense`, `product`, `awareness_time`, `fix_available_at`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "readiness": { "type": "string", "enum": [ "REPORTABLE_CANDIDATES", "NO_EXPLOITED_EVIDENCE", "INSUFFICIENT_EVIDENCE", "NO_RESOLVED_VERSIONS" ], "description": "REPORTABLE_CANDIDATES when an exploited vulnerability affects a resolved dependency; NO_EXPLOITED_EVIDENCE only when every resolved dependency was fully checked and none was unresolved." }, "fixPlan": { "type": "array", "items": { "type": "object", "description": "Per exploited component: purl, package, manifest, range, usageFiles, kevDateAdded, cves, fixedVersions, advisorFindings." }, "description": "Fix plan, a list of objects." }, "deadlines": { "type": "object", "description": "cra-exploit-clock's Art. 14(2) deadlines, or null when it did not run.", "nullable": true }, "nextStep": { "description": "cra-exploit-clock's next_step, or null." }, "unresolved": { "type": "array", "items": { "type": "object", "description": "Declared packages with no resolved version (no lockfile entry); not checked for exploitation." }, "description": "Unresolved, a list of objects." }, "results": { "type": "object", "description": "Each executed member step's full result, keyed by step id (forEach steps: one entry per item)." }, "steps": { "type": "object", "description": "Per step: status (ok | skipped | failed), reason, attempts, ms, inputSha256, outputSha256, and the output hashes of the upstream steps its input was derived from." }, "partial": { "type": "boolean", "description": "True when an optional step was missing or a member returned its own partial result." }, "missing": { "type": "array", "items": { "type": "object", "description": "{step, reason, impact}" }, "description": "Missing, a list of objects." }, "deterministic": { "type": "boolean", "description": "True only when every executed member answered without a model." } }, "required": [ "results", "steps", "partial", "missing", "deterministic" ], "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "readiness": "NO_EXPLOITED_EVIDENCE", "fixPlan": [], "deadlines": { "early_warning_due": "2026-11-07T01:30:35.929Z", "notification_due": "2026-11-09T01:30:35.929Z", "final_report_due": null, "final_report_basis": "Not computable: runs 14 days from the time a corrective or mitigating measure is available (fix_available_at not supplied).", "early_warning_hours_remaining": 24, "notification_hours_remaining": 72, "final_report_hours_remaining": null, "applies": false, "art14_in_force_at_awareness": true, "evaluated_at": "2026-11-06T01:30:38.377Z", "legal_basis": { "regulation": "Regulation (EU) 2024/2847 (Cyber Resilience Act)", "article": "Article 14(2)", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj", "applies_from": "2026-09-11", "applies_from_basis": "Art. 71(2): Article 14 shall apply from 11 September 2026.", "early_warning": "Art. 14(2)(a): early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it.", "notification": "Art. 14(2)(b): vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware, unless the relevant information has already been provided.", "final_report": "Art. 14(2)(c): final report no later than 14 days after a corrective or mitigating measure is available, unless the relevant information has already been provided.", "severe_incident_final_report": "Art. 14(4)(c): for a severe incident the final report is due within one month after the submission of the incident notification under Art. 14(4)(b); this agent evaluates vulnerabilities only and computes no incident clock.", "actively_exploited_definition": "Art. 3(42): a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner." } }, "nextStep": { "code": "MONITOR_FEEDS", "by": null, "detail": "No KEV or EUVD exploitation evidence for any matched advisory at the snapshot times below. Rerun when the SBOM or the feeds change; feeds lag disclosure." }, "unresolved": [], "results": { "advisor": { "verdict": "fail", "riskScore": 90, "verdictReason": "4 declared packages with a high or critical known advisory: node-fetch, body-parser, connect-multiparty", "status": "complete", "missing": [], "topFindings": [ { "rank": 1, "id": "vulnerable:npm:node-fetch:package.json", "package": "node-fetch", "ecosystem": "npm", "kind": "vulnerable", "severity": "high", "score": 91, "confidence": "high", "file": "package.json", "line": 22, "summary": "node-fetch@2.6.1 has 1 known advisory (GHSA-r683-j2x4-v87g).", "fix": "Upgrade node-fetch (latest is 3.3.2) and re-check advisories." }, { "rank": 2, "id": "vulnerable:npm:body-parser:package.json", "package": "body-parser", "ecosystem": "npm", "kind": "vulnerable", "severity": "high", "score": 88, "confidence": "high", "file": "package.json", "line": 17, "summary": "body-parser@1.18.3 has 3 known advisories (GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6).", "fix": "Upgrade body-parser (latest is 2.4.0) and re-check advisories." }, { "rank": 3, "id": "vulnerable:npm:connect-multiparty:package.json", "package": "connect-multiparty", "ecosystem": "npm", "kind": "vulnerable", "severity": "high", "score": 88, "confidence": "high", "file": "package.json", "line": 18, "summary": "connect-multiparty@2.2.0 has 1 known advisory (GHSA-w2xw-44r3-4v9g).", "fix": "No newer release; replace connect-multiparty." } ], "nextStep": "Block the release until node-fetch is fixed: Upgrade node-fetch (latest is 3.3.2) and re-check advisories.", "source": { "kind": "github", "repo": "star7th/htq", "commit": "c64ac96becf9d0003774094bc5ff192bec8c70be", "treeEntries": 12, "treeTruncated": false, "filesRead": 6, "bytesRead": 52035, "sourceFilesRead": 4, "skippedBySize": [], "skippedByCap": 0, "via": "api", "license": "apache2.0", "licenseSource": "manifest" }, "ecosystems": [ { "ecosystem": "npm", "manifests": [ { "path": "package.json", "lockfile": "package-lock v1", "runtimeMin": null, "declared": 9 } ], "sourceFilesScanned": 4 } ], "summary": { "declaredPackages": 9, "flaggedPackages": 11, "findings": 19, "byCategory": { "underused": 4, "outgrown": 12, "replace": 3 }, "byKind": { "vulnerable": 6, "deprecated": 2, "redundant-dependency": 1, "undeclared": 1, "unused": 1, "dev-only-in-dependencies": 1, "native-replacement": 1, "trivial-use": 1, "stale": 3, "overlap": 1, "behind-major": 1 }, "high": 8, "replacementsReviewed": 4 }, "findings": [ { "ecosystem": "npm", "package": "node-fetch", "manifest": "package.json", "kind": "vulnerable", "confidence": "high", "summary": "node-fetch@2.6.1 has 1 known advisory (GHSA-r683-j2x4-v87g).", "evidence": { "version": "2.6.1", "versionSource": "lockfile", "source": "osv", "advisories": [ { "id": "GHSA-r683-j2x4-v87g", "cvss": 8.8, "severity": "high", "summary": "node-fetch forwards secure headers to untrusted sites" } ], "total": 1, "latestVersion": "3.3.2" }, "action": "Upgrade node-fetch (latest is 3.3.2) and re-check advisories.", "id": "vulnerable:npm:node-fetch:package.json", "category": "outgrown", "score": 91, "severity": "high" }, { "ecosystem": "npm", "package": "body-parser", "manifest": "package.json", "kind": "vulnerable", "confidence": "high", "summary": "body-parser@1.18.3 has 3 known advisories (GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6).", "evidence": { "version": "1.18.3", "versionSource": "lockfile", "source": "osv", "advisories": [ { "id": "GHSA-27r3-jxmh-p828", "cvss": 7.5, "severity": "high", "summary": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body" }, { "id": "GHSA-qwcr-r2fm-qrc7", "cvss": 7.5, "severity": "high", "summary": "body-parser vulnerable to denial of service when url encoding is enabled" }, { "id": "GHSA-v422-hmwv-36x6", "cvss": 3.7, "severity": "low", "summary": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement" } ], "total": 3, "latestVersion": "2.4.0" }, "action": "Upgrade body-parser (latest is 2.4.0) and re-check advisories.", "id": "vulnerable:npm:body-parser:package.json", "category": "outgrown", "score": 88, "severity": "high" }, { "ecosystem": "npm", "package": "connect-multiparty", "manifest": "package.json", "kind": "vulnerable", "confidence": "high", "summary": "connect-multiparty@2.2.0 has 1 known advisory (GHSA-w2xw-44r3-4v9g).", "evidence": { "version": "2.2.0", "versionSource": "lockfile", "source": "osv", "advisories": [ { "id": "GHSA-w2xw-44r3-4v9g", "cvss": 7.8, "severity": "high", "summary": "Connect-Multiparty allows arbitrary file upload" } ], "total": 1, "latestVersion": "2.2.0" }, "action": "No newer release; replace connect-multiparty.", "id": "vulnerable:npm:connect-multiparty:package.json", "category": "outgrown", "score": 88, "severity": "high" } ], "replacements": [ { "package": "connect-multiparty", "ecosystem": "npm", "manifest": "package.json", "flaggedBy": [ "deprecated" ], "files": 1, "symbols": [ "default" ], "migrationEffort": "low", "current": { "version": "2.2.0", "scorecard": 3, "dependents": 423, "monthsSinceLatestRelease": 97.7, "unpackedSize": 8691, "licenses": [ "MIT" ] }, "table": null, "alternatives": [], "candidates": [], "reviewedAlternative": null, "coverage": null }, { "package": "request", "ecosystem": "npm", "manifest": "package.json", "flaggedBy": [ "deprecated", "trivial-use" ], "files": 2, "symbols": [ "default" ], "migrationEffort": "low", "current": { "version": "2.88.0", "scorecard": 3.4, "dependents": 4587, "monthsSinceLatestRelease": 80.8, "unpackedSize": 206894, "licenses": [ "Apache-2.0" ] }, "table": { "entry": "npm:request", "tableVersion": "2026-11-04.1", "reason": "deprecated", "summary": "request is deprecated by its maintainers and receives no fixes; the callback and stream API has no drop-in replacement.", "applicability": "unknown-runtime", "note": "requires runtime >= 18; the repo does not declare its minimum runtime", "citations": [ { "title": "request/request#3142: Request is officially deprecated", "url": "https://github.com/request/request/issues/3142" }, { "title": "MDN: Fetch API", "url": "https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API" } ] }, "alternatives": [ { "kind": "platform", "name": "global fetch", "applicability": "unknown-runtime" }, { "kind": "package", "name": "axios" }, { "kind": "package", "name": "got" } ], "candidates": [ { "name": "axios", "source": "curated", "score": 84.9, "components": { "scorecard": 0.77, "recency": 1, "dependents": 1, "size": 0.177, "license": 1 }, "licenseCompat": "compatible", "version": "1.21.0", "licenses": [ "MIT" ], "scorecard": 7.7, "monthsSinceLatestRelease": 0.3, "dependents": 174644, "unpackedSize": 2215223 }, { "name": "got", "source": "curated", "score": 70.1, "components": { "scorecard": 0.55, "recency": 1, "dependents": 0.429, "size": 0.502, "license": 1 }, "licenseCompat": "compatible", "version": "16.2.0", "licenses": [ "MIT" ], "scorecard": 5.5, "monthsSinceLatestRelease": 0.2, "dependents": 138, "unpackedSize": 495293 }, { "name": "undici", "source": "curated", "score": 70.1, "components": { "scorecard": 0.81, "recency": 1, "dependents": 0.2, "size": 0.18, "license": 1 }, "licenseCompat": "compatible", "version": "8.12.4", "licenses": [ "MIT" ], "scorecard": 8.1, "monthsSinceLatestRelease": 0, "unpackedSize": 2185656 } ], "reviewedAlternative": "global fetch", "coverage": { "status": "UNREVIEWED", "symbols": [], "unaccounted": [ "default" ], "decidedBy": "none" } }, { "package": "body-parser", "ecosystem": "npm", "manifest": "package.json", "flaggedBy": [ "redundant-dependency" ], "files": 1, "symbols": [ "default" ], "migrationEffort": "low", "current": { "version": "1.18.3", "scorecard": 7.4, "dependents": 3544, "monthsSinceLatestRelease": 0.5, "unpackedSize": 55897, "licenses": [ "MIT" ] }, "table": { "entry": "npm:body-parser", "tableVersion": "2026-11-04.1", "reason": "redundant", "summary": "Express exposes json and urlencoded (4.16.0), raw and text (4.17.0) built in.", "applicability": "applies", "citations": [ { "title": "Express History.md (4.16.0 adds express.json and express.urlencoded; 4.17.0 adds raw and text)", "url": "https://github.com/expressjs/express/blob/master/History.md" } ] }, "alternatives": [ { "kind": "dependency", "name": "express built-in body parsers", "applicability": "applies" } ], "candidates": [], "reviewedAlternative": "express built-in body parsers", "coverage": { "status": "UNREVIEWED", "symbols": [], "unaccounted": [ "default" ], "decidedBy": "none" } } ], "dependencies": [ { "ecosystem": "npm", "name": "async-redis", "sections": [ "dependencies" ], "manifest": "package.json", "range": "^1.1.7", "version": "1.1.7", "versionSource": "lockfile", "usage": { "files": 2, "filesByClass": { "prod": 1, "test": 1, "tooling": 0 }, "symbols": [ "createClient" ], "symbolCount": 1, "typeOnly": false, "referencedByTooling": false }, "health": { "deprecated": false, "latestVersion": "2.0.0", "monthsSinceLatestRelease": 65.4, "licenses": [ "MIT" ], "advisories": 0, "unpackedSize": 104783, "maintainers": 1, "scorecard": 3, "dependents": 127 } }, { "ecosystem": "npm", "name": "body-parser", "sections": [ "dependencies" ], "manifest": "package.json", "range": "^1.18.3", "version": "1.18.3", "versionSource": "lockfile", "usage": { "files": 1, "filesByClass": { "prod": 0, "test": 1, "tooling": 0 }, "symbols": [ "default" ], "symbolCount": 1, "typeOnly": false, "referencedByTooling": false }, "health": { "deprecated": false, "latestVersion": "2.4.0", "monthsSinceLatestRelease": 0.5, "licenses": [ "MIT" ], "advisories": 3, "unpackedSize": 55897, "maintainers": 1, "scorecard": 7.4, "dependents": 3544 } }, { "ecosystem": "npm", "name": "connect-multiparty", "sections": [ "dependencies" ], "manifest": "package.json", "range": "^2.2.0", "version": "2.2.0", "versionSource": "lockfile", "usage": { "files": 1, "filesByClass": { "prod": 1, "test": 0, "tooling": 0 }, "symbols": [ "default" ], "symbolCount": 1, "typeOnly": false, "referencedByTooling": false }, "health": { "deprecated": true, "latestVersion": "2.2.0", "monthsSinceLatestRelease": 97.7, "licenses": [ "MIT" ], "advisories": 1, "unpackedSize": 8691, "maintainers": 2, "scorecard": 3, "dependents": 423 } } ], "coverage": { "complete": true, "notes": [], "sourceFilesScanned": 4, "health": { "checked": 9, "skipped": 0 }, "upstreamCalls": { "github": 8, "registries": 76 }, "failures": [] }, "sarif": { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "writerslogic-dependency-advisor", "version": "1.0.0", "semanticVersion": "1.0.0", "informationUri": "https://agents.writerslogic.com", "rules": [ { "id": "dep/vulnerable", "name": "vulnerable", "shortDescription": { "text": "Dependency has known security advisories" }, "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "dependencies", "external/cwe/cwe-1395" ], "security-severity": "8.0" } }, { "id": "dep/deprecated", "name": "deprecated", "shortDescription": { "text": "Dependency is deprecated by its maintainers" }, "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "dependencies", "maintainability" ], "security-severity": "5.5" } }, { "id": "dep/redundant-dependency", "name": "redundant-dependency", "shortDescription": { "text": "Dependency is redundant with another already in use" }, "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "dependencies", "maintainability" ], "security-severity": "3.0" } } ] } }, "results": [ { "ruleId": "dep/vulnerable", "ruleIndex": 0, "level": "error", "message": { "text": "node-fetch@2.6.1 has 1 known advisory (GHSA-r683-j2x4-v87g). Fix: Upgrade node-fetch (latest is 3.3.2) and re-check advisories." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "package.json", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 22 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "vulnerable:npm:node-fetch:package.json" }, "properties": { "severity": "high", "package": "node-fetch", "ecosystem": "npm", "score": 91, "confidence": "high" } }, { "ruleId": "dep/vulnerable", "ruleIndex": 0, "level": "error", "message": { "text": "body-parser@1.18.3 has 3 known advisories (GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6). Fix: Upgrade body-parser (latest is 2.4.0) and re-check advisories." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "package.json", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 17 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "vulnerable:npm:body-parser:package.json" }, "properties": { "severity": "high", "package": "body-parser", "ecosystem": "npm", "score": 88, "confidence": "high" } }, { "ruleId": "dep/vulnerable", "ruleIndex": 0, "level": "error", "message": { "text": "connect-multiparty@2.2.0 has 1 known advisory (GHSA-w2xw-44r3-4v9g). Fix: No newer release; replace connect-multiparty." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "package.json", "uriBaseId": "%SRCROOT%" }, "region": { "startLine": 18 } } } ], "partialFingerprints": { "primaryLocationLineHash/v1": "vulnerable:npm:connect-multiparty:package.json" }, "properties": { "severity": "high", "package": "connect-multiparty", "ecosystem": "npm", "score": 88, "confidence": "high" } } ] } ] }, "llmCalls": 0, "decidedBy": { "findings": "code", "replacementCoverage": { "table": 1, "model": 0, "unreviewed": 2 } }, "versions": { "replacementsTable": "2026-11-04.1" }, "thresholds": { "trivialMaxSymbols": 2, "trivialMaxFiles": 2, "trivialMinSizeBytes": 200000, "effortLowFiles": 2, "effortMediumFiles": 8, "heavyUseFiles": 5, "staleMonths": 24, "majorsBehind": 2 }, "wouldChangeVerdict": [ "Re-run with mode \"auto\" and an available model to review symbols the curated table does not decide." ] }, "cra": { "deterministic": true, "verdict": "NO_EXPLOITED_EVIDENCE", "confidence": { "score": 0.9, "label": "high" }, "exposure": { "article": "Art. 64(2)", "max_administrative_fine_eur": 15000000, "max_turnover_percent": 2.5, "note": "Ceiling for non-compliance with Art. 13 and 14 (whichever is higher for an undertaking); not an estimate of any penalty." }, "next_step": { "code": "MONITOR_FEEDS", "by": null, "detail": "No KEV or EUVD exploitation evidence for any matched advisory at the snapshot times below. Rerun when the SBOM or the feeds change; feeds lag disclosure." }, "top_evidence": [], "summary": "All 9 entries were checked; none has an OSV-matched advisory listed in CISA KEV or ENISA EUVD at the snapshot times.", "not_legal_advice": "Not legal advice. This report lists feed evidence and arithmetic on the timestamps you supply. Whether a vulnerability is 'actively exploited' under Art. 3(42), when the manufacturer 'became aware', and what must be notified are determinations for the manufacturer and its counsel.", "product": { "name": "htq", "version": null }, "sbom": { "format": "purl-list", "spec_version": null, "sha256": "ff7d233db3e297da33d2c556464067c141ba5f1f9c78d00b700d25b520c7bfbb", "bytes": 245, "entries": 9, "evaluated": 9, "skipped": [] }, "awareness": { "time": "2026-11-06T01:30:35.929Z", "source": "evaluation_time", "attested": false, "note": "awareness_time defaulted to the evaluation time." }, "deadlines": { "early_warning_due": "2026-11-07T01:30:35.929Z", "notification_due": "2026-11-09T01:30:35.929Z", "final_report_due": null, "final_report_basis": "Not computable: runs 14 days from the time a corrective or mitigating measure is available (fix_available_at not supplied).", "early_warning_hours_remaining": 24, "notification_hours_remaining": 72, "final_report_hours_remaining": null, "applies": false, "art14_in_force_at_awareness": true, "evaluated_at": "2026-11-06T01:30:38.377Z", "legal_basis": { "regulation": "Regulation (EU) 2024/2847 (Cyber Resilience Act)", "article": "Article 14(2)", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj", "applies_from": "2026-09-11", "applies_from_basis": "Art. 71(2): Article 14 shall apply from 11 September 2026.", "early_warning": "Art. 14(2)(a): early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it.", "notification": "Art. 14(2)(b): vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware, unless the relevant information has already been provided.", "final_report": "Art. 14(2)(c): final report no later than 14 days after a corrective or mitigating measure is available, unless the relevant information has already been provided.", "severe_incident_final_report": "Art. 14(4)(c): for a severe incident the final report is due within one month after the submission of the incident notification under Art. 14(4)(b); this agent evaluates vulnerabilities only and computes no incident clock.", "actively_exploited_definition": "Art. 3(42): a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner." } }, "counts": { "EXPLOITED_REPORTABLE_CANDIDATE": 0, "KNOWN_VULN_NOT_EXPLOITED": 7, "NO_MATCH": 2, "INSUFFICIENT_EVIDENCE": 0 }, "exploited_vulnerabilities": [], "exploited_vulnerabilities_truncated": false, "components": [ { "purl": "pkg:npm/async-redis@1.1.7", "ref": "purls[0]", "verdict": "NO_MATCH", "affected_range_match": "OSV_NOT_AFFECTED", "advisory_count": 0, "advisories": [], "advisories_truncated": false, "advisories_without_cve": 0, "exploited_cves": [], "kev": false, "kev_date_added": null, "euvd_exploited": false, "epss": null, "evidence_gaps": [] }, { "purl": "pkg:npm/body-parser@1.18.3", "ref": "purls[1]", "verdict": "KNOWN_VULN_NOT_EXPLOITED", "affected_range_match": "OSV_AFFECTED", "advisory_count": 3, "advisories": [ { "id": "GHSA-27r3-jxmh-p828", "cve_ids": [ "CVE-2026-111181" ], "summary": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "fixed_versions": [ "2.4.0", "1.20.9" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-27r3-jxmh-p828" }, { "id": "GHSA-qwcr-r2fm-qrc7", "cve_ids": [ "CVE-2024-45590" ], "summary": "body-parser vulnerable to denial of service when url encoding is enabled", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "fixed_versions": [ "1.20.3" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-qwcr-r2fm-qrc7" }, { "id": "GHSA-v422-hmwv-36x6", "cve_ids": [ "CVE-2026-12590" ], "summary": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement", "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "fixed_versions": [ "1.20.6", "2.3.0" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6" } ], "advisories_truncated": false, "advisories_without_cve": 0, "exploited_cves": [], "kev": false, "kev_date_added": null, "euvd_exploited": false, "epss": 0.00824, "evidence_gaps": [] }, { "purl": "pkg:npm/connect-multiparty@2.2.0", "ref": "purls[2]", "verdict": "KNOWN_VULN_NOT_EXPLOITED", "affected_range_match": "OSV_AFFECTED", "advisory_count": 1, "advisories": [ { "id": "GHSA-w2xw-44r3-4v9g", "cve_ids": [ "CVE-2022-29623" ], "summary": "Connect-Multiparty allows arbitrary file upload", "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "fixed_versions": [], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-w2xw-44r3-4v9g" } ], "advisories_truncated": false, "advisories_without_cve": 0, "exploited_cves": [], "kev": false, "kev_date_added": null, "euvd_exploited": false, "epss": 0.01384, "evidence_gaps": [] } ], "art14_draft_fields": [], "feed_snapshots": { "osv": { "queried_at": "2026-11-06T01:30:36.225Z", "components_queried": 9 }, "cisa_kev": { "catalog_version": "2026.11.04", "date_released": "2026-11-04T20:00:05.774Z", "entries": 1768 }, "first_epss": { "score_date": "2026-11-05", "cves_scored": 17 }, "enisa_euvd": { "cves_checked": 17, "cves_with_exploitation_record": 0 } }, "sources": [ { "name": "osv.dev", "role": "Version-aware advisory matching (querybatch by purl and version) and advisory records", "status": "ok", "url": "https://api.osv.dev/v1/querybatch", "requests": 18, "sha256": "cdd8735c93d55fe1e6d6d22ae30bbb3cabd12dd0938a7cd56686f6f1be81ab7a", "digest_basis": "sha256 over the lines '\\t' of every request in order", "fetched_at": "2026-11-06T01:30:36.596Z", "errors": [], "failed_requests": 0 }, { "name": "cisa-kev", "role": "Known Exploited Vulnerabilities catalog", "status": "ok", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "requests": 1, "sha256": "273b7e449828f0af92e012bf03270a6a6c3deb21dc7a50b46ebe0447ea196bff", "digest_basis": "response body", "fetched_at": "2026-11-06T01:30:36.008Z", "errors": [], "failed_requests": 0 }, { "name": "first-epss", "role": "Exploit Prediction Scoring System scores", "status": "ok", "url": "https://api.first.org/data/v1/epss?limit=100&cve=CVE-2021-29469,CVE-2022-0235,CVE-2022-29623,CVE-2023-28155,CVE-2024-29041,CVE-2024-43796,CVE-2024-45590,CVE-2025-47935,CVE-2026-111181,CVE-2026-12590,CVE-2026-2359,CVE-2026-3304,CVE-2026-3520,CVE-2026-5079,CVE-2026-77063,CVE-2026-77078,CVE-2026-82333", "requests": 1, "sha256": "1c54dfc4f244dedaebee3811c2d5c335512cf0f97b236501812996034ad01a08", "digest_basis": "response body", "fetched_at": "2026-11-06T01:30:36.895Z", "errors": [], "failed_requests": 0 } ], "coverage": { "complete": true, "missing": [], "upstream_calls": 37, "deadline_ms": 45000, "elapsed_ms": 2448 }, "awareness_record": null, "would_change_verdict": [ "A new KEV or EUVD entry for an advisory matched to a component.", "Versioned purls for skipped entries.", "A rerun after missing feeds recover (see coverage.missing)." ] } }, "steps": { "advisor": { "id": "advisor", "agentId": "dependency-advisor", "attempts": 1, "status": "ok", "ms": 2116, "inputSha256": "c30a61927aede25f53ef6dec45b095294f3d6826c540454eddbcd33e36d046df", "outputSha256": "2f64012aa205f47bceaa4220a525c2cfddff1bcf54f1f53209dcac481e786bb5", "partial": false }, "purls": { "id": "purls", "attempts": 0, "status": "ok", "ms": 0, "outputSha256": "c9be27e39ca485c355f33047d36dcfd26e231fc39c4332983dff95e5ff48a0f6", "reads": { "advisor": "2f64012aa205f47bceaa4220a525c2cfddff1bcf54f1f53209dcac481e786bb5" }, "partial": false }, "cra": { "id": "cra", "agentId": "cra-exploit-clock", "attempts": 1, "status": "ok", "ms": 2448, "inputSha256": "0525805d54eb312219d15bf760b90c4480f8587775c4ef857fdbef34a46e998b", "outputSha256": "18450b147f3ad01511f05f2735b7bfc514b27dfb8263fdeba88ff29334432688", "reads": { "purls": "c9be27e39ca485c355f33047d36dcfd26e231fc39c4332983dff95e5ff48a0f6" }, "partial": false } }, "partial": false, "missing": [], "deterministic": true }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:dc7ef82f-41f0-4c0c-8ffb-b4b5e095b2d0", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "EU CRA Readiness Check", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-06T01:30:38.377Z", "softwareAgent": { "name": "writerslogic-agent-hub/cra-readiness", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia", "parameters": { "endpoint": "POST /api/v1/pipelines/cra-readiness", "inputDigest": { "alg": "sha256", "hash": "4abea584f587ba02703fe80fcb699f75a4f118f2d4c7ca3f7b637f404070cf08", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "182ea8227f6a5e9f9c992902abd55ef467721f3b3885820db29960947f154455", "name": "jcs-canonical-json(data)" } }, { "label": "c2pa.ingredient.v3", "data": { "title": "https://api.github.com/repos/star7th/htq/commits/HEAD", "format": "application/json", "relationship": "inputTo", "dc": { "source": "https://api.github.com/repos/star7th/htq/commits/HEAD", "date": "2026-11-06T01:30:34.072Z" }, "hash": { "alg": "sha256", "hash": "4bd55e22578cbe3b02e15b73bcb3d6f24c81e015ed9b9cfaddb1ca41f760e631", "basis": "body" } } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:a0c5705d-19c0-454f-8bb9-e100e74e02a4", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-06T01:30:38.377Z", "credentialSubject": { "id": "urn:sha256:182ea8227f6a5e9f9c992902abd55ef467721f3b3885820db29960947f154455", "agent": "cra-readiness", "endpoint": "POST /api/v1/pipelines/cra-readiness", "outputDigest": { "alg": "sha256", "value": "182ea8227f6a5e9f9c992902abd55ef467721f3b3885820db29960947f154455", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "4abea584f587ba02703fe80fcb699f75a4f118f2d4c7ca3f7b637f404070cf08", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "49271c6b952840a962ec8386538ee48cf754b3534cb200261d432922793378ca", "canonicalization": "JCS" }, "ingredients": [ { "url": "https://api.github.com/repos/star7th/htq/commits/HEAD", "sha256": "4bd55e22578cbe3b02e15b73bcb3d6f24c81e015ed9b9cfaddb1ca41f760e631" }, { "url": "https://api.github.com/repos/star7th/htq/git/trees/c64ac96becf9d0003774094bc5ff192bec8c70be?recursive=1", "sha256": "e43c95e9a6f0f020ba2a4c998d85d9a0c0820581d639df1b4ce4be1cdbd89d20" }, { "url": "https://raw.githubusercontent.com/star7th/htq/c64ac96becf9d0003774094bc5ff192bec8c70be/package.json", "sha256": "49a697a13dcb6037bcd30929f6db6ede495891f6fa6b9b43a172f0ec8d8c6c96" } ], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-06T01:30:38.377Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "z3No9XZB79FNwriUcjY9HzyhoVpqBFLArVGUY8vM7Uc4kpBtinT4uYoUy73wPSusx6odQbobVjYYo587UwtmjY7Y" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:ac661a608da98ab7c230d7f838f2e6c1ef14568e931875836f0fb8b95d516479", "signature": "0x626dde5129d635404e66889df6df34a92eb46bddc8a076a7e99d019ba378c9ad7481577e9500abd20d4ae7cf50cf707bf0af77b0282a2712544363ca187773851c" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/cra-readiness/", "description": "Documentation for EU CRA Readiness Check: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "cra-readiness: unknown field is rejected", "method": "POST", "path": "/v1/pipelines/cra-readiness", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "cra-readiness: example returns a signed result", "method": "POST", "path": "/v1/pipelines/cra-readiness", "body": { "repo": "star7th/htq", "product": { "name": "htq" } }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "readiness": { "type": "string", "enum": [ "REPORTABLE_CANDIDATES", "NO_EXPLOITED_EVIDENCE", "INSUFFICIENT_EVIDENCE", "NO_RESOLVED_VERSIONS" ] }, "fixPlan": { "type": "array", "items": { "type": "object" } }, "deadlines": { "type": [ "object", "null" ] }, "nextStep": {}, "unresolved": { "type": "array", "items": { "type": "object" } }, "results": { "type": "object" }, "steps": { "type": "object" }, "partial": { "type": "boolean" }, "missing": { "type": "array", "items": { "type": "object" } }, "deterministic": { "type": "boolean" } }, "required": [ "results", "steps", "partial", "missing", "deterministic" ] }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/cra-exploit-clock": { "post": { "operationId": "craExploitClock", "summary": "EU CRA Exploited Vulnerability Clock", "description": "`POST /v1/cra-exploit-clock`\n\nTakes a CycloneDX or SPDX SBOM or a purl list, finds advisories for each exact component version through OSV.dev, checks each CVE against CISA KEV and ENISA EUVD and adds EPSS scores. Returns a per-component verdict with evidence and the Regulation (EU) 2024/2847 Article 14 reporting dates computed in UTC from the awareness time you supply.\n\n**What you get:** Shows which SBOM components carry vulnerabilities listed as exploited by CISA or ENISA, and the 24 h, 72 h and 14-day Art. 14 dates from your awareness time.\n\n### Use it for\n\n- Check an SBOM against CISA Known Exploited Vulnerabilities and the ENISA exploited-vulnerability index.\n- Compute the Article 14 reporting dates from the time you became aware of an exploited vulnerability.\n- Attach per-component evidence with source URLs and SHA-256 digests to a compliance file.\n\n### Details and limits\n\nTakes a CycloneDX or SPDX JSON SBOM (or a purl list), asks OSV.dev for the advisories that affect each exact component version (OSV evaluates the version ranges per ecosystem), then checks each CVE against the CISA Known Exploited Vulnerabilities catalog and the ENISA EUVD exploited-vulnerability index, and adds FIRST EPSS scores. Returns a per-component verdict, the evidence with source URLs and SHA-256 digests, and the Regulation (EU) 2024/2847 Article 14(2) dates computed in UTC from the awareness time and fix time you supply: early warning within 24 h, notification within 72 h, final report 14 days after a corrective or mitigating measure is available. Also drafts Art. 14(2) content from quoted feed text. Reports evidence and arithmetic, not a legal conclusion. Not legal advice: whether a vulnerability is actively exploited, when you became aware, and what to notify are your determination. A separate standalone awareness record is added only when issue_record is true; every response is in any case a hub-signed credential over its output and input digests. Fan-out is capped (1000 components, 120 advisory records); EUVD is checked per CVE up to 20 CVEs and above that by one read of its whole exploited list; partial results name what is missing. Deterministic, no model call.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `sbom` | one of several | no | CycloneDX 1.4-1.6 or SPDX 2.2/2.3 JSON SBOM, as an object or a JSON string, up to 5 MB. Components need a purl with a version (SPDX: a purl externalRef). Exactly one of sbom or purls. |\n| `purls` | array of string | no | Alternative to sbom: versioned package URLs, e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Ecosystems: npm, pypi, maven, golang, cargo, nuget, gem, composer, hex, pub, swift. |\n| `product` | object | no | Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name). |\n| `awareness_time` | string | no | When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it. |\n| `fix_available_at` | string | no | When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date. |\n| `issue_record` | boolean | no | Default false. When true, adds a standalone awareness_record (evidence snapshot, SBOM digest, evaluation time; signed with the hub attestation key when configured) for you to retain. It does not switch off the hub's standard signed response credential, which every response carries and which already binds the output and input digests to a timestamp. |\n\n### Example request body\n\n```json\n{\n \"sbom\": {\n \"bomFormat\": \"CycloneDX\",\n \"specVersion\": \"1.5\",\n \"version\": 1,\n \"metadata\": {\n \"component\": {\n \"type\": \"application\",\n \"name\": \"acme-gateway\",\n \"version\": \"3.2.0\"\n }\n },\n \"components\": [\n {\n \"type\": \"library\",\n \"bom-ref\": \"log4j-core\",\n \"group\": \"org.apache.logging.log4j\",\n \"name\": \"log4j-core\",\n \"version\": \"2.14.1\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"lodash\",\n \"name\": \"lodash\",\n \"version\": \"4.17.15\",\n \"purl\": \"pkg:npm/lodash@4.17.15\"\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"left-pad\",\n \"name\": \"left-pad\",\n \"version\": \"1.3.0\",\n \"purl\": \"pkg:npm/left-pad@1.3.0\"\n }\n ]\n },\n \"product\": {\n \"name\": \"acme-gateway\",\n \"version\": \"3.2.0\"\n }\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/cra-exploit-clock\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"sbom\":{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"version\":1,\"metadata\":{\"component\":{\"type\":\"application\",\"name\":\"acme-gateway\",\"version\":\"3.2.0\"}},\"components\":[{\"type\":\"library\",\"bom-ref\":\"log4j-core\",\"group\":\"org.apache.logging.log4j\",\"name\":\"log4j-core\",\"version\":\"2.14.1\",\"purl\":\"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"},{\"type\":\"library\",\"bom-ref\":\"lodash\",\"name\":\"lodash\",\"version\":\"4.17.15\",\"purl\":\"pkg:npm/lodash@4.17.15\"},{\"type\":\"library\",\"bom-ref\":\"left-pad\",\"name\":\"left-pad\",\"version\":\"1.3.0\",\"purl\":\"pkg:npm/left-pad@1.3.0\"}]},\"product\":{\"name\":\"acme-gateway\",\"version\":\"3.2.0\"}}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `verdict` | enum | NO_EXPLOITED_EVIDENCE only when every SBOM entry was fully checked. |\n| `confidence` | object | {score 0-1, label}: 0.95 with a CISA KEV listing, 0.85 EUVD only, 0.9 for absence, else 0.5 times the share of entries with a definitive answer. |\n| `exposure` | object | Art. 64(2) fine ceiling for breaching Art. 13/14: EUR 15 000 000 or 2.5% of worldwide turnover, whichever is higher. A ceiling, not an estimate. |\n| `next_step` | object | {code: ASSESS_AND_SUBMIT_EARLY_WARNING \\| RESOLVE_EVIDENCE_GAPS \\| MONITOR_FEEDS, by, detail}. |\n| `top_evidence` | array of object | Top evidence, a list of objects. |\n| `summary` | string | Summary. |\n| `not_legal_advice` | string | Caveat: evidence and arithmetic only; the 'actively exploited' and 'aware' determinations are the manufacturer's. |\n| `awareness` | object | {time, source: caller \\| evaluation_time, attested, note}. A caller-supplied time is never attested unless issue_record is true, and even then it is recorded as caller-asserted. |\n| `deadlines` | object | early_warning_due (+24 h), notification_due (+72 h), final_report_due (fix_available_at + 14 days, or null), hours remaining at evaluation, applies (exploitation evidence found and awareness on or after the 2026-09-11 application date of Art. 14, Art. 71(2)), and legal_basis citing Regulation (EU) 2024/2847 Art. 14(2) with the source URL. |\n| `sbom` | object | format, spec_version, sha256, bytes, entries, evaluated, skipped[{ref, name, reason}]. |\n| `counts` | object | Entries per component verdict. |\n| `exploited_vulnerabilities` | array of object | Exploited vulnerabilities, a list of objects. |\n| `components` | array of object | Components, a list of objects. |\n| `art14_draft_fields` | array of object | Art14 draft fields, a list of objects. |\n| `feed_snapshots` | object | KEV catalog version and release date, EPSS score date, EUVD and OSV query times. |\n| `sources` | array of object | Sources, a list of objects. |\n| `coverage` | object | complete, missing[], upstream_calls, elapsed_ms. Partial results name what is missing. |\n| `awareness_record` | object, nullable | Null unless issue_record is true (the response credential is signed regardless). When present: evaluated_at, awareness_time and its source, sbom_sha256, exploited CVEs, feed snapshots, source digests, digest_sha256 and an optional signature. |\n| `deterministic` | boolean | Deterministic, true or false. |\n| `product` | object | Product, an object. |\n| `exploited_vulnerabilities_truncated` | boolean | Exploited vulnerabilities truncated, true or false. |\n| `would_change_verdict` | array of items | Would change verdict, a list of items. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"deterministic\": true,\n \"verdict\": \"EXPLOITED_CANDIDATES_FOUND\",\n \"confidence\": {\n \"score\": 0.95,\n \"label\": \"high\"\n },\n \"exposure\": {\n \"article\": \"Art. 64(2)\",\n \"max_administrative_fine_eur\": 15000000,\n \"max_turnover_percent\": 2.5,\n \"note\": \"Ceiling for non-compliance with Art. 13 and 14 (whichever is higher for an undertaking); not an estimate of any penalty.\"\n },\n \"next_step\": {\n \"code\": \"ASSESS_AND_SUBMIT_EARLY_WARNING\",\n \"by\": \"2026-11-07T17:57:03.937Z\",\n \"detail\": \"Confirm with counsel whether the listed CVEs are actively exploited vulnerabilities in your product, and if so submit the Art. 14(2)(a) early warning by 2026...\"\n },\n \"top_evidence\": [\n {\n \"cve\": \"CVE-2021-44228\",\n \"component\": \"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\",\n \"sources\": [\n \"...\",\n \"...\",\n \"...\"\n ]\n },\n {\n \"cve\": \"CVE-2021-45046\",\n \"component\": \"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\",\n \"sources\": [\n \"...\",\n \"...\",\n \"...\"\n ]\n }\n ],\n \"summary\": \"2 CVE(s) with exploitation evidence (CISA KEV or ENISA EUVD) affect 1 of 3 SBOM entries. Early warning would be due 2026-11-07T17:57:03.937Z and notification...\",\n \"not_legal_advice\": \"Not legal advice. This report lists feed evidence and arithmetic on the timestamps you supply. Whether a vulnerability is 'actively exploited' under Art. 3(4...\",\n \"product\": {\n \"name\": \"acme-gateway\",\n \"version\": \"3.2.0\"\n },\n \"sbom\": {\n \"format\": \"CycloneDX\",\n \"spec_version\": \"1.5\",\n \"sha256\": \"3e3400a9d44b720ad65005087362253a88ab59033702c5caeb9025662d33f2b0\",\n \"bytes\": 552,\n \"entries\": 3,\n \"evaluated\": 3,\n \"skipped\": []\n },\n \"awareness\": {\n \"time\": \"2026-11-06T17:57:03.937Z\",\n \"source\": \"evaluation_time\",\n \"attested\": false,\n \"note\": \"awareness_time defaulted to the evaluation time.\"\n },\n \"deadlines\": {\n \"early_warning_due\": \"2026-11-07T17:57:03.937Z\",\n \"notification_due\": \"2026-11-09T17:57:03.937Z\",\n \"final_report_due\": null,\n \"final_report_basis\": \"Not computable: runs 14 days from the time a corrective or mitigating measure is available (fix_available_at not supplied).\",\n \"early_warning_hours_remaining\": 24,\n \"notification_hours_remaining\": 72,\n \"final_report_hours_remaining\": null,\n \"applies\": true,\n \"art14_in_force_at_awareness\": true,\n \"evaluated_at\": \"2026-11-06T17:57:06.580Z\",\n \"legal_basis\": {\n \"regulation\": \"Regulation (EU) 2024/2847 (Cyber Resilience Act)\",\n \"article\": \"Article 14(2)\",\n \"source_url\": \"https://eur-lex.europa.eu/eli/reg/2024/2847/oj\",\n \"applies_from\": \"2026-09-11\",\n \"applies_from_basis\": \"Art. 71(2): Article 14 shall apply from 11 September 2026.\",\n \"early_warning\": \"Art. 14(2)(a): early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer be...\",\n \"notification\": \"Art. 14(2)(b): vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware, unless the relevant infor...\",\n \"final_report\": \"Art. 14(2)(c): final report no later than 14 days after a corrective or mitigating measure is available, unless the relevant information has already been pro...\",\n \"severe_incident_final_report\": \"Art. 14(4)(c): for a severe incident the final report is due within one month after the submission of the incident notification under Art. 14(4)(b); this age...\",\n \"actively_exploited_definition\": \"Art. 3(42): a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner.\"\n }\n },\n \"counts\": {\n \"EXPLOITED_REPORTABLE_CANDIDATE\": 1,\n \"KNOWN_VULN_NOT_EXPLOITED\": 1,\n \"NO_MATCH\": 1,\n \"INSUFFICIENT_EVIDENCE\": 0\n },\n \"exploited_vulnerabilities\": [\n {\n \"cve\": \"CVE-2021-44228\",\n \"components\": [\n \"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"\n ],\n \"kev\": \"...\",\n \"euvd\": \"...\",\n \"epss\": \"...\",\n \"earliest_exploitation_evidence_date\": \"2021-12-10\",\n \"osv_advisories\": [\n \"...\"\n ],\n \"source_refs\": [\n \"cisa-kev\",\n \"enisa-euvd\",\n \"osv.dev\"\n ]\n },\n {\n \"cve\": \"CVE-2021-45046\",\n \"components\": [\n \"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"\n ],\n \"kev\": \"...\",\n \"euvd\": \"...\",\n \"epss\": \"...\",\n \"earliest_exploitation_evidence_date\": \"2023-05-01\",\n \"osv_advisories\": [\n \"...\"\n ],\n \"source_refs\": [\n \"cisa-kev\",\n \"enisa-euvd\",\n \"osv.dev\"\n ]\n }\n ]\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/cra-exploit-clock/\nMachine-readable input and result schemas: https://writerslogic.com/agents/cra-exploit-clock.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/cra-exploit-clock", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "sbom": { "description": "CycloneDX 1.4-1.6 or SPDX 2.2/2.3 JSON SBOM, as an object or a JSON string, up to 5 MB. Components need a purl with a version (SPDX: a purl externalRef). Exactly one of sbom or purls.", "anyOf": [ { "type": "object" }, { "type": "string", "maxLength": 5000000 } ] }, "purls": { "type": "array", "maxItems": 1000, "items": { "type": "string", "minLength": 8, "maxLength": 400 }, "description": "Alternative to sbom: versioned package URLs, e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Ecosystems: npm, pypi, maven, golang, cargo, nuget, gem, composer, hex, pub, swift." }, "product": { "type": "object", "additionalProperties": false, "required": [ "name" ], "description": "Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200, "description": "Name. Up to 200 characters." }, "version": { "type": "string", "maxLength": 100, "description": "Version. Up to 100 characters." } } }, "awareness_time": { "type": "string", "maxLength": 40, "description": "When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it." }, "fix_available_at": { "type": "string", "maxLength": 40, "description": "When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date." }, "issue_record": { "type": "boolean", "description": "Default false. When true, adds a standalone awareness_record (evidence snapshot, SBOM digest, evaluation time; signed with the hub attestation key when configured) for you to retain. It does not switch off the hub's standard signed response credential, which every response carries and which already binds the output and input digests to a timestamp." } }, "description": "Input payload for CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock. Required fields: none. Optional fields: `sbom`, `purls`, `product`, `awareness_time`, `fix_available_at`, `issue_record`.", "externalDocs": { "url": "https://writerslogic.com/agents/cra-exploit-clock.json", "description": "Machine-readable record for CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock", "description": "A complete valid request body for EU CRA Exploited Vulnerability Clock.", "value": { "sbom": { "bomFormat": "CycloneDX", "specVersion": "1.5", "version": 1, "metadata": { "component": { "type": "application", "name": "acme-gateway", "version": "3.2.0" } }, "components": [ { "type": "library", "bom-ref": "log4j-core", "group": "org.apache.logging.log4j", "name": "log4j-core", "version": "2.14.1", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" }, { "type": "library", "bom-ref": "lodash", "name": "lodash", "version": "4.17.15", "purl": "pkg:npm/lodash@4.17.15" }, { "type": "library", "bom-ref": "left-pad", "name": "left-pad", "version": "1.3.0", "purl": "pkg:npm/left-pad@1.3.0" } ] }, "product": { "name": "acme-gateway", "version": "3.2.0" } } } } } }, "description": "JSON request body for CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock. Required fields: none. Optional fields: `sbom`, `purls`, `product`, `awareness_time`, `fix_available_at`, `issue_record`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "EXPLOITED_CANDIDATES_FOUND", "NO_EXPLOITED_EVIDENCE", "INSUFFICIENT_EVIDENCE" ], "description": "NO_EXPLOITED_EVIDENCE only when every SBOM entry was fully checked." }, "confidence": { "type": "object", "description": "{score 0-1, label}: 0.95 with a CISA KEV listing, 0.85 EUVD only, 0.9 for absence, else 0.5 times the share of entries with a definitive answer." }, "exposure": { "type": "object", "description": "Art. 64(2) fine ceiling for breaching Art. 13/14: EUR 15 000 000 or 2.5% of worldwide turnover, whichever is higher. A ceiling, not an estimate." }, "next_step": { "type": "object", "description": "{code: ASSESS_AND_SUBMIT_EARLY_WARNING | RESOLVE_EVIDENCE_GAPS | MONITOR_FEEDS, by, detail}." }, "top_evidence": { "type": "array", "items": { "type": "object", "description": "Up to 5 exploited CVEs, each with the sources behind it: {cve, component, sources[{source, url, sha256}]}. The sha256 is of the response body fetched from that url." }, "description": "Top evidence, a list of objects." }, "summary": { "type": "string", "description": "Summary." }, "not_legal_advice": { "type": "string", "description": "Caveat: evidence and arithmetic only; the 'actively exploited' and 'aware' determinations are the manufacturer's." }, "awareness": { "type": "object", "description": "{time, source: caller | evaluation_time, attested, note}. A caller-supplied time is never attested unless issue_record is true, and even then it is recorded as caller-asserted." }, "deadlines": { "type": "object", "description": "early_warning_due (+24 h), notification_due (+72 h), final_report_due (fix_available_at + 14 days, or null), hours remaining at evaluation, applies (exploitation evidence found and awareness on or after the 2026-09-11 application date of Art. 14, Art. 71(2)), and legal_basis citing Regulation (EU) 2024/2847 Art. 14(2) with the source URL." }, "sbom": { "type": "object", "description": "format, spec_version, sha256, bytes, entries, evaluated, skipped[{ref, name, reason}]." }, "counts": { "type": "object", "description": "Entries per component verdict." }, "exploited_vulnerabilities": { "type": "array", "items": { "type": "object", "description": "Per CVE: components, kev entry (date_added, ransomware use), euvd record (id, exploited_since, url), epss, earliest_exploitation_evidence_date, osv_advisories with URLs." }, "description": "Exploited vulnerabilities, a list of objects." }, "components": { "type": "array", "items": { "type": "object", "description": "Per entry: purl, verdict (EXPLOITED_REPORTABLE_CANDIDATE | KNOWN_VULN_NOT_EXPLOITED | NO_MATCH | INSUFFICIENT_EVIDENCE), affected_range_match (OSV_AFFECTED | OSV_NOT_AFFECTED | NOT_EVALUATED), advisories[], kev, kev_date_added, epss, euvd_exploited, evidence_gaps. Skipped entries carry reason instead." }, "description": "Components, a list of objects." }, "art14_draft_fields": { "type": "array", "items": { "type": "object", "description": "Draft Art. 14(2)(a)-(c) content per exploited CVE, quoted from feed text with source URLs; a draft, never a filing." }, "description": "Art14 draft fields, a list of objects." }, "feed_snapshots": { "type": "object", "description": "KEV catalog version and release date, EPSS score date, EUVD and OSV query times." }, "sources": { "type": "array", "items": { "type": "object", "description": "Per feed: url, status, requests, sha256 (a single response body, or a digest over every request's url and hash), fetched_at, errors." }, "description": "Sources, a list of objects." }, "coverage": { "type": "object", "description": "complete, missing[], upstream_calls, elapsed_ms. Partial results name what is missing." }, "awareness_record": { "type": "object", "description": "Null unless issue_record is true (the response credential is signed regardless). When present: evaluated_at, awareness_time and its source, sbom_sha256, exploited CVEs, feed snapshots, source digests, digest_sha256 and an optional signature.", "nullable": true }, "deterministic": { "type": "boolean", "description": "Deterministic, true or false." }, "product": { "type": "object", "description": "Product, an object." }, "exploited_vulnerabilities_truncated": { "type": "boolean", "description": "Exploited vulnerabilities truncated, true or false." }, "would_change_verdict": { "type": "array", "items": {}, "description": "Would change verdict, a list of items." } }, "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "deterministic": true, "verdict": "EXPLOITED_CANDIDATES_FOUND", "confidence": { "score": 0.95, "label": "high" }, "exposure": { "article": "Art. 64(2)", "max_administrative_fine_eur": 15000000, "max_turnover_percent": 2.5, "note": "Ceiling for non-compliance with Art. 13 and 14 (whichever is higher for an undertaking); not an estimate of any penalty." }, "next_step": { "code": "ASSESS_AND_SUBMIT_EARLY_WARNING", "by": "2026-11-07T17:57:03.937Z", "detail": "Confirm with counsel whether the listed CVEs are actively exploited vulnerabilities in your product, and if so submit the Art. 14(2)(a) early warning by 2026-11-07T17:57:03.937Z (24 h from now) via the single reporting platform." }, "top_evidence": [ { "cve": "CVE-2021-44228", "component": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "sources": [ { "source": "cisa-kev", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "sha256": "273b7e449828f0af92e012bf03270a6a6c3deb21dc7a50b46ebe0447ea196bff" }, { "source": "enisa-euvd", "url": "https://euvdservices.enisa.europa.eu/api/search?exploited=true&size=5&text=CVE-2021-44228", "sha256": "03316fed481f067fb93d8ee20d6afbc95d2dc2b28cfecc2d7c9f05b3a1f2a92a" }, { "source": "osv.dev", "url": "https://api.osv.dev/v1/vulns/GHSA-jfh8-c2jp-5v3q", "sha256": "901770305f9a6e38f4cf38dd42d9c8a44e696b319c2b1769f4fe4b3a102f608e" } ] }, { "cve": "CVE-2021-45046", "component": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "sources": [ { "source": "cisa-kev", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "sha256": "273b7e449828f0af92e012bf03270a6a6c3deb21dc7a50b46ebe0447ea196bff" }, { "source": "enisa-euvd", "url": "https://euvdservices.enisa.europa.eu/api/search?exploited=true&size=5&text=CVE-2021-45046", "sha256": "710af6e697cb89f890e525e611e7e1f16871df6186b3f2ad0919d1b0b51ed87a" }, { "source": "osv.dev", "url": "https://api.osv.dev/v1/vulns/GHSA-7rjr-3q55-vv33", "sha256": "d4f6b0f5e1dcb149ccdccd2260e3d91266feb91a7bd8fb5107319c71ddb662a6" } ] } ], "summary": "2 CVE(s) with exploitation evidence (CISA KEV or ENISA EUVD) affect 1 of 3 SBOM entries. Early warning would be due 2026-11-07T17:57:03.937Z and notification 2026-11-09T17:57:03.937Z if awareness is 2026-11-06T17:57:03.937Z. Evidence only, not a legal conclusion.", "not_legal_advice": "Not legal advice. This report lists feed evidence and arithmetic on the timestamps you supply. Whether a vulnerability is 'actively exploited' under Art. 3(42), when the manufacturer 'became aware', and what must be notified are determinations for the manufacturer and its counsel.", "product": { "name": "acme-gateway", "version": "3.2.0" }, "sbom": { "format": "CycloneDX", "spec_version": "1.5", "sha256": "3e3400a9d44b720ad65005087362253a88ab59033702c5caeb9025662d33f2b0", "bytes": 552, "entries": 3, "evaluated": 3, "skipped": [] }, "awareness": { "time": "2026-11-06T17:57:03.937Z", "source": "evaluation_time", "attested": false, "note": "awareness_time defaulted to the evaluation time." }, "deadlines": { "early_warning_due": "2026-11-07T17:57:03.937Z", "notification_due": "2026-11-09T17:57:03.937Z", "final_report_due": null, "final_report_basis": "Not computable: runs 14 days from the time a corrective or mitigating measure is available (fix_available_at not supplied).", "early_warning_hours_remaining": 24, "notification_hours_remaining": 72, "final_report_hours_remaining": null, "applies": true, "art14_in_force_at_awareness": true, "evaluated_at": "2026-11-06T17:57:06.580Z", "legal_basis": { "regulation": "Regulation (EU) 2024/2847 (Cyber Resilience Act)", "article": "Article 14(2)", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj", "applies_from": "2026-09-11", "applies_from_basis": "Art. 71(2): Article 14 shall apply from 11 September 2026.", "early_warning": "Art. 14(2)(a): early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it.", "notification": "Art. 14(2)(b): vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware, unless the relevant information has already been provided.", "final_report": "Art. 14(2)(c): final report no later than 14 days after a corrective or mitigating measure is available, unless the relevant information has already been provided.", "severe_incident_final_report": "Art. 14(4)(c): for a severe incident the final report is due within one month after the submission of the incident notification under Art. 14(4)(b); this agent evaluates vulnerabilities only and computes no incident clock.", "actively_exploited_definition": "Art. 3(42): a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner." } }, "counts": { "EXPLOITED_REPORTABLE_CANDIDATE": 1, "KNOWN_VULN_NOT_EXPLOITED": 1, "NO_MATCH": 1, "INSUFFICIENT_EVIDENCE": 0 }, "exploited_vulnerabilities": [ { "cve": "CVE-2021-44228", "components": [ "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" ], "kev": { "cve": "CVE-2021-44228", "date_added": "2021-12-10", "vendor_project": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Remote Code Execution Vulnerability", "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.", "known_ransomware_campaign_use": "Known", "catalog_version": "2026.11.04", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "euvd": { "euvd_id": "EUVD-2021-34768", "exploited_since": "2021-12-10", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34768" }, "epss": { "epss": 0.99999, "percentile": 1, "date": "2026-11-06" }, "earliest_exploitation_evidence_date": "2021-12-10", "osv_advisories": [ { "id": "GHSA-jfh8-c2jp-5v3q", "url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" } ], "source_refs": [ "cisa-kev", "enisa-euvd", "osv.dev" ] }, { "cve": "CVE-2021-45046", "components": [ "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" ], "kev": { "cve": "CVE-2021-45046", "date_added": "2023-05-01", "vendor_project": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Deserialization of Untrusted Data Vulnerability", "short_description": "Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.", "known_ransomware_campaign_use": "Known", "catalog_version": "2026.11.04", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "euvd": { "euvd_id": "EUVD-2021-34769", "exploited_since": "2023-05-01", "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34769" }, "epss": { "epss": 0.99977, "percentile": 0.99979, "date": "2026-11-06" }, "earliest_exploitation_evidence_date": "2023-05-01", "osv_advisories": [ { "id": "GHSA-7rjr-3q55-vv33", "url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" } ], "source_refs": [ "cisa-kev", "enisa-euvd", "osv.dev" ] } ], "exploited_vulnerabilities_truncated": false, "components": [ { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "ref": "log4j-core", "verdict": "EXPLOITED_REPORTABLE_CANDIDATE", "affected_range_match": "OSV_AFFECTED", "advisory_count": 8, "advisories": [ { "id": "GHSA-7rjr-3q55-vv33", "cve_ids": [ "CVE-2021-45046" ], "summary": "Incomplete fix for Apache Log4j vulnerability", "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "fixed_versions": [ "2.16.0", "2.12.2", "2.3.1" ], "exploited": true, "url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" }, { "id": "GHSA-jfh8-c2jp-5v3q", "cve_ids": [ "CVE-2021-44228" ], "summary": "Remote code injection in Log4j", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H", "fixed_versions": [ "2.15.0", "2.3.1", "2.12.2" ], "exploited": true, "url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" }, { "id": "GHSA-3pxv-7cmr-fjr4", "cve_ids": [ "CVE-2026-34480" ], "summary": "Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "fixed_versions": [ "2.25.4" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-3pxv-7cmr-fjr4" } ], "advisories_truncated": false, "advisories_without_cve": 0, "exploited_cves": [ "CVE-2021-45046", "CVE-2021-44228" ], "kev": true, "kev_date_added": "2021-12-10", "euvd_exploited": true, "epss": 0.99999, "evidence_gaps": [] }, { "purl": "pkg:npm/lodash@4.17.15", "ref": "lodash", "verdict": "KNOWN_VULN_NOT_EXPLOITED", "affected_range_match": "OSV_AFFECTED", "advisory_count": 5, "advisories": [ { "id": "GHSA-29mw-wpgm-hmr9", "cve_ids": [ "CVE-2020-28500" ], "summary": "Regular Expression Denial of Service (ReDoS) in lodash", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "fixed_versions": [ "4.17.21" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9" }, { "id": "GHSA-35jh-r3h4-6jhm", "cve_ids": [ "CVE-2021-23337" ], "summary": "Command Injection in lodash", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "fixed_versions": [ "4.17.21" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm" }, { "id": "GHSA-p6mc-m468-83gw", "cve_ids": [ "CVE-2020-8203" ], "summary": "Prototype Pollution in lodash", "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "fixed_versions": [ "4.17.19" ], "exploited": false, "url": "https://osv.dev/vulnerability/GHSA-p6mc-m468-83gw" } ], "advisories_truncated": false, "advisories_without_cve": 0, "exploited_cves": [], "kev": false, "kev_date_added": null, "euvd_exploited": false, "epss": 0.21333, "evidence_gaps": [] }, { "purl": "pkg:npm/left-pad@1.3.0", "ref": "left-pad", "verdict": "NO_MATCH", "affected_range_match": "OSV_NOT_AFFECTED", "advisory_count": 0, "advisories": [], "advisories_truncated": false, "advisories_without_cve": 0, "exploited_cves": [], "kev": false, "kev_date_added": null, "euvd_exploited": false, "epss": null, "evidence_gaps": [] } ], "art14_draft_fields": [ { "label": "DRAFT: assembled from quoted feed text; review before use. The ENISA single reporting platform's form fields were not verified, so content is keyed to Art. 14(2).", "vulnerability": "CVE-2021-44228", "art14_2a_early_warning": { "product": { "name": "acme-gateway", "version": "3.2.0" }, "actively_exploited_vulnerability": "CVE-2021-44228", "member_states_where_product_made_available": null, "note_member_states": "Supply the Member States; this agent cannot know where the product is placed on the market." }, "art14_2b_notification": { "general_nature_of_vulnerability": { "text": "Remote code injection in Log4j", "source_url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" }, "general_nature_of_exploit": { "text": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "affected_components": [ "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" ], "corrective_or_mitigating_measures_available": [ { "fixed_version": "2.15.0", "source_url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" }, { "fixed_version": "2.3.1", "source_url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" }, { "fixed_version": "2.12.2", "source_url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" } ], "corrective_measures_note": "OSV lists one fixed version per maintained branch; the one for your branch applies.", "sensitivity_of_information": null }, "art14_2c_final_report": { "severity": { "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H", "source_url": "https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q" }, "malicious_actor_information": { "cisa_known_ransomware_campaign_use": "Known", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "euvd_reference": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34768" } }, { "label": "DRAFT: assembled from quoted feed text; review before use. The ENISA single reporting platform's form fields were not verified, so content is keyed to Art. 14(2).", "vulnerability": "CVE-2021-45046", "art14_2a_early_warning": { "product": { "name": "acme-gateway", "version": "3.2.0" }, "actively_exploited_vulnerability": "CVE-2021-45046", "member_states_where_product_made_available": null, "note_member_states": "Supply the Member States; this agent cannot know where the product is placed on the market." }, "art14_2b_notification": { "general_nature_of_vulnerability": { "text": "Incomplete fix for Apache Log4j vulnerability", "source_url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" }, "general_nature_of_exploit": { "text": "Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "affected_components": [ "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" ], "corrective_or_mitigating_measures_available": [ { "fixed_version": "2.16.0", "source_url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" }, { "fixed_version": "2.12.2", "source_url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" }, { "fixed_version": "2.3.1", "source_url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" } ], "corrective_measures_note": "OSV lists one fixed version per maintained branch; the one for your branch applies.", "sensitivity_of_information": null }, "art14_2c_final_report": { "severity": { "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "source_url": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33" }, "malicious_actor_information": { "cisa_known_ransomware_campaign_use": "Known", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "euvd_reference": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34769" } } ], "feed_snapshots": { "osv": { "queried_at": "2026-11-06T17:57:04.548Z", "components_queried": 3 }, "cisa_kev": { "catalog_version": "2026.11.04", "date_released": "2026-11-04T20:00:05.774Z", "entries": 1768 }, "first_epss": { "score_date": "2026-11-06", "cves_scored": 13 }, "enisa_euvd": { "cves_checked": 13, "cves_with_exploitation_record": 2 } }, "sources": [ { "name": "osv.dev", "role": "Version-aware advisory matching (querybatch by purl and version) and advisory records", "status": "ok", "url": "https://api.osv.dev/v1/querybatch", "requests": 14, "sha256": "02cbd2d9650394aa8b7c55d563149b1f0e6d957b0fc5f08ff63b84686ab67f66", "digest_basis": "sha256 over the lines '\\t' of every request in order", "fetched_at": "2026-11-06T17:57:04.829Z", "errors": [], "failed_requests": 0 }, { "name": "cisa-kev", "role": "Known Exploited Vulnerabilities catalog", "status": "ok", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "requests": 1, "sha256": "273b7e449828f0af92e012bf03270a6a6c3deb21dc7a50b46ebe0447ea196bff", "digest_basis": "response body", "fetched_at": "2026-11-06T17:57:04.036Z", "errors": [], "failed_requests": 0 }, { "name": "first-epss", "role": "Exploit Prediction Scoring System scores", "status": "ok", "url": "https://api.first.org/data/v1/epss?limit=100&cve=CVE-2020-28500,CVE-2020-8203,CVE-2021-23337,CVE-2021-44228,CVE-2021-44832,CVE-2021-45046,CVE-2021-45105,CVE-2025-13465,CVE-2025-68161,CVE-2026-34477,CVE-2026-34479,CVE-2026-34480,CVE-2026-4800", "requests": 1, "sha256": "f9b174e37e338f37b126e0a0367075ccc9c75a4cbe5e96225a77e39c445e1d63", "digest_basis": "response body", "fetched_at": "2026-11-06T17:57:05.184Z", "errors": [], "failed_requests": 0 } ], "coverage": { "complete": true, "missing": [], "upstream_calls": 29, "deadline_ms": 45000, "elapsed_ms": 2643 }, "awareness_record": null, "would_change_verdict": [ "A new KEV or EUVD entry for an advisory matched to a component.", "Versioned purls for skipped entries.", "A rerun after missing feeds recover (see coverage.missing)." ] }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:3659e067-bd55-444b-bbc6-c97fe967bc39", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-06T17:57:06.580Z", "softwareAgent": { "name": "writerslogic-agent-hub/cra-exploit-clock", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia", "parameters": { "endpoint": "POST /api/v1/cra-exploit-clock", "inputDigest": { "alg": "sha256", "hash": "3a527f595efee540578ff40a0fd9e446f785edbc585bbdb77260c60f93890d02", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "3b0f179898cb3c67dd1d382ddde06005692eb4194f5379d1b55b233e48c7ab3b", "name": "jcs-canonical-json(data)" } }, { "label": "c2pa.ingredient.v3", "data": { "title": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "format": "application/json", "relationship": "inputTo", "dc": { "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "date": "2026-11-06T17:57:04.036Z" }, "hash": { "alg": "sha256", "hash": "273b7e449828f0af92e012bf03270a6a6c3deb21dc7a50b46ebe0447ea196bff", "basis": "body" } } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:d0054b53-801d-4cec-ad67-b968cf6463e6", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-06T17:57:06.580Z", "credentialSubject": { "id": "urn:sha256:3b0f179898cb3c67dd1d382ddde06005692eb4194f5379d1b55b233e48c7ab3b", "agent": "cra-exploit-clock", "endpoint": "POST /api/v1/cra-exploit-clock", "outputDigest": { "alg": "sha256", "value": "3b0f179898cb3c67dd1d382ddde06005692eb4194f5379d1b55b233e48c7ab3b", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "3a527f595efee540578ff40a0fd9e446f785edbc585bbdb77260c60f93890d02", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "4f6d20fa7088f530447a5225f04aa05e75ddb3b3582e6227a75c0640179b27c9", "canonicalization": "JCS" }, "ingredients": [ { "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "sha256": "273b7e449828f0af92e012bf03270a6a6c3deb21dc7a50b46ebe0447ea196bff" }, { "url": "https://api.osv.dev/v1/querybatch", "sha256": "69d35a47d60807ecca2d0263f76b792bfb497b8a2b21fb45d689c907905076ed" }, { "url": "https://api.osv.dev/v1/vulns/GHSA-3pxv-7cmr-fjr4", "sha256": "1eb0bb16e67a035871b41fe02bf42ac562254dd9df42f4d051f927b78ad77f9b" } ], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-06T17:57:06.580Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "z48anfqTcWF6tbqTq6WhbLnyW8htRnLTYh5vkZUncVFc2kSAkUc7yLZ5VmwxCb9SzVKcLz1TSs4tGw64xeYo2EtHk" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:1bfcec8c681712e391a7e29f96b2647257eebac6640790c2952379bbc5522402", "signature": "0x69e71d453a4fdbc6d5b3870587e5c96a8658f16898bbb5485cf70e8cd22d9f6107954a0f3fe33ebe693be48899077dd2d201cecc677bf7e249a9cb3eaa2ffd5a1c" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/cra-exploit-clock/", "description": "Documentation for CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "cra-exploit-clock: unknown field is rejected", "method": "POST", "path": "/v1/cra-exploit-clock", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "cra-exploit-clock: example returns a signed result", "method": "POST", "path": "/v1/cra-exploit-clock", "body": { "sbom": { "bomFormat": "CycloneDX", "specVersion": "1.5", "version": 1, "metadata": { "component": { "type": "application", "name": "acme-gateway", "version": "3.2.0" } }, "components": [ { "type": "library", "bom-ref": "log4j-core", "group": "org.apache.logging.log4j", "name": "log4j-core", "version": "2.14.1", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" }, { "type": "library", "bom-ref": "lodash", "name": "lodash", "version": "4.17.15", "purl": "pkg:npm/lodash@4.17.15" }, { "type": "library", "bom-ref": "left-pad", "name": "left-pad", "version": "1.3.0", "purl": "pkg:npm/left-pad@1.3.0" } ] }, "product": { "name": "acme-gateway", "version": "3.2.0" } }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "EXPLOITED_CANDIDATES_FOUND", "NO_EXPLOITED_EVIDENCE", "INSUFFICIENT_EVIDENCE" ] }, "confidence": { "type": "object" }, "exposure": { "type": "object" }, "next_step": { "type": "object" }, "top_evidence": { "type": "array", "items": { "type": "object" } }, "summary": { "type": "string" }, "not_legal_advice": { "type": "string" }, "awareness": { "type": "object" }, "deadlines": { "type": "object" }, "sbom": { "type": "object" }, "counts": { "type": "object" }, "exploited_vulnerabilities": { "type": "array", "items": { "type": "object" } }, "components": { "type": "array", "items": { "type": "object" } }, "art14_draft_fields": { "type": "array", "items": { "type": "object" } }, "feed_snapshots": { "type": "object" }, "sources": { "type": "array", "items": { "type": "object" } }, "coverage": { "type": "object" }, "awareness_record": { "type": [ "object", "null" ] }, "deterministic": { "type": "boolean" }, "product": { "type": "object" }, "exploited_vulnerabilities_truncated": { "type": "boolean" }, "would_change_verdict": { "type": "array", "items": {} } } }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/ai-bom-license-resolver": { "post": { "operationId": "aiBomLicenseResolver", "summary": "AI Model License Chain Resolver", "description": "`POST /v1/ai-bom-license-resolver`\n\nWalks the Hugging Face lineage of up to 10 models (base-model chain and training datasets) and applies a hash-pinned table of license clauses to each intended use. Uses include commercial, API, weights, fine-tuning, user thresholds and jurisdiction. Per use it returns ALLOWED, CONFLICT or UNDETERMINED with the conflicting nodes, the clause and a verbatim quote.\n\n**What you get:** Tells you whether a model stack may be used for your stated use, names the conflicting model and clause, and ships a CycloneDX-style AI-BOM.\n\n### Use it for\n\n- Check whether a stack of Hugging Face models and datasets may be used for your stated use, such as commercial or API use.\n- Name the conflicting model and license clause when a use is not allowed.\n- Produce a CycloneDX-style AI bill of materials for the stack.\n\n### Details and limits\n\nWalks the Hugging Face lineage of up to 10 models (base_model chain, training datasets; at most 30 nodes, 4 generations) and applies a curated, hash-pinned table of license clauses (Apache-2.0, MIT, CC-BY, CC-BY-NC, CC-BY-SA, OpenRAIL variants, Llama 2 / 3 / 3.1 / 3.2 / 3.3, Gemma, Mistral Research License) to each intended use: commercial or not, API, weights or on-prem, fine-tuning, monthly active users, jurisdiction, sensitive fields of use. Per use it returns ALLOWED, CONFLICT or UNDETERMINED with the conflicting nodes, the clause, a verbatim quote, and the license source URL and SHA-256; the unsatisfiable core comes from the hub's deterministic SAT/LRA solver, with no LLM. Unknown, custom, missing or unreadable licenses are UNDETERMINED, never ALLOWED. Not legal advice.\n\n### Request fields\n\nSend these as a JSON body.\n\n| Field | Type | Required | Description |\n| --- | --- | --- | --- |\n| `models` | array of string | yes | Hugging Face model repo ids (owner/name) used together in the system. |\n| `datasets` | array of string | no | Extra Hugging Face dataset repo ids; datasets named on the model cards are followed automatically. |\n| `uses` | array of object | yes | Intended uses to decide, each evaluated independently. |\n| `dataset_terms` | enum | no | advisory (default): a dataset license restriction yields UNDETERMINED because it is unsettled whether it binds trained weights. binding: treat it as binding and report CONFLICT. |\n\n### Example request body\n\n```json\n{\n \"models\": [\n \"NousResearch/Hermes-3-Llama-3.1-8B\",\n \"mistralai/Mistral-7B-Instruct-v0.2\"\n ],\n \"uses\": [\n {\n \"id\": \"api-above-700m-mau\",\n \"commercial\": true,\n \"distribution\": \"api\",\n \"monthly_active_users\": 800000000\n },\n {\n \"id\": \"api-below-700m-mau\",\n \"commercial\": true,\n \"distribution\": \"api\",\n \"monthly_active_users\": 50000000\n }\n ]\n}\n```\n\n### Request (curl)\n\n```bash\ncurl -X POST \"https://$RAPIDAPI_HOST/v1/ai-bom-license-resolver\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-RapidAPI-Key: $RAPIDAPI_KEY\" \\\n -H \"X-RapidAPI-Host: $RAPIDAPI_HOST\" \\\n -d '{\"models\":[\"NousResearch/Hermes-3-Llama-3.1-8B\",\"mistralai/Mistral-7B-Instruct-v0.2\"],\"uses\":[{\"id\":\"api-above-700m-mau\",\"commercial\":true,\"distribution\":\"api\",\"monthly_active_users\":800000000},{\"id\":\"api-below-700m-mau\",\"commercial\":true,\"distribution\":\"api\",\"monthly_active_users\":50000000}]}'\n```\n\n### What comes back\n\nA 200 response is `{ \"data\": ..., \"_provenance\": ... }`. `_provenance` is a signed record of the sources read; the Verify a Signed Result endpoint checks it.\n\nFields of `data`:\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `verdict` | enum | Worst per-use verdict: CONFLICT, then UNDETERMINED, then ALLOWED. Unknown, custom, or missing licenses are never ALLOWED. |\n| `confidence` | enum | Completeness of the rule evaluation, not legal certainty: low when any use is UNDETERMINED. |\n| `deterministic` | boolean | Always true: no LLM touches the verdict path. |\n| `evidence` | array of object | Evidence, a list of objects. |\n| `summary` | string | Summary. |\n| `next_step` | string | Next step. |\n| `not_legal_advice` | string | Not legal advice. |\n| `uses` | array of object | Uses, a list of objects. |\n| `missing_license_nodes` | array of object | Missing license nodes, a list of objects. |\n| `license_mismatches` | array of object | License mismatches, a list of objects. |\n| `lineage` | object | nodes (key, id, kind, depth, license status and id, source_url), edges (from, to, relation), truncations, limits. |\n| `ai_bom` | object | CycloneDX 1.6 style ML-BOM: components, licenses, dependencies. |\n| `license_table` | object | Table version, verification date, and for every license used: sources with URL and SHA-256. |\n| `source_manifest` | array of object | Source manifest, a list of objects. |\n| `partial` | object | complete flag and the list of what is missing when an upstream read failed or a limit cut the lineage. |\n| `solver` | object | Solver name, version, and total solver calls. |\n\nExample `data` from a real recorded call (long values shortened):\n\n```json\n{\n \"verdict\": \"CONFLICT\",\n \"confidence\": \"high\",\n \"deterministic\": true,\n \"evidence\": [\n {\n \"kind\": \"license_clause\",\n \"url\": \"https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE\",\n \"sha256\": \"4fa551d4f938f68b8c1e6afa9d28befb70e3f33f75d0753248d530364aeea40f\",\n \"node\": \"NousResearch/Hermes-3-Llama-3.1-8B\",\n \"quote\": \"monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active user...\"\n },\n {\n \"kind\": \"hf_api\",\n \"url\": \"https://huggingface.co/api/models/NousResearch/Hermes-3-Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expan...\",\n \"sha256\": \"c6733c46eb7d112b072649f6530ff436f148e0f2256eed57ae96db97f0ea7f7b\",\n \"node\": \"NousResearch/Hermes-3-Llama-3.1-8B\"\n },\n {\n \"kind\": \"license_clause\",\n \"url\": \"https://raw.githubusercontent.com/meta-llama/llama-models/main/models/llama3_1/LICENSE\",\n \"sha256\": \"bf2eac60b81e5c5f779fc3b4849d3bfacfd63f97f3eb68b44e9c6868c5801712\",\n \"node\": \"meta-llama/Llama-3.1-8B\",\n \"quote\": \"monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active user...\"\n }\n ],\n \"summary\": \"2 uses over 3 lineage nodes (3 models, 0 datasets). api-above-700m-mau: CONFLICT; api-below-700m-mau: ALLOWED. Not legal advice.\",\n \"next_step\": \"Resolve the conflict before shipping: Request a license from Meta, or remove the Llama-licensed model from the lineage. Conflicting nodes: NousResearch/Herme...\",\n \"not_legal_advice\": \"Not legal advice. This is a machine reading of the license clauses listed in license_table, applied to the facts you supplied. It does not evaluate indemniti...\",\n \"uses\": [\n {\n \"id\": \"api-above-700m-mau\",\n \"verdict\": \"CONFLICT\",\n \"confidence\": \"high\",\n \"conflicts\": [\n \"...\",\n \"...\"\n ],\n \"undetermined\": [],\n \"obligations\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"solver_calls\": 3,\n \"by_model\": [\n \"...\",\n \"...\"\n ]\n },\n {\n \"id\": \"api-below-700m-mau\",\n \"verdict\": \"ALLOWED\",\n \"confidence\": \"high\",\n \"conflicts\": [],\n \"undetermined\": [],\n \"obligations\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"solver_calls\": 1,\n \"by_model\": [\n \"...\",\n \"...\"\n ]\n }\n ],\n \"missing_license_nodes\": [],\n \"license_mismatches\": [\n {\n \"node\": \"NousResearch/Hermes-3-Llama-3.1-8B\",\n \"declared\": \"llama3\",\n \"base\": \"meta-llama/Llama-3.1-8B\",\n \"base_declared\": \"llama3.1\",\n \"relation\": \"finetune\",\n \"note\": \"Both licenses were applied; a derivative's declared license does not replace its base model's terms.\"\n }\n ],\n \"lineage\": {\n \"nodes\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"edges\": [\n \"...\"\n ],\n \"truncations\": [],\n \"limits\": {\n \"max_depth\": 4,\n \"max_nodes\": 30,\n \"max_datasets_per_model\": 6\n }\n },\n \"ai_bom\": {\n \"bomFormat\": \"CycloneDX\",\n \"specVersion\": \"1.6\",\n \"version\": 1,\n \"metadata\": {\n \"timestamp\": \"2026-11-06T01:30:18.372Z\",\n \"tools\": \"...\"\n },\n \"components\": [\n \"...\",\n \"...\",\n \"...\"\n ],\n \"dependencies\": [\n \"...\",\n \"...\",\n \"...\"\n ]\n },\n \"license_table\": {\n \"version\": \"2026-11-04.1\",\n \"verified_at\": \"2026-11-04\",\n \"entries_used\": [\n \"...\",\n \"...\",\n \"...\"\n ]\n },\n \"source_manifest\": [\n {\n \"url\": \"https://huggingface.co/api/models/NousResearch/Hermes-3-Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expan...\",\n \"kind\": \"hf_api\",\n \"sha256\": \"c6733c46eb7d112b072649f6530ff436f148e0f2256eed57ae96db97f0ea7f7b\",\n \"bytes\": 1186,\n \"digest_basis\": \"decoded-text\",\n \"fetched_at\": \"2026-11-06T01:30:18.520Z\"\n },\n {\n \"url\": \"https://huggingface.co/api/models/mistralai/Mistral-7B-Instruct-v0.2?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expan...\",\n \"kind\": \"hf_api\",\n \"sha256\": \"2909387d9acca5863ac600f83206effea8fdeba7382bc82dddbe5cd4a3607018\",\n \"bytes\": 875,\n \"digest_basis\": \"decoded-text\",\n \"fetched_at\": \"2026-11-06T01:30:18.520Z\"\n },\n {\n \"url\": \"https://huggingface.co/api/models/meta-llama/Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gat...\",\n \"kind\": \"hf_api\",\n \"sha256\": \"4896bfd309270849d069a9897a79b12cffa2980e19f77b926990bd1fffb45b2d\",\n \"bytes\": 13622,\n \"digest_basis\": \"decoded-text\",\n \"fetched_at\": \"2026-11-06T01:30:18.618Z\"\n }\n ]\n}\n```\n\n### HTTP response status codes\n\n- 200: success; the body is `{ \"data\": ..., \"_provenance\": ... }`.\n- 400: the request failed validation; `error` names the field and `code` is `invalid_request`.\n- 401: the RapidAPI key or subscription is missing or not valid for this API.\n- 429: the plan's rate limit was reached.\n- 5xx: the call failed on our side or at an upstream source; retry it.\n\nFull field-by-field documentation: https://writerslogic.com/agents/ai-bom-license-resolver/\nMachine-readable input and result schemas: https://writerslogic.com/agents/ai-bom-license-resolver.json", "x-sample-url": "https://agents.writerslogic.com/api/v1/samples/ai-bom-license-resolver", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "required": [ "models", "uses" ], "properties": { "models": { "type": "array", "minItems": 1, "maxItems": 10, "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "description": "Hugging Face model repo ids (owner/name) used together in the system." }, "datasets": { "type": "array", "maxItems": 10, "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "description": "Extra Hugging Face dataset repo ids; datasets named on the model cards are followed automatically." }, "uses": { "type": "array", "minItems": 1, "maxItems": 6, "items": { "type": "object", "additionalProperties": false, "required": [ "commercial", "distribution" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 40, "description": "Label echoed in the result; defaults to use-1, use-2, ..." }, "commercial": { "type": "boolean", "description": "Any commercial activity, revenue, or business operations connected to the use." }, "distribution": { "type": "string", "enum": [ "api", "weights", "on_prem" ], "description": "api: hosted service, weights stay with you. weights: you redistribute model weights. on_prem: internal use only." }, "fine_tune": { "type": "boolean", "description": "You will fine-tune, merge, quantize or otherwise modify the models. Default false." }, "monthly_active_users": { "type": "integer", "minimum": 0, "maximum": 10000000000000, "description": "Monthly active users of your products and affiliates; compared with user-count thresholds such as Llama's 700 million. Required to evaluate those clauses." }, "jurisdiction": { "type": "string", "pattern": "^[A-Za-z]{2}$", "description": "ISO 3166-1 alpha-2 country of the licensee's domicile or principal place of business, e.g. DE. Required for regional clauses." }, "trains_other_models": { "type": "boolean", "description": "Outputs of these models will train or improve a different model that is not a derivative of the same family (distillation). Default false." }, "fields_of_use": { "type": "array", "maxItems": 4, "items": { "type": "string", "enum": [ "medical_advice", "law_enforcement_justice", "military", "automated_legal_decisions" ] }, "description": "Sensitive fields the use touches; checked against field-of-use clauses." } } }, "description": "Intended uses to decide, each evaluated independently." }, "dataset_terms": { "type": "string", "enum": [ "advisory", "binding" ], "description": "advisory (default): a dataset license restriction yields UNDETERMINED because it is unsettled whether it binds trained weights. binding: treat it as binding and report CONFLICT." } }, "description": "Input payload for AI-BOM License Chain Resolver for Hugging Face Models. Required fields: `models`, `uses`. Optional fields: `datasets`, `dataset_terms`.", "externalDocs": { "url": "https://writerslogic.com/agents/ai-bom-license-resolver.json", "description": "Machine-readable record for AI-BOM License Chain Resolver for Hugging Face Models: the full input and result JSON Schemas, an example payload and the OpenAPI operation." } }, "examples": { "default": { "summary": "Example request for AI-BOM License Chain Resolver for Hugging Face Models", "description": "A complete valid request body for AI Model License Chain Resolver.", "value": { "models": [ "NousResearch/Hermes-3-Llama-3.1-8B", "mistralai/Mistral-7B-Instruct-v0.2" ], "uses": [ { "id": "api-above-700m-mau", "commercial": true, "distribution": "api", "monthly_active_users": 800000000 }, { "id": "api-below-700m-mau", "commercial": true, "distribution": "api", "monthly_active_users": 50000000 } ] } } } } }, "description": "JSON request body for AI-BOM License Chain Resolver for Hugging Face Models. Required fields: `models`, `uses`. Optional fields: `datasets`, `dataset_terms`. Unknown fields are rejected with a 400." }, "responses": { "200": { "description": "Success. `data` holds the answer and `_provenance` holds the signed credential for it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "ALLOWED", "CONFLICT", "UNDETERMINED" ], "description": "Worst per-use verdict: CONFLICT, then UNDETERMINED, then ALLOWED. Unknown, custom, or missing licenses are never ALLOWED." }, "confidence": { "type": "string", "enum": [ "high", "low" ], "description": "Completeness of the rule evaluation, not legal certainty: low when any use is UNDETERMINED." }, "deterministic": { "type": "boolean", "description": "Always true: no LLM touches the verdict path." }, "evidence": { "type": "array", "items": { "type": "object", "description": "Top sources behind the verdict: kind (license_clause, hf_api, license_text), url, sha256, node and verbatim quote for clauses. Full list in source_manifest." }, "description": "Evidence, a list of objects." }, "summary": { "type": "string", "description": "Summary." }, "next_step": { "type": "string", "description": "Next step." }, "not_legal_advice": { "type": "string", "description": "Not legal advice." }, "uses": { "type": "array", "items": { "type": "object", "description": "id, verdict, confidence, conflicts[] (tier, nodes, clauses[{node, license, clause, ref, quote, source_url, source_sha256}], use_facts, unsat_core, minimal, cure), undetermined[] (code, node, detail), obligations[], by_model[{model, verdict}], solver_calls." }, "description": "Uses, a list of objects." }, "missing_license_nodes": { "type": "array", "items": { "type": "object", "description": "node, kind, reason, declared, license_file {url, sha256, bytes}." }, "description": "Missing license nodes, a list of objects." }, "license_mismatches": { "type": "array", "items": { "type": "object", "description": "A node whose declared license differs from its base model's; the base license terms still apply." }, "description": "License mismatches, a list of objects." }, "lineage": { "type": "object", "description": "nodes (key, id, kind, depth, license status and id, source_url), edges (from, to, relation), truncations, limits." }, "ai_bom": { "type": "object", "description": "CycloneDX 1.6 style ML-BOM: components, licenses, dependencies." }, "license_table": { "type": "object", "description": "Table version, verification date, and for every license used: sources with URL and SHA-256." }, "source_manifest": { "type": "array", "items": { "type": "object", "description": "url, kind, sha256, bytes, digest_basis, fetched_at for every source read." }, "description": "Source manifest, a list of objects." }, "partial": { "type": "object", "description": "complete flag and the list of what is missing when an upstream read failed or a limit cut the lineage." }, "solver": { "type": "object", "description": "Solver name, version, and total solver calls." } }, "description": "Data, an object." }, "_provenance": { "type": "object", "description": "C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance" } }, "required": [ "data", "_provenance" ] }, "example": { "data": { "verdict": "CONFLICT", "confidence": "high", "deterministic": true, "evidence": [ { "kind": "license_clause", "url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "sha256": "4fa551d4f938f68b8c1e6afa9d28befb70e3f33f75d0753248d530364aeea40f", "node": "NousResearch/Hermes-3-Llama-3.1-8B", "quote": "monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta" }, { "kind": "hf_api", "url": "https://huggingface.co/api/models/NousResearch/Hermes-3-Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "sha256": "c6733c46eb7d112b072649f6530ff436f148e0f2256eed57ae96db97f0ea7f7b", "node": "NousResearch/Hermes-3-Llama-3.1-8B" }, { "kind": "license_clause", "url": "https://raw.githubusercontent.com/meta-llama/llama-models/main/models/llama3_1/LICENSE", "sha256": "bf2eac60b81e5c5f779fc3b4849d3bfacfd63f97f3eb68b44e9c6868c5801712", "node": "meta-llama/Llama-3.1-8B", "quote": "monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta" } ], "summary": "2 uses over 3 lineage nodes (3 models, 0 datasets). api-above-700m-mau: CONFLICT; api-below-700m-mau: ALLOWED. Not legal advice.", "next_step": "Resolve the conflict before shipping: Request a license from Meta, or remove the Llama-licensed model from the lineage. Conflicting nodes: NousResearch/Hermes-3-Llama-3.1-8B, meta-llama/Llama-3.1-8B.", "not_legal_advice": "Not legal advice. This is a machine reading of the license clauses listed in license_table, applied to the facts you supplied. It does not evaluate indemnities, export controls, trademarks, patents, privacy law, or any term outside that table, and a license file can change after the recorded veri...", "uses": [ { "id": "api-above-700m-mau", "verdict": "CONFLICT", "confidence": "high", "conflicts": [ { "tier": "binding", "nodes": [ "NousResearch/Hermes-3-Llama-3.1-8B" ], "clauses": [ { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "clause": "mau-cap", "title": "More than 700 million monthly active users requires a separate license from Meta", "ref": "Section 2 (Additional Commercial Terms)", "quote": "monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "source_sha256": "4fa551d4f938f68b8c1e6afa9d28befb70e3f33f75d0753248d530364aeea40f", "note": "The threshold is measured on the version release date for the preceding calendar month; monthly_active_users is assumed to be that figure for the licensee and its affiliates. A written license from Meta lifts the restriction." } ], "use_facts": [ "monthly_active_users = 800000000" ], "unsat_core": [ "use:mau", "n0:mau-cap" ], "minimal": true, "cure": "Request a license from Meta, or remove the Llama-licensed model from the lineage." }, { "tier": "binding", "nodes": [ "meta-llama/Llama-3.1-8B" ], "clauses": [ { "node": "meta-llama/Llama-3.1-8B", "license": "llama3.1", "clause": "mau-cap", "title": "More than 700 million monthly active users requires a separate license from Meta", "ref": "Section 2 (Additional Commercial Terms)", "quote": "monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta", "source_url": "https://raw.githubusercontent.com/meta-llama/llama-models/main/models/llama3_1/LICENSE", "source_sha256": "bf2eac60b81e5c5f779fc3b4849d3bfacfd63f97f3eb68b44e9c6868c5801712", "note": "The threshold is measured on the version release date for the preceding calendar month; monthly_active_users is assumed to be that figure for the licensee and its affiliates. A written license from Meta lifts the restriction." } ], "use_facts": [ "monthly_active_users = 800000000" ], "unsat_core": [ "use:mau", "n2:mau-cap" ], "minimal": true, "cure": "Request a license from Meta, or remove the Llama-licensed model from the lineage." } ], "undetermined": [], "obligations": [ { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "id": "copy-of-agreement", "text": "Provide a copy of the license agreement with the Llama Materials.", "ref": "Section 1.b.i", "quote": "you shall (A) provide a copy of this Agreement with any such Llama Materials", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "scope": "model" }, { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "id": "built-with", "text": "Prominently display \"Built with Meta Llama 3\" on a related website, interface, blogpost, about page or product documentation.", "ref": "Section 1.b.i", "quote": "prominently display “Built with Meta Llama 3” on a related website, user interface, blogpost, about page, or product documentation", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "scope": "model" }, { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "id": "aup", "text": "Comply with applicable law and the incorporated Acceptable Use Policy.", "ref": "Section 1.b.iv", "quote": "adhere to the Acceptable Use Policy for the Llama Materials", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "scope": "model" } ], "solver_calls": 3, "by_model": [ { "model": "NousResearch/Hermes-3-Llama-3.1-8B", "verdict": "CONFLICT" }, { "model": "mistralai/Mistral-7B-Instruct-v0.2", "verdict": "ALLOWED" } ] }, { "id": "api-below-700m-mau", "verdict": "ALLOWED", "confidence": "high", "conflicts": [], "undetermined": [], "obligations": [ { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "id": "copy-of-agreement", "text": "Provide a copy of the license agreement with the Llama Materials.", "ref": "Section 1.b.i", "quote": "you shall (A) provide a copy of this Agreement with any such Llama Materials", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "scope": "model" }, { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "id": "built-with", "text": "Prominently display \"Built with Meta Llama 3\" on a related website, interface, blogpost, about page or product documentation.", "ref": "Section 1.b.i", "quote": "prominently display “Built with Meta Llama 3” on a related website, user interface, blogpost, about page, or product documentation", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "scope": "model" }, { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "license": "llama3", "id": "aup", "text": "Comply with applicable law and the incorporated Acceptable Use Policy.", "ref": "Section 1.b.iv", "quote": "adhere to the Acceptable Use Policy for the Llama Materials", "source_url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "scope": "model" } ], "solver_calls": 1, "by_model": [ { "model": "NousResearch/Hermes-3-Llama-3.1-8B", "verdict": "ALLOWED" }, { "model": "mistralai/Mistral-7B-Instruct-v0.2", "verdict": "ALLOWED" } ] } ], "missing_license_nodes": [], "license_mismatches": [ { "node": "NousResearch/Hermes-3-Llama-3.1-8B", "declared": "llama3", "base": "meta-llama/Llama-3.1-8B", "base_declared": "llama3.1", "relation": "finetune", "note": "Both licenses were applied; a derivative's declared license does not replace its base model's terms." } ], "lineage": { "nodes": [ { "key": "n0", "id": "NousResearch/Hermes-3-Llama-3.1-8B", "kind": "model", "depth": 0, "requested": true, "status": "ok", "license": { "status": "known", "id": "llama3", "declared": [ "llama3" ] }, "sha": "896ea440e5a9e6070e3d8a2774daf2b481ab425b", "pipeline_tag": "text-generation", "source_url": "https://huggingface.co/NousResearch/Hermes-3-Llama-3.1-8B" }, { "key": "n1", "id": "mistralai/Mistral-7B-Instruct-v0.2", "kind": "model", "depth": 0, "requested": true, "status": "ok", "license": { "status": "known", "id": "apache-2.0", "declared": [ "apache-2.0" ] }, "sha": "63a8b081895390a26e140280378bc85ec8bce07a", "pipeline_tag": "text-generation", "source_url": "https://huggingface.co/mistralai/Mistral-7B-Instruct-v0.2" }, { "key": "n2", "id": "meta-llama/Llama-3.1-8B", "kind": "model", "depth": 1, "requested": false, "status": "ok", "license": { "status": "known", "id": "llama3.1", "declared": [ "llama3.1" ] }, "sha": "d04e592bb4f6aa9cfee91e2e20afa771667e1d4b", "pipeline_tag": "text-generation", "source_url": "https://huggingface.co/meta-llama/Llama-3.1-8B" } ], "edges": [ { "from": "n0", "to": "n2", "relation": "finetune" } ], "truncations": [], "limits": { "max_depth": 4, "max_nodes": 30, "max_datasets_per_model": 6 } }, "ai_bom": { "bomFormat": "CycloneDX", "specVersion": "1.6", "version": 1, "metadata": { "timestamp": "2026-11-06T01:30:18.372Z", "tools": { "components": [ { "type": "application", "name": "ai-bom-license-resolver", "version": "1.0.0" } ] } }, "components": [ { "type": "machine-learning-model", "bom-ref": "hf:model:NousResearch/Hermes-3-Llama-3.1-8B", "name": "NousResearch/Hermes-3-Llama-3.1-8B", "version": "896ea440e5a9e6070e3d8a2774daf2b481ab425b", "licenses": [ { "license": { "name": "Meta Llama 3 Community License Agreement", "url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE" } } ], "externalReferences": [ { "type": "website", "url": "https://huggingface.co/NousResearch/Hermes-3-Llama-3.1-8B" } ], "properties": [ { "name": "resolver:node_status", "value": "ok" }, { "name": "resolver:license_status", "value": "known" }, { "name": "huggingface:pipeline_tag", "value": "text-generation" } ] }, { "type": "machine-learning-model", "bom-ref": "hf:model:mistralai/Mistral-7B-Instruct-v0.2", "name": "mistralai/Mistral-7B-Instruct-v0.2", "version": "63a8b081895390a26e140280378bc85ec8bce07a", "licenses": [ { "license": { "id": "Apache-2.0" } } ], "externalReferences": [ { "type": "website", "url": "https://huggingface.co/mistralai/Mistral-7B-Instruct-v0.2" } ], "properties": [ { "name": "resolver:node_status", "value": "ok" }, { "name": "resolver:license_status", "value": "known" }, { "name": "huggingface:pipeline_tag", "value": "text-generation" } ] }, { "type": "machine-learning-model", "bom-ref": "hf:model:meta-llama/Llama-3.1-8B", "name": "meta-llama/Llama-3.1-8B", "version": "d04e592bb4f6aa9cfee91e2e20afa771667e1d4b", "licenses": [ { "license": { "name": "Llama 3.1 Community License Agreement", "url": "https://raw.githubusercontent.com/meta-llama/llama-models/main/models/llama3_1/LICENSE" } } ], "externalReferences": [ { "type": "website", "url": "https://huggingface.co/meta-llama/Llama-3.1-8B" } ], "properties": [ { "name": "resolver:node_status", "value": "ok" }, { "name": "resolver:license_status", "value": "known" }, { "name": "huggingface:pipeline_tag", "value": "text-generation" } ] } ], "dependencies": [ { "ref": "hf:model:NousResearch/Hermes-3-Llama-3.1-8B", "dependsOn": [ "hf:model:meta-llama/Llama-3.1-8B" ] }, { "ref": "hf:model:mistralai/Mistral-7B-Instruct-v0.2", "dependsOn": [] }, { "ref": "hf:model:meta-llama/Llama-3.1-8B", "dependsOn": [] } ] }, "license_table": { "version": "2026-11-04.1", "verified_at": "2026-11-04", "entries_used": [ { "id": "apache-2.0", "name": "Apache License 2.0", "sources": [ { "role": "license", "url": "https://www.apache.org/licenses/LICENSE-2.0.txt", "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", "digest_basis": "bytes" } ] }, { "id": "llama3", "name": "Meta Llama 3 Community License Agreement", "sources": [ { "role": "license", "url": "https://raw.githubusercontent.com/meta-llama/llama3/main/LICENSE", "sha256": "4fa551d4f938f68b8c1e6afa9d28befb70e3f33f75d0753248d530364aeea40f", "digest_basis": "bytes" }, { "role": "aup", "url": "https://raw.githubusercontent.com/meta-llama/llama3/main/USE_POLICY.md", "sha256": "716a6b46e9bc75220c7b78f27382f7d0b8ca4c95818661a0936c081708f87f7c", "digest_basis": "bytes" } ] }, { "id": "llama3.1", "name": "Llama 3.1 Community License Agreement", "sources": [ { "role": "license", "url": "https://raw.githubusercontent.com/meta-llama/llama-models/main/models/llama3_1/LICENSE", "sha256": "bf2eac60b81e5c5f779fc3b4849d3bfacfd63f97f3eb68b44e9c6868c5801712", "digest_basis": "bytes" }, { "role": "aup", "url": "https://raw.githubusercontent.com/meta-llama/llama-models/main/models/llama3_1/USE_POLICY.md", "sha256": "f456a3f5b15ab588c84d06cf095a245bfee0bbc1620b48ed00af2cca4a711735", "digest_basis": "bytes" } ] } ] }, "source_manifest": [ { "url": "https://huggingface.co/api/models/NousResearch/Hermes-3-Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "kind": "hf_api", "sha256": "c6733c46eb7d112b072649f6530ff436f148e0f2256eed57ae96db97f0ea7f7b", "bytes": 1186, "digest_basis": "decoded-text", "fetched_at": "2026-11-06T01:30:18.520Z" }, { "url": "https://huggingface.co/api/models/mistralai/Mistral-7B-Instruct-v0.2?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "kind": "hf_api", "sha256": "2909387d9acca5863ac600f83206effea8fdeba7382bc82dddbe5cd4a3607018", "bytes": 875, "digest_basis": "decoded-text", "fetched_at": "2026-11-06T01:30:18.520Z" }, { "url": "https://huggingface.co/api/models/meta-llama/Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "kind": "hf_api", "sha256": "4896bfd309270849d069a9897a79b12cffa2980e19f77b926990bd1fffb45b2d", "bytes": 13622, "digest_basis": "decoded-text", "fetched_at": "2026-11-06T01:30:18.618Z" } ], "partial": { "complete": true, "missing": [] }, "solver": { "name": "cdcl-lra-ts", "version": "1.0.0", "calls": 4, "hugging_face_reads": 3 } }, "_provenance": { "version": "writerslogic-provenance/1", "issuer": "did:web:agents.writerslogic.com", "verify": { "endpoint": "POST /api/v1/verify-provenance", "did": "did:web:agents.writerslogic.com" }, "manifest": { "format": "application/json", "instance_id": "xmp:iid:9090a222-1203-4022-8f21-eb7c5fa05585", "claim_generator_info": [ { "name": "WritersLogic x402 Agent Hub", "version": "2.0.0" } ], "title": "AI-BOM License Chain Resolver for Hugging Face Models", "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "when": "2026-11-06T01:30:18.618Z", "softwareAgent": { "name": "writerslogic-agent-hub/ai-bom-license-resolver", "version": "2.0.0" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia", "parameters": { "endpoint": "POST /api/v1/ai-bom-license-resolver", "inputDigest": { "alg": "sha256", "hash": "b2b0f5aa58f4d58ef9ae6a0a87f6a45dfd48bd1d9f37c8670d29dfd3ebb348cf", "canonicalization": "JCS" } } } ] } }, { "label": "c2pa.hash.data", "data": { "alg": "sha256", "hash": "19a3bdc85656a106049736e7e2487b2ed0c102f2c4094ec4ca57100de293b252", "name": "jcs-canonical-json(data)" } }, { "label": "c2pa.ingredient.v3", "data": { "title": "https://huggingface.co/api/models/mistralai/Mistral-7B-Instruct-v0.2?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "format": "application/json", "relationship": "inputTo", "dc": { "source": "https://huggingface.co/api/models/mistralai/Mistral-7B-Instruct-v0.2?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "date": "2026-11-06T01:30:18.520Z" }, "hash": { "alg": "sha256", "hash": "2909387d9acca5863ac600f83206effea8fdeba7382bc82dddbe5cd4a3607018", "basis": "body" } } } ] }, "credential": { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "id": "urn:uuid:c36f6496-d465-4b5b-8e72-f2db5c322464", "type": [ "VerifiableCredential", "AgentOutputCredential" ], "issuer": "did:web:agents.writerslogic.com", "validFrom": "2026-11-06T01:30:18.618Z", "credentialSubject": { "id": "urn:sha256:19a3bdc85656a106049736e7e2487b2ed0c102f2c4094ec4ca57100de293b252", "agent": "ai-bom-license-resolver", "endpoint": "POST /api/v1/ai-bom-license-resolver", "outputDigest": { "alg": "sha256", "value": "19a3bdc85656a106049736e7e2487b2ed0c102f2c4094ec4ca57100de293b252", "canonicalization": "JCS" }, "inputDigest": { "alg": "sha256", "value": "b2b0f5aa58f4d58ef9ae6a0a87f6a45dfd48bd1d9f37c8670d29dfd3ebb348cf", "canonicalization": "JCS" }, "manifestDigest": { "alg": "sha256", "value": "61d3eef2cefc17de8124ef58c055884ecec1c5249ce41260dd791204a0dc5707", "canonicalization": "JCS" }, "ingredients": [ { "url": "https://huggingface.co/api/models/mistralai/Mistral-7B-Instruct-v0.2?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "sha256": "2909387d9acca5863ac600f83206effea8fdeba7382bc82dddbe5cd4a3607018" }, { "url": "https://huggingface.co/api/models/NousResearch/Hermes-3-Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "sha256": "c6733c46eb7d112b072649f6530ff436f148e0f2256eed57ae96db97f0ea7f7b" }, { "url": "https://huggingface.co/api/models/meta-llama/Llama-3.1-8B?expand%5B%5D=cardData&expand%5B%5D=tags&expand%5B%5D=sha&expand%5B%5D=lastModified&expand%5B%5D=gated&expand%5B%5D=pipeline_tag", "sha256": "4896bfd309270849d069a9897a79b12cffa2980e19f77b926990bd1fffb45b2d" } ], "payment": { "scheme": "api-key", "network": "eip155:8453", "payer": "sample" } }, "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": "2026-11-06T01:30:18.618Z", "verificationMethod": "did:web:agents.writerslogic.com#key-1", "proofPurpose": "assertionMethod", "proofValue": "zCot5y9WFSWKafd6vmJthd26bRx1KYLk9Mv7y7zopDxvuphFwT3AsF6m2mQUt64jePxihdvgXwUHLn2oSmGqZdPW" } }, "ethSignature": { "type": "EIP-191", "signer": "did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "address": "0x3DBd42560cA7a7E448A2c7DfC9E785526189411f", "message": "writerslogic-provenance:695c8834d8c220d5c5cbc5d16238ab4f091fae31d943b0915c570fd6e1e1db65", "signature": "0xb5a63bda3e4627534304c79ddff7ce05415efd2aef85dddc5335ca1da582d3f8318ed636e668ffcccd85caf0ae579d7aaa03bbe740768d91c89f6ecf46b3ef641c" } } } } } }, "400": { "description": "Invalid request. The `error` field names the offending field and `code` is `invalid_request`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "401": { "description": "Missing or invalid RapidAPI key.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } }, "402": { "description": "Payment required. The request did not arrive through RapidAPI.", "content": { "application/json": { "schema": { "type": "object", "description": "x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)", "properties": { "x402Version": { "type": "integer" }, "error": { "type": "string" }, "code": { "type": "string" }, "resource": { "type": "object" }, "accepts": { "type": "array", "items": { "type": "object" } }, "extensions": { "type": "object" } } } } } }, "502": { "description": "A source or model this endpoint depends on failed. Retry later; the body carries an `error` message and a `code`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" } } } } } } }, "externalDocs": { "url": "https://writerslogic.com/agents/ai-bom-license-resolver/", "description": "Documentation for AI-BOM License Chain Resolver for Hugging Face Models: what it does, every input and result field, an example call and the response shape. A free signed sample response is linked from the page." }, "x-tests": [ { "name": "ai-bom-license-resolver: unknown field is rejected", "method": "POST", "path": "/v1/ai-bom-license-resolver", "body": { "nonsense": true }, "assert": { "status": 400, "json": { "code": "invalid_request" }, "maxMs": 10000 } }, { "name": "ai-bom-license-resolver: example returns a signed result", "method": "POST", "path": "/v1/ai-bom-license-resolver", "body": { "models": [ "NousResearch/Hermes-3-Llama-3.1-8B", "mistralai/Mistral-7B-Instruct-v0.2" ], "uses": [ { "id": "api-above-700m-mau", "commercial": true, "distribution": "api", "monthly_active_users": 800000000 }, { "id": "api-below-700m-mau", "commercial": true, "distribution": "api", "monthly_active_users": 50000000 } ] }, "assert": { "status": 200, "jsonPathsExist": [ "data", "_provenance.credential" ], "jsonSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "ALLOWED", "CONFLICT", "UNDETERMINED" ] }, "confidence": { "type": "string", "enum": [ "high", "low" ] }, "deterministic": { "type": "boolean" }, "evidence": { "type": "array", "items": { "type": "object" } }, "summary": { "type": "string" }, "next_step": { "type": "string" }, "not_legal_advice": { "type": "string" }, "uses": { "type": "array", "items": { "type": "object" } }, "missing_license_nodes": { "type": "array", "items": { "type": "object" } }, "license_mismatches": { "type": "array", "items": { "type": "object" } }, "lineage": { "type": "object" }, "ai_bom": { "type": "object" }, "license_table": { "type": "object" }, "source_manifest": { "type": "array", "items": { "type": "object" } }, "partial": { "type": "object" }, "solver": { "type": "object" } } }, "_provenance": { "type": "object" } }, "required": [ "data", "_provenance" ] }, "maxMs": 120000 } } ] } }, "/v1/patch-accessibility": { "post": { "operationId": "accessibilityPatcher", "summary": "WCAG Accessibility Audit and HTML Patch", "description": "`POST /v1/patch-accessibility`\n\nChecks a page's HTML, pasted or fetched from a URL, against the WCAG failures most cited in ADA demand letters and returns FAIL, REVIEW or PASS. Each issue has a CSS selector, source line and fix, with patched HTML, a SARIF 2.1.0 log and an interim script hotfix. Static HTML only: color contrast, keyboard behavior and JavaScript-rendered content are not checked. Not a conformance claim.\n\n**What you get:** ADA website demand letters commonly settle for $5,000-$25,000 plus fees; fixing the cited elements before a letter arrives is far cheaper than settling.\n\n### Use it for\n\n- Audit a page's HTML for the WCAG failures most cited in ADA demand letters, such as missing alt text, labels and link names.\n- Get per-element patched HTML and an interim script hotfix for the issues found.\n- Publish findings as a SARIF log with a selector, source line and fix for every issue.\n\n### Details and limits\n\nReturns a FAIL / REVIEW / PASS verdict for a page's HTML (pasted or fetched from a URL) against the WCAG failures most cited in ADA demand letters: alt text, form labels, unnamed buttons and links, lang, headings, landmarks, skip links, zoom. Each issue carries a CSS selector, source line and fix, with a top-five list, a SARIF 2.1.0 log, a litigation risk score, per-element patched HTML and an interim