Sample on example input
Software Supply Chain, SBOM & Repo Hygiene Composite Suite
Composite 6-check supply-chain audit chaining CycloneDX SBOM, package.json, pyproject.toml, Renovate/Dependabot, env secret-leak scan, and SemVer compatibility.
What you get
- Executive grade B, posture score 83/100 on this example input
- 6 sub-check results; failed on this example:
package_json- Prioritized remediation checklist and disclaimer
Example input
{
"bom_format": "CycloneDX",
"no_untrusted_postinstall": "false"
}
Parameters this suite reads
All parameters this suite reads. Pass your real values as query or JSON parameters; omitted ones use defaults. The suite evaluates the values you pass; it does not crawl or scan live URLs.
bom_format, spec_version, components_have_purl_and_sha256, exact_or_lockfile_pinned, no_untrusted_postinstall, engines_node_specified, requires_python, pep517_build_system, has_lockfile, lockfile_maintenance, grouped_minor_updates, pr_hourly_limit_set, vars, current, target
How to call it (0.05 USDC)
x402: Returns HTTP 402 with a base64 PAYMENT-REQUIRED header (x402 v2, USDC on Base, eip155:8453). Use any x402 v2 client (it signs an EIP-3009 authorization and retries with PAYMENT-SIGNATURE). Fallback: send the USDC yourself, then retry with header X-PAYMENT-TX: <tx hash>.
curl -i 'https://bot-bazaar.fly.dev/v1/x402/suite/supply-chain-and-repo-hygiene?bom_format=CycloneDX&no_untrusted_postinstall=false'
Prepaid key:
curl -s -H 'X-Bazaar-Key: bz_live_YOUR_KEY' 'https://bot-bazaar.fly.dev/v1/x402/suite/supply-chain-and-repo-hygiene?bom_format=CycloneDX&no_untrusted_postinstall=false'
MCP (streamable HTTP, tool suite_supply_chain_and_repo_hygiene):
curl -s https://bot-bazaar.fly.dev/mcp -H 'content-type: application/json' -H 'X-Bazaar-Key: bz_live_YOUR_KEY' -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "suite_supply_chain_and_repo_hygiene", "arguments": {"bom_format": "CycloneDX", "no_untrusted_postinstall": "false"}}}'OpenAI-compatible
Not routed by the chat-completions endpoint; call the x402 route or the MCP tool.
Full sample report (JSON)
{
"suite": "supply-chain-and-repo-hygiene",
"tool": "suite/supply-chain-and-repo-hygiene",
"title": "Software Supply Chain, SBOM & Repository Hygiene Audit Suite",
"valid": true,
"composite_risk_score": 17,
"composite_posture_score": 83,
"executive_grade": "B",
"sub_check_count": 6,
"sub_checks": {
"sbom_cyclonedx": {
"valid": true,
"ntia_minimum_elements_met": true,
"bom_format": "CycloneDX",
"spec_version": "1.5",
"checks": {
"cyclonedx_or_spdx": true,
"modern_spec_version": true,
"purl_and_hashes_present": true
}
},
"package_json": {
"valid": true,
"supply_chain_safe": false,
"checks": {
"exact_or_lockfile_pinned": true,
"no_untrusted_postinstall": false,
"engines_node_specified": true
}
},
"pyproject_toml": {
"valid": true,
"compliant": true,
"requires_python": ">=3.11",
"checks": {
"requires_python_set": true,
"pep517_build_system": true,
"reproducible_lockfile": true
}
},
"renovate_dependabot": {
"valid": true,
"low_noise_config": true,
"checks": {
"lockfile_maintenance": true,
"grouped_minor_updates": true,
"pr_hourly_limit_set": true
}
},
"secret_leak": {
"safe_for_public_config": true,
"checked_vars": [
"PUBLIC_BASE_URL",
"PORT",
"DEMO_MODE"
],
"sensitive_vars_requiring_secret_store": []
},
"semver_compat": {
"valid_semver": true,
"current": "0.7.0",
"target": "0.8.0",
"upgrade_kind": "0_x_minor_update",
"is_upgrade": true
}
},
"passed_sub_checks": [
"sbom_cyclonedx",
"pyproject_toml",
"renovate_dependabot",
"secret_leak",
"semver_compat"
],
"failed_sub_checks": [
"package_json"
],
"informational_sub_checks": [],
"prioritized_remediation_checklist": [
"Maintain CycloneDX/SPDX SBOMs with package URLs (purl) and SHA-256 component digests.",
"Pin dependencies via lockfiles and disable untrusted npm postinstall scripts.",
"Keep private keys, API tokens, and mnemonics strictly in secret stores outside git and fly.toml."
],
"remediation_note": "General hardening checklist for this suite; failed_sub_checks lists the findings specific to the input you passed.",
"input_note": "This suite evaluates the configuration values passed as query or JSON parameters; it does not crawl or scan live URLs. Omitted parameters fall back to the documented defaults.",
"disclaimer": "Automated composite analytical & schema audit only \u2014 not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
"generated_at": 1793508313
}