Development x402 offerings

Normalize npm or PyPI package reality: existence, requested-version existence, resolved/latest version, staleness, deprecation/yank state when available, license and runtime requirement. No dependency graph or vulnerability analysis. Public registries only; unsupported provider fields are null.

Find API docs, developer portal, candidate base URLs and auth docs.

Perform a bounded static discovery pass for machine-usable documentation: llms.txt, Markdown alternates, developer/API/auth docs, OpenAPI/Swagger and MCP candidates. Candidates are returned only after bounded verification. Maximum 10 HTTP requests, no JavaScript, recursive crawl or authenticated content.

Check whether a named branch exists in a public GitHub repository and return the branch current head commit SHA and URL without cloning. This is a read-only branch-state lookup; branch protection stays unknown when the public API does not expose it. Base mainnet USDC

Resolve a public GitHub ref to commit metadata without fetching a diff. Verification is reported as published by GitHub and is not independently re-signed by Forest. Base mainnet USDC

Detect material public HTTP endpoint changes using bounded response metadata and deterministic hashing. ETag and Last-Modified are evidence; arbitrary body downloads are capped. Base mainnet USDC

Cheaply detect material public repository state changes with a deterministic hash of existence, branch and archive state. Timestamps and unrelated metadata do not trigger a change. Base mainnet USDC

Check lightweight metadata for a path in a public GitHub repository at an optional ref. It does not clone or download large file contents. Base mainnet USDC

Measure bounded sequential timing samples for one public HTTP endpoint. Samples are hard-capped at three and this is never a load-testing or port-scanning service. Base mainnet USDC

Resolve the current public GitHub repository state without cloning or customer OAuth. Archived, fork, branch and license fields reflect only public API facts; private repositories are unsupported. Base mainnet USDC

Fingerprint the normalized metadata state of one public GitHub release and optionally compare it with a caller-provided previous SHA-256 hash. Forest uses the existing bounded release lookup and does not download assets, inspect repository contents or mutate GitHub state. Base mainnet USDC

Verify whether a specific npm or PyPI package version exists before installation, resolve the current/latest version, and report deprecation or yank state when available, plus license and runtime requirement. This is a public-registry package install preflight; it does not resolve dependency graphs or perform vulnerability analysis. Base mainnet USDC

Detect whether normalized public npm or PyPI package registry state changed since a saved fingerprint. Returns a deterministic SHA-256 fingerprint for package/version existence, latest/resolved version, deprecation or yank state, license and runtime requirement. No dependency graph, vulnerability scan or registry mutation. Base mainnet USDC

Resolve a public GitHub release into the most plausible downloadable asset for a normalized OS/architecture target, excluding source/signature/checksum files and linking checksum companions when present. Returns ambiguity instead of silently choosing tied candidates. No private repositories or customer authentication. Base mainnet USDC

Normalize declared package license metadata toward SPDX; no legal compatibility conclusion. Base mainnet USDC

Fingerprint the structural machine contract of a public OpenAPI or Swagger specification and compare it with an optional previous SHA-256 fingerprint to detect API contract drift. Paths, operations, parameters, security and component schema structure are tracked while documentation-only text and examples are ignored. No API operation is executed. Base mainnet USDC

Discover machine-readable integration documentation from a public developer/docs page: llms.txt, Markdown alternates, API/auth docs, OpenAPI or Swagger specifications, and MCP candidates. Candidates are returned only after bounded verification. Maximum 10 HTTP requests; no JavaScript, recursive crawl or authenticated content. Base mainnet USDC

Extract bounded static HTML form structure without submitting anything. Forest returns field names/types/labels/constraints and submit-control structure, but never current values, textarea contents, hidden tokens, passwords, cookies or authentication material. Base mainnet USDC

Inspect the declared request and response contract for one exact OpenAPI or Swagger operation before integration. Returns parameters, request-body content types, response statuses/content types and declared security scheme names without executing the endpoint or resolving external references. Base mainnet USDC

Compare two public OpenAPI or Swagger contracts and determine whether the API update contains directly observable breaking compatibility changes. Detects removed operations, newly required request inputs, narrowed inline enums, removed content types or successful responses and tightened authentication; unsupported compatibility questions remain unknown. No API operation is executed. Base mainnet USDC

Validate one caller-supplied JSON request or response payload against the documented JSON schema for one exact OpenAPI or Swagger operation. Forest fetches only the supplied public specification, never invokes the described API operation, resolves only bounded local references, and reuses the same deterministic schema subset as json.validate. Base mainnet USDC

Discover the callable public API behind a developer or documentation page: identify candidate API base URLs, developer portals, machine-readable API docs and authentication documentation for integration setup. Base mainnet USDC

Compose bounded API discovery with one deterministic OpenAPI or Swagger preflight into a concise agent-readiness state. The check does not authenticate, call discovered API operations, or prove business-level API correctness. Base mainnet USDC

Parse a document (in any format) and re-emit it in the RFC 8785 JSON Canonicalization Scheme form — sorted keys, canonical number/string formatting — plus the SHA-256 of the canonical bytes for stabl…