YourAITools Pkg Guard API
The PkgGuard API from YourAITools — 3 operation(s) for pkgguard.
Operations 5
POST
/pkgguard/v1/scan
Scan a manifest / lockfile / package list for vulnerable and malicious packages…
#
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/youraitools-co:youraitools-co-pkgguard-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: YourAITools Pkg Guard API
version: 1.0.0
description: Pay-per-call tools for AI agents, paid per request in USDC via x402 on Base, Polygon, Arbitrum One or Solana, with each tool's own spec at https://api.youraitools.co//openapi.json.
contact:
email: hello@youraitools.co
url: https://youraitools.co/built-by-us
servers:
- url: https://api.youraitools.co
tags:
- name: PkgGuard
paths:
/pkgguard/v1/scan:
post:
operationId: scan_dependencies
summary: Scan a manifest / lockfile / package list for vulnerable and malicious packages…
tags:
- PkgGuard
x-payment-info:
price:
mode: fixed
currency: USD
amount: '0.003'
protocols:
- x402: {}
x-x402:
scheme: exact
network: eip155:8453
asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
amount: '3000'
assetSymbol: USDC
x402Versions:
- 2
- 1
networks:
- network: eip155:8453
name: Base
asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: eip155:137
name: Polygon
asset: '0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: eip155:42161
name: Arbitrum One
asset: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
name: Solana
asset: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
symbol: USDC
payTo: FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
manifest:
type: string
maxLength: 512000
description: 'File contents: package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock'
filename:
type: string
type:
type: string
enum:
- package.json
- package-lock.json
- requirements.txt
- Pipfile.lock
- poetry.lock
- go.mod
- Cargo.lock
- composer.lock
include_dev:
type: boolean
default: true
packages:
type: array
maxItems: 500
items:
type: object
properties:
ecosystem:
type: string
enum:
- npm
- PyPI
- Go
- crates.io
- Packagist
- RubyGems
- Maven
- NuGet
- Pub
- Hex
name:
type: string
version:
type: string
required:
- name
- version
responses:
'200':
description: Scan result (payment settled)
content:
application/json:
schema:
type: object
properties:
tier:
type: string
manifest_type:
type: string
package_count:
type: integer
scanned_count:
type: integer
unpinned_count:
type: integer
vulnerable_count:
type: integer
malicious_count:
type: integer
advisory_count:
type: integer
verdict:
type: string
enum:
- clean
- vulnerable
- malicious
highest_severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
by_severity:
type: object
packages:
type: array
items:
type: object
properties:
ecosystem:
type: string
name:
type: string
version:
type: string
version_source:
type: string
enum:
- exact
- range_floor
malicious:
type: boolean
highest_severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
vuln_count:
type: integer
vulns:
type: array
items:
type: object
properties:
id:
type: string
malicious:
type: boolean
severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
cvss_score:
type:
- number
- 'null'
cvss_vector:
type:
- string
- 'null'
summary:
type:
- string
- 'null'
aliases:
type: array
items:
type: string
fixed_in:
type: array
items:
type: string
published:
type:
- string
- 'null'
url:
type: string
description: Only packages with at least one advisory
unpinned:
type: array
items:
type: object
source:
type: object
scanned_at:
type: string
format: date-time
disclaimer:
type: string
'400':
description: Invalid input (never charged)
'402':
description: Payment Required (x402 v2 terms in the PAYMENT-REQUIRED header, v1 terms in the body)
'503':
description: OSV.dev unavailable (never charged)
description: 'Dependency vulnerability scanner API. Scan a manifest / lockfile / package list for vulnerable and malicious packages (up to 500) Search intents: dependency vulnerability scan, npm audit api, sca api, lockfile security scan, cve lookup, software supply chain security.'
/pkgguard/v1/package:
get:
operationId: check_package
summary: Known vulnerabilities and malicious flag for one package version
tags:
- PkgGuard
x-payment-info:
price:
mode: fixed
currency: USD
amount: '0.001'
protocols:
- x402: {}
x-x402:
scheme: exact
network: eip155:8453
asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
amount: '1000'
assetSymbol: USDC
x402Versions:
- 2
- 1
networks:
- network: eip155:8453
name: Base
asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: eip155:137
name: Polygon
asset: '0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: eip155:42161
name: Arbitrum One
asset: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
name: Solana
asset: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
symbol: USDC
payTo: FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte
parameters:
- name: ecosystem
in: query
required: false
schema:
type: string
enum:
- npm
- PyPI
- Go
- crates.io
- Packagist
- RubyGems
- Maven
- NuGet
- Pub
- Hex
default: npm
- name: name
in: query
required: true
schema:
type: string
maxLength: 214
description: Package name, e.g. lodash, requests, github.com/gin-gonic/gin
- name: version
in: query
required: true
schema:
type: string
maxLength: 64
description: Exact version, e.g. 4.17.15
responses:
'200':
description: Package result (payment settled)
content:
application/json:
schema:
type: object
properties:
tier:
type: string
manifest_type:
type: string
package_count:
type: integer
scanned_count:
type: integer
unpinned_count:
type: integer
vulnerable_count:
type: integer
malicious_count:
type: integer
advisory_count:
type: integer
verdict:
type: string
enum:
- clean
- vulnerable
- malicious
highest_severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
by_severity:
type: object
packages:
type: array
items:
type: object
properties:
ecosystem:
type: string
name:
type: string
version:
type: string
version_source:
type: string
enum:
- exact
- range_floor
malicious:
type: boolean
highest_severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
vuln_count:
type: integer
vulns:
type: array
items:
type: object
properties:
id:
type: string
malicious:
type: boolean
severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
cvss_score:
type:
- number
- 'null'
cvss_vector:
type:
- string
- 'null'
summary:
type:
- string
- 'null'
aliases:
type: array
items:
type: string
fixed_in:
type: array
items:
type: string
published:
type:
- string
- 'null'
url:
type: string
description: Only packages with at least one advisory
unpinned:
type: array
items:
type: object
source:
type: object
scanned_at:
type: string
format: date-time
disclaimer:
type: string
'400':
description: Invalid input (never charged)
'402':
description: Payment Required (x402 v2 terms in the PAYMENT-REQUIRED header, v1 terms in the body)
'503':
description: OSV.dev unavailable (never charged)
description: 'Package vulnerability lookup API. Known vulnerabilities and malicious flag for one package version. Search intents: package vulnerability check, is this npm package safe, cve lookup api, pypi vulnerability, malicious package check, osv lookup.'
post:
operationId: check_package_post
summary: Same as GET, POST {"ecosystem","name","version"}
tags:
- PkgGuard
x-payment-info:
price:
mode: fixed
currency: USD
amount: '0.001'
protocols:
- x402: {}
x-x402:
scheme: exact
network: eip155:8453
asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
amount: '1000'
assetSymbol: USDC
x402Versions:
- 2
- 1
networks:
- network: eip155:8453
name: Base
asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: eip155:137
name: Polygon
asset: '0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: eip155:42161
name: Arbitrum One
asset: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831'
symbol: USDC
payTo: '0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F'
- network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
name: Solana
asset: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
symbol: USDC
payTo: FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
ecosystem:
type: string
enum:
- npm
- PyPI
- Go
- crates.io
- Packagist
- RubyGems
- Maven
- NuGet
- Pub
- Hex
default: npm
name:
type: string
version:
type: string
required:
- name
- version
responses:
'200':
description: Package result (payment settled)
content:
application/json:
schema:
type: object
properties:
tier:
type: string
manifest_type:
type: string
package_count:
type: integer
scanned_count:
type: integer
unpinned_count:
type: integer
vulnerable_count:
type: integer
malicious_count:
type: integer
advisory_count:
type: integer
verdict:
type: string
enum:
- clean
- vulnerable
- malicious
highest_severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
by_severity:
type: object
packages:
type: array
items:
type: object
properties:
ecosystem:
type: string
name:
type: string
version:
type: string
version_source:
type: string
enum:
- exact
- range_floor
malicious:
type: boolean
highest_severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
vuln_count:
type: integer
vulns:
type: array
items:
type: object
properties:
id:
type: string
malicious:
type: boolean
severity:
type: string
enum:
- CRITICAL
- HIGH
- MEDIUM
- LOW
- UNKNOWN
- NONE
cvss_score:
type:
- number
- 'null'
cvss_vector:
type:
- string
- 'null'
summary:
type:
- string
- 'null'
aliases:
type: array
items:
type: string
fixed_in:
type: array
items:
type: string
published:
type:
- string
- 'null'
url:
type: string
description: Only packages with at least one advisory
unpinned:
type: array
items:
type: object
source:
type: object
scanned_at:
type: string
format: date-time
disclaimer:
type: string
'400':
description: Invalid input (never charged)
'402':
description: Payment Required (x402 v2 terms in the PAYMENT-REQUIRED header, v1 terms in the body)
'503':
description: OSV.dev unavailable (never charged)
description: 'Package vulnerability lookup API. Same as GET, POST {"ecosystem","name","version"}. Search intents: package vulnerability check, is this npm package safe, cve lookup api, pypi vulnerability, malicious package check, osv lookup.'
/pkgguard/v1/preview:
get:
operationId: preview_package
summary: Free verdict + counts for one package (10/min/IP)
security: []
responses:
'200':
description: OK
'429':
description: Free tier rate limit
'503':
description: OSV.dev unavailable
parameters:
- name: ecosystem
in: query
required: false
schema:
type: string
enum:
- npm
- PyPI
- Go
- crates.io
- Packagist
- RubyGems
- Maven
- NuGet
- Pub
- Hex
default: npm
- name: name
in: query
required: true
schema:
type: string
maxLength: 214
description: Package name, e.g. lodash, requests, github.com/gin-gonic/gin
- name: version
in: query
required: true
schema:
type: string
maxLength: 64
description: Exact version, e.g. 4.17.15
tags:
- PkgGuard
post:
operationId: preview_scan
summary: Free verdict + counts for a manifest or up to 25 packages
security: []
responses:
'200':
description: OK
'429':
description: Free tier rate limit
'503':
description: OSV.dev unavailable
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
manifest:
type: string
maxLength: 512000
description: 'File contents: package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock'
filename:
type: string
type:
type: string
enum:
- package.json
- package-lock.json
- requirements.txt
- Pipfile.lock
- poetry.lock
- go.mod
- Cargo.lock
- composer.lock
include_dev:
type: boolean
default: true
packages:
type: array
maxItems: 500
items:
type: object
properties:
ecosystem:
type: string
enum:
- npm
- PyPI
- Go
- crates.io
- Packagist
- RubyGems
- Maven
- NuGet
- Pub
- Hex
name:
type: string
version:
type: string
required:
- name
- version
tags:
- PkgGuard
components:
securitySchemes:
creditsKey:
type: http
scheme: bearer
description: yatc_... credits key