Console

The API, made operable

Every view here is one endpoint, rendered the way that endpoint's answer is actually shaped. Depth-based traversals get a 3D graph; ordered chains stay flat and readable. The graph holds npm and PyPI side by side.

Services0

Production0

Ecosystemsnpm · pypinpm: / pypi: key prefixes

GET /packages/:name/graph?depth=

Dependency graph

The traversal rendered in 3D, one sphere shell per hop, with the subtree of any node isolatable in a click.

Open GET /packages/:name/:version/analysis

Analysis

Risk, blast radius and attack paths in a single request — the whole picture for one version on one screen.

Open GET /versions/:key/blast-radius

Blast radius

Which services reach a version, and from how far. Distance from the centre is hop count; colour is severity.

Open GET /versions/:key/attack-path

Attack paths

Every route from a service to the compromised version, in order, so the finding can be argued with.

Open GET /versions/:key/risk

Risk

Score per service with the reasons attached, rolled up to the version, next to the rules that produced it.

Open GET /versions/:key/co-maintainers

Co-maintainers

Everything else the same accounts can publish. A stolen token is not scoped to the package you noticed.

Open POST /lockfiles/resolve

Lockfile resolve

Paste pinned lockfile lines and see which ones actually resolved to the compromised version, and for whom.

Open GET /typosquat/:name

Typosquat

Package names within a few edits of a target, with shared-prefix and popularity signals alongside the distance.

Open GET /services

Services

The registry that turns a package graph into an impact graph: repo, team, environment, versions shipped.

Open

Graph modelwhat every query walks

(:Package)-[:HAS_VERSION]->(:Version)
(:Version)-[:DEPENDS_ON]->(:Version)
(:Service)-[:DEPENDS_ON_VERSION]->(:Version)
(:Maintainer)-[:MAINTAINS]->(:Package)

Traversal runs level by level rather than as a variable-length Cypher path, which is why every response carries an explicit hop depth — and why this console can lay it out in space. Version keys are prefixed npm: or pypi:, which is the only thing separating the two ecosystems in the graph.

Rest of the surface

route	does
`GET /health`	liveness
`GET /packages/:name`	package info and known versions
`GET /versions/:key/dependencies`	direct dependencies of one version
`GET /packages/:name/:version/risk`	risk addressed by package and version
`GET /packages/:name/:version/ingest`	crawl npm and write the graph (writes)
`GET /pypi/:name/:version/ingest`	crawl PyPI and write the graph (writes)
`POST /services`	register a service and its dependencies (writes)