Package registry lookup across 8 ecosystems. One endpoint, normalized metadata and vulnerability data — so your agent doesn't have to know npm's JSON vs PyPI's JSON vs crates.io's JSON.
Your agent needs package metadata. Normally that means knowing the different URL patterns, auth requirements, and JSON shapes of 8 different registries — plus a separate vulnerability lookup. PKGS does it all in one call.
NPM, PyPI, crates, RubyGems, Packagist, Go, NuGet, Maven — all return the same JSON shape. Your agent never needs ecosystem-specific parsing logic.
Paid tier includes vulnerability lookups via OSV.dev. Know if a package has known CVEs before your agent installs it.
24-hour cache on every lookup. Same package requested 100 times = 1 upstream API call. No rate limit surprises.
Per-ecosystem normalization and security hardening. SSRF protection, input validation, and per-ecosystem timeouts.
Every ecosystem is keyless for reads — no API keys needed, no auth management. We handle the HTTP calls, parsing, and normalization.
Node.js packages. registry.npmjs.org
Python packages. pypi.org
Rust packages. crates.io
Ruby gems. rubygems.org
PHP packages. packagist.org
Go modules. go.dev proxy
.NET packages. nuget.org
Java/Kotlin packages. search.maven.org
Look up package metadata. Free tier: 10/day/IP, basic metadata only.
curl "https://pkgs.4bots.ai/v1/free/pkg?ecosystem=npm&package=express"
Example response:
{
"ecosystem": "npm",
"package": "express",
"version": "4.18.2",
"description": "Fast, unopinionated, minimalist web framework",
"license": "MIT",
"homepage": "https://expressjs.com",
"repository": "https://github.com/expressjs/express",
"downloads_last_month": 22000000,
"cached": false,
"free_remaining": 7
}
Paid tier: full metadata + OSV vulnerability data. $0.002/lookup.
curl "https://pkgs.4bots.ai/v1/paid/pkg?ecosystem=pypi&package=requests"
Same schema. Extra fields: dependencies, OSV vulnerability list.
Health check. Always free, always returns 200.
curl "https://pkgs.4bots.ai/health"
10 free lookups per day covers development and light agent workloads. Paid tier unlocks full metadata and vulnerability data.
No signup. No API key. Just send a request.
How x402 works