npm & PyPI Package Version Check with OSV

Check a dependency pin before an agent writes it into a project. Send exact npm or PyPI versions; get registry existence, deprecation, yanking and known OSV vulnerability IDs. Packages are never installed. OSV results are evidence, not a safety verdict. A completed check costs $0.0009, plus $0.00005 per run start at default memory.

Try it

{"items":[{"ecosystem":"npm","name":"is-number","version":"7.0.0"},{"ecosystem":"PyPI","name":"six","version":"1.17.0"}],"maxResults":100}

Empty input {} checks those same two versions. An explicit empty items array is invalid. No upstream API key is needed.

Use from an agent

Add https://mcp.apify.com?tools=miacx/npm-pypi-package-version-check to your MCP client and sign in to Apify. Call the dedicated Actor tool, then use get-dataset-items to read the completed run's dataset. Or set APIFY_TOKEN to your Apify API token and call the API:

curl --fail-with-body 'https://api.apify.com/v2/actors/miacx~npm-pypi-package-version-check/run-sync-get-dataset-items' \
  -H "Authorization: Bearer $APIFY_TOKEN" -H 'Content-Type: application/json' \
  -d '{"items":[{"ecosystem":"npm","name":"is-number","version":"7.0.0"},{"ecosystem":"PyPI","name":"six","version":"1.17.0"}],"maxResults":100}'

What you get

The dataset contains one row per processed input item, in input order, including duplicates and failures. Read status first. ok means the check completed; read packageExists and versionExists for its verdict. Failed or partial checks use a machine error code as their dataset status.

Selected fields from the synthetic registry/OSV fixture in test/core.test.ts, replayed through the core:

{
  "normalized": {"ecosystem":"npm","name":"@scope/pkg","version":"1.0.0"},
  "duplicateOf": null,
  "status": "ok",
  "code": "verified",
  "packageExists": true,
  "versionExists": true,
  "latestStable": "1.0.0",
  "deprecated": null,
  "yanked": null,
  "vulnerabilities": {
    "status": "ok",
    "code": "known_vulnerabilities",
    "sourceUrl": "https://api.osv.dev/v1/querybatch",
    "fetchedAt": "1970-01-01T00:00:00.000Z",
    "ids": ["GHSA-fixture"]
  }
}

The fixture package, advisory ID and fixed clock are test data, not a live package check. Rows also contain the original input and registry evidence with status, code, sourceUrl and fetchedAt.

packageExists and versionExists are null when the registry verdict is unknown. latestStable is the registry-advertised latest version, only when stable; it is null otherwise. deprecated is the requested npm version's message, capped at 500 characters, or null when absent or unavailable.

PyPI yanked contains state (none, partial, all or no_files) and up to five distinct reasons. A release with no files still exists in metadata. Missing releases and npm rows have yanked: null.

OSV ids are unique and sorted. An empty array means a completed lookup found no known IDs. Null means unavailable or not queried; missing versions do not trigger OSV requests. Advisory details are not fetched. duplicateOf points to the first equivalent row using a zero-based index. The key-value store's OUTPUT report retains the core's ok, partial and error statuses and usage counts.

Input

Field	Default	Accepted input
items	The two packages above	1–100 objects containing ecosystem, name and version. At most 30 unique packages are fetched.
items[].ecosystem	Supply in each object	npm or PyPI, with this capitalization.
items[].name	Supply in each object	1–214 characters. npm accepts scopes; PyPI normalizes case, dots, underscores and hyphens.
items[].version	Supply in each object	1–128 characters. Canonical npm SemVer or exact PyPI PEP 440 version.
maxResults	100	1–100. Limits the processed input prefix, further bounded by remaining charge capacity.

npm rejects ranges, tags, shorthand and leading v. PyPI compares equivalent releases, including trailing zero segments. Invalid entries return invalid_exact_entry. PyPI numeric components beyond JavaScript's safe integer range are unsupported. The complete schema is schemas/input.schema.json.

Pricing

A Version check costs $0.0009. One unique completed check counts, including a missing package or version. Existing versions count only when the OSV lookup also completes. Partial and error rows incur no Version check events. Equivalent duplicates share one check event within a run.

The two-package example costs $0.00185 when both checks complete, including startup. One thousand Version checks cost $0.90, plus $0.00005 per run start at default memory. The default memory is 256 MB. Apify counts one start event per GB of memory, with a minimum of one event. The $0.00005 run start at default memory applies even with no billable checks.

maxResults and charge capacity limit the input prefix before checking. Duplicate and invalid entries occupy prefix slots. A budget below one check event produces no rows. A refused charge stops publication; OUTPUT contains only published rows.

Limits and data freshness

• Input is capped at 32,000 encoded bytes; output at 1,000,000 bytes. Each batch has a 25-second upstream deadline.
• Registry responses allow 4,000,000 bytes each and 16,000,000 streamed bytes in total, with at most 96 request attempts.
• Metadata allows 30,000 version keys and 10,000 files per PyPI release. Large packages can fail without a per-version fallback.
• OSV allows 2,000 IDs per item, 200 characters per ID and an 8,000-byte evidence budget per row. Oversized evidence stays unknown.
• Only official npm, PyPI and OSV HTTPS endpoints are used. Redirects are refused.

Evidence is shared within a run and discarded afterwards. Later runs fetch again. fetchedAt marks source response receipt, not publication or update time; failed requests have null timestamps. No package installation, code execution, malware scan or runtime LLM call occurs.

If a row fails

Status or code	Next step
invalid_exact_entry	Supply a valid registry name and exact version.
osv_unavailable	Read vulnerabilities.code; retry later. Existing registry evidence remains available.
package_limit	Split the batch into groups of at most 30 unique packages.
byte_limit, invalid_registry_payload, output_limit	Read the source evidence; metadata or response shape exceeded supported limits.
deadline, dns_not_found, network_error, http_429	Retry later. A deadline can include an upstream retry delay that would exceed the run budget.

package_missing and version_missing are completed verdicts with status: "ok", not transport errors. Use the schemas/output.schema.json for the versioned report.