oxpecker.dev

mx

mx10.antispam.mailspamprotection.com

mx20.antispam.mailspamprotection.com

mx30.antispam.mailspamprotection.com

ns

ns2.siteground.net

ns1.siteground.net

caa

txt

v=spf1 +a +mx include:oxpecker.dev.spf.auto.dnssmarthost.net ~all

dmarc

v=DMARC1; p=none; aspf=r; adkim=r;

# oxpecker

> oxpecker watches third-party API vendors and reports when they ship a
> change that breaks code calling them.

This file exists so an agent can answer one question in a codebase it has
never seen: does this repository call any of the vendors oxpecker watches?
It is generated from oxpecker's own vendor catalog, so it is exactly the
list the product uses - 68 vendors, not a marketing subset.

## How to read this

EVERY ENTRY LIVES BELOW THE `## Vendors` HEADING. Nothing above it is
data. The examples below are written in the entry shape on purpose, and
indented so that no line above the heading can be read as one; a parser
that scans the whole file anyway still comes back with a vendor called
`<vendor>`, which does not exist. Start after the heading, stop at the
next one, and take only lines that begin in the first column.

ONE ENTRY PER LINE. Every line is `<vendor> <evidence>` and nothing else:

    <vendor> pkg:<ecosystem>:<name>
    <vendor> host:<hostname>

A vendor appears on as many lines as it has entries. This shape is
deliberate: an earlier version packed a vendor's entries onto one line
separated by pipes, and a line-based extraction silently swallowed the
separator into the package name - losing a vendor that WAS present, with
no error. One self-contained entry per line cannot fail that way.

Split each line on the FIRST space, then on the first two colons of the
remainder. Everything after `pkg:<ecosystem>:` is the package name and may
itself contain colons - maven coordinates do:

    stripe pkg:maven:com.stripe:stripe-java

A `pkg:` entry is a dependency name as it appears in a manifest. A `host:`
entry is a hostname that appears in code, config, or an environment default
when the API is called directly rather than through an SDK. Either is
evidence; a repository can use a vendor through one and not the other.

NEITHER IS MATCHED BY A LITERAL GREP. Both need a rule, and a reader
that searches for a published value exactly as it is written here
misses real dependencies:

  - A package name matches case-insensitively, and for `pypi` also with
    `-`, `_` and `.` treated as the same character (PEP 503). This list
    publishes `shopifyapi` and `Adyen`; the manifests that install them
    say `ShopifyAPI==12.0.0` and `adyen>=9`. Both are matches.
  - A host matches AT A LABEL BOUNDARY. Get the hostname out of what
    it sits in first: it is what falls between `//` and the next `/`,
    `:`, `?` or end of the token. WITH NO `//` IN FRONT OF IT, the
    token itself is the hostname - strip quotes, a trailing comma and
    a trailing dot. Most occurrences are URLs, but an environment
    default or a config literal is a bare hostname, and an extraction
    rule that insists on a scheme skips every one of them. Compare
    without case. Then, after dropping a leading `*.` from the
    published value, the hostname either IS that value or ends with a
    dot and then that value.

    `*.atlassian.net` is how jira appears here and
    `mycompany.atlassian.net` is how it appears in a repository.
    `myshopify.com` carries no star, and `acme.myshopify.com` matches
    it under the same rule - which is why the rule is written once and
    applied to every entry, starred or not. A plain suffix test is NOT
    this rule: it also reads `evilmyshopify.com` as shopify, and that
    dot is the whole difference between a subdomain and a domain
    somebody registered to resemble one. 8 of the published
    values carry a star.

ONE VALUE CAN NAME TWO VENDORS, and this is the one place counting
is a judgement rather than a lookup:

    pkg:pypi:atlassian-python-api  ->  bitbucket, jira

Finding it means the repository calls ONE of those vendors, not all
of them - the package installs a client for each. A `host:` match is
what settles which. Absent one, report the finding once, name every
candidate, and say the evidence does not distinguish them.

Where each ecosystem declares its dependencies:

    composer   composer.json, composer.lock
    go         go.mod, go.sum
    maven      pom.xml, build.gradle, build.gradle.kts
    npm        package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
    nuget      *.csproj, packages.config, Directory.Packages.props
    pypi       requirements*.txt, pyproject.toml, poetry.lock, Pipfile, setup.py
    rubygems   Gemfile, Gemfile.lock, *.gemspec

## Vendors (68 vendors, 251 entries)

adyen pkg:npm:@adyen/api-library
adyen pkg:pypi:Adyen
adyen host:*.adyen.com
adyen host:checkout-test.adyen.com
algolia pkg:composer:algolia/algoliasearch-client-php
algolia pkg:go:github.com/algolia/algoliasearch-client-go
algolia pkg:npm:algoliasearch
algolia pkg:pypi:algoliasearch
algolia pkg:rubygems:algolia
algolia host:*.algolia.net
algolia host:*.algolianet.com
anthropic pkg:npm:@anthropic-ai/sdk
anthropic pkg:pypi:anthropic
anthropic pkg:rubygems:anthropic
anthropic host:api.anthropic.com
asana pkg:npm:asana
asana pkg:pypi:asana
asana host:app.asana.com
auth0 pkg:go:github.com/auth0/go-auth0
auth0 pkg:npm:auth0
auth0 pkg:nuget:auth0.core
auth0 pkg:pypi:auth0-python
auth0 pkg:rubygems:auth0
auth0 host:auth0.com
bamboohr host:bamboohr.com
basecamp host:3.basecampapi.com
bitbucket pkg:npm:bitbucket
bitbucket pkg:pypi:atlassian-python-api
bitbucket host:api.bitbucket.org
box pkg:npm:box-node-sdk
box pkg:pypi:boxsdk
box host:api.box.com
cal-com pkg:npm:@calcom/api
cal-com host:api.cal.com
chargebee pkg:npm:chargebee
chargebee pkg:pypi:chargebee
chargebee host:*.chargebee.com
circleci host:circleci.com
clerk pkg:npm:@clerk/backend
clerk pkg:pypi:clerk-backend-api
clerk host:api.clerk.com
cloudflare pkg:go:github.com/cloudflare/cloudflare-go
cloudflare pkg:npm:cloudflare
cloudflare pkg:pypi:cloudflare
cloudflare host:api.cloudflare.com
coda pkg:npm:@codahq/packs-sdk
coda pkg:pypi:codaio
coda host:coda.io
cohere pkg:npm:cohere-ai
cohere pkg:pypi:cohere
cohere host:api.cohere.com
datadog pkg:npm:@datadog/datadog-api-client
datadog pkg:pypi:datadog-api-client
datadog host:api.ap1.datadoghq.com
datadog host:api.ap2.datadoghq.com
datadog host:api.datadoghq.com
datadog host:api.datadoghq.eu
datadog host:api.ddog-gov.com
datadog host:api.uk1.datadoghq.com
datadog host:api.us2.ddog-gov.com
datadog host:api.us3.datadoghq.com
datadog host:api.us5.datadoghq.com
digitalocean pkg:go:github.com/digitalocean/godo
digitalocean pkg:npm:dots-wrapper
digitalocean pkg:pypi:python-digitalocean
digitalocean pkg:rubygems:droplet_kit
digitalocean host:api.digitalocean.com
discord pkg:npm:discord.js
discord pkg:pypi:discord.py
discord host:discord.com
docusign pkg:npm:docusign-esign
docusign pkg:pypi:docusign-esign
docusign host:*.docusign.net
docusign host:demo.docusign.net
docusign host:www.docusign.net
dwolla pkg:composer:dwolla/dwollaswagger
dwolla pkg:npm:dwolla-v2
dwolla pkg:pypi:dwollav2
dwolla pkg:rubygems:dwolla_v2
dwolla host:api-sandbox.dwolla.com
dwolla host:api.dwolla.com
elevenlabs pkg:npm:@elevenlabs/elevenlabs-js
elevenlabs pkg:npm:elevenlabs
elevenlabs pkg:pypi:elevenlabs
elevenlabs host:api.elevenlabs.io
figma pkg:npm:figma-api
figma host:api.figma.com
github pkg:composer:knplabs/github-api
github pkg:go:github.com/google/go-github
github pkg:maven:org.kohsuke:github-api
github pkg:npm:@octokit/core
github pkg:npm:@octokit/rest
github pkg:npm:octokit
github pkg:pypi:pygithub
github pkg:rubygems:octokit
github host:api.github.com
groq pkg:npm:groq-sdk
groq pkg:pypi:groq
groq host:api.groq.com
increase pkg:npm:increase
increase pkg:pypi:increase
increase host:api.increase.com
intercom pkg:npm:intercom-client
intercom pkg:pypi:python-intercom
intercom host:api.intercom.io
jira pkg:npm:jira-client
jira pkg:pypi:atlassian-python-api
jira pkg:pypi:jira
jira host:*.atlassian.net
klaviyo pkg:npm:klaviyo-api
klaviyo pkg:pypi:klaviyo-api
klaviyo host:a.klaviyo.com
launchdarkly pkg:npm:launchdarkly-node-server-sdk
launchdarkly pkg:pypi:launchdarkly-server-sdk
launchdarkly host:app.launchdarkly.com
linode pkg:npm:@linode/api-v4
linode pkg:pypi:linode-api4
linode host:api.linode.com
lithic pkg:go:github.com/lithic-com/lithic-go
lithic pkg:npm:lithic
lithic pkg:pypi:lithic
lithic host:api.lithic.com
mailchimp pkg:npm:@mailchimp/mailchimp_marketing
mailchimp pkg:pypi:mailchimp-marketing
mailchimp host:*.api.mailchimp.com
marqeta host:marqeta.com
metronome pkg:npm:@metronome/sdk
metronome pkg:pypi:metronome-sdk
metronome host:api.metronome.com
modern-treasury pkg:go:github.com/Modern-Treasury/modern-treasury-go
modern-treasury pkg:npm:modern-treasury
modern-treasury pkg:pypi:modern-treasury
modern-treasury host:app.moderntreasury.com
mollie pkg:composer:mollie/mollie-api-php
mollie pkg:npm:@mollie/api-client
mollie pkg:pypi:mollie-api-python
mollie host:api.mollie.com
mx pkg:npm:mx-platform-node
mx pkg:pypi:mx-platform-python
mx host:api.mx.com
mx host:int-api.mx.com
neon pkg:npm:@neondatabase/api-client
neon pkg:pypi:neon-api
neon host:console.neon.tech
notion pkg:npm:@notionhq/client
notion pkg:pypi:notion-client
notion host:api.notion.com
nutshell host:app.nutshell.com
openai pkg:composer:openai-php/client
openai pkg:go:github.com/sashabaranov/go-openai
openai pkg:npm:openai
openai pkg:nuget:openai
openai pkg:pypi:openai
openai host:api.openai.com
paddle pkg:npm:@paddle/paddle-node-sdk
paddle host:api.paddle.com
paddle host:sandbox-api.paddle.com
pagerduty pkg:npm:@pagerduty/pdjs
pagerduty pkg:pypi:pdpyras
pagerduty host:api.pagerduty.com
pipedrive pkg:npm:pipedrive
pipedrive host:api.pipedrive.com
plaid pkg:npm:plaid
plaid pkg:pypi:plaid-python
plaid host:development.plaid.com
plaid host:production.plaid.com
plaid host:sandbox.plaid.com
posthog pkg:npm:posthog-node
posthog pkg:pypi:posthog
posthog host:eu.posthog.com
posthog host:us.posthog.com
ramp host:api.ramp.com
ramp host:demo-api.ramp.com
render host:api.render.com
resend pkg:npm:resend
resend pkg:pypi:resend
resend host:api.resend.com
retell pkg:npm:retell-client-js-sdk
retell pkg:npm:retell-sdk
retell pkg:pypi:retell-sdk
retell host:api.retellai.com
revenuecat pkg:npm:@revenuecat/purchases-capacitor
revenuecat pkg:npm:@revenuecat/purchases-js
revenuecat pkg:npm:cordova-plugin-purchases
revenuecat pkg:npm:react-native-purchases
revenuecat host:api.revenuecat.com
salesflare host:api.salesflare.com
sendgrid pkg:composer:sendgrid/sendgrid
sendgrid pkg:go:github.com/sendgrid/sendgrid-go
sendgrid pkg:maven:com.sendgrid:sendgrid-java
sendgrid pkg:npm:@sendgrid/client
sendgrid pkg:npm:@sendgrid/mail
sendgrid pkg:npm:sendgrid
sendgrid pkg:nuget:sendgrid
sendgrid pkg:pypi:sendgrid
sendgrid pkg:rubygems:sendgrid-ruby
sendgrid host:api.eu.sendgrid.com
sendgrid host:api.sendgrid.com
sentry host:sentry.io
shopify pkg:composer:shopify/shopify-api
shopify pkg:npm:@shopify/admin-api-client
shopify pkg:npm:@shopify/shopify-api
shopify pkg:pypi:shopifyapi
shopify pkg:rubygems:shopify_api
shopify host:myshopify.com
shortcut pkg:npm:@shortcut/client
shortcut host:api.app.shortcut.com
slack pkg:go:github.com/slack-go/slack
slack pkg:npm:@slack/bolt
slack pkg:npm:@slack/web-api
slack pkg:pypi:slack-sdk
slack pkg:rubygems:slack-ruby-client
slack host:api.slack.com
slack host:hooks.slack.com
slack host:slack.com
stripe pkg:composer:stripe/stripe-php
stripe pkg:go:github.com/stripe/stripe-go
stripe pkg:maven:com.stripe:stripe-java
stripe pkg:npm:stripe
stripe pkg:nuget:stripe.net
stripe pkg:pypi:stripe
stripe pkg:rubygems:stripe
stripe host:api.stripe.com
supabase host:api.supabase.com
telnyx pkg:npm:telnyx
telnyx pkg:pypi:telnyx
telnyx host:api.telnyx.com
todoist pkg:npm:@doist/todoist-api-typescript
todoist pkg:pypi:todoist-api-python
todoist host:api.todoist.com
together pkg:npm:together-ai
together pkg:pypi:together
together host:api.together.ai
together host:api.together.xyz
twilio pkg:composer:twilio/sdk
twilio pkg:go:github.com/twilio/twilio-go
twilio pkg:npm:twilio
twilio pkg:nuget:twilio
twilio pkg:pypi:twilio
twilio pkg:rubygems:twilio-ruby
twilio host:api.twilio.com
vercel pkg:npm:@vercel/sdk
vercel host:api.vercel.com
webflow pkg:npm:webflow-api
webflow host:api.webflow.com
xero pkg:npm:xero-node
xero pkg:pypi:xero-python
xero host:api.xero.com
zendesk pkg:npm:sunshine-conversations-client
zendesk host:*.zendesk.com
zendesk host:api.smooch.io

## What this list does not tell you

That a vendor is absent from a repository is harder to establish than that
it is present. A `pkg:` or `host:` match is evidence anyone can check by
opening the file. Finding nothing is not the same fact: a repository can
reach a vendor through a wrapper, a gateway, a hostname built from parts at
runtime, or a service this scan never reads. Report a null result as what
was searched, not as an all-clear.