# ADX trial starter

New, dependency-free sample code for a public starter repository. Node.js 22 or later.
This directory contains only the public example; publish this directory, never the private ADX application repository.

The invitation-only trial supplies a reviewed subset of GitHub Advisory Database records in OSV format, for exact npm, PyPI and NuGet package/version inputs. It ends October 1, 2026 at 04:00 UTC (through September 30 Eastern). No card, wallet or automatic paid conversion. Five packages per query; 100 successful responses or 10,000,000 logical JSON data bytes per UTC day, whichever is exhausted first, shared by REST and MCP. Ten admitted attempts per minute and service-wide limits also apply.

1. Request an invitation at https://www.dajotaappfactory.com/demo.html?campaignCode=github-starter#signup.
2. Keep the private receipt and check request delivery. After acknowledgment, reply from the same mailbox to contact@dajotaappfactory.com with the request reference to verify ownership. Do not send a key or invitation in email.
3. After approval, open the secure activation page from the verified ADX origin. Accept terms only with your operator's authorization. Store the once-shown key privately. This example never activates invitations or accepts terms for you.
4. Set `ADX_API_KEY` in a private process environment using your secret manager. Never place it in a command argument, URL, repository, or shared transcript.
5. Run one bounded query:

```text
node adx-trial-client.mjs rest npm lodash 4.17.20
node adx-trial-client.mjs mcp npm lodash 4.17.20
```

The REST route is `POST https://api.dajotaappfactory.com/v1/demo/security/query`. Put the key in the `Authorization: Bearer …` header; the body is:

```json
{"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}],"offset":0,"limit":5}
```

MCP uses `https://api.dajotaappfactory.com/mcp`. The client initializes the protocol, retains any issued session header, then calls:

```json
{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"demo_security_query","arguments":{"request":{"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}],"offset":0,"limit":5}}}}
```

Inspect HTTP errors and MCP error/structured status separately. HTTP 200 does not imply a successful tool call. Inspect `allowance`, `retryAt`, each finding's `match`, `evidence.sourceUrl`, `evidence.retrievedAt`, and `evidence.snapshotHash`. `sourceUpdatedAt: null` means unknown. `hasMoreCandidates` means another bounded candidate page can exist; pagination happens before publication filtering. Advance offset only deliberately, at most 5000; limits are 1–50. Never infer completeness from an empty page or no match.

Use `GET /v1/demo/usage` or MCP `demo_usage` for allowance without consuming a data response. Authentication remains in headers. Do not retry activation automatically; reconcile any lost key response with support. This starter does not automatically retry queries either.

Try the labeled local demonstration at https://www.dajotaappfactory.com/agent-builders.html#sample. It contains synthetic data, not a current advisory. ADX is best effort: verify source evidence independently before changing dependencies. Preserve source attribution and license notices. CISA, EPSS and NVD enrichment is outside the public trial offer.

Code license: MIT. Advisory data has its separately identified source license.