{"openapi":"3.1.0","info":{"title":"PkgGuard","version":"0.1.1","contact":{"name":"PkgGuard","email":"hello@youraitools.co","url":"https://agentgate-source.pages.dev/x402-pkgguard/"},"license":{"name":"MIT"},"x-service-name":"PkgGuard by AgentGate","x-category":"security","x-categories":["security","developer-tools"],"x-tags":["security","dependencies","vulnerability-scan","supply-chain","malware"],"x-logo":{"url":"https://agentgate-source.pages.dev/icons/pkgguard.png"},"description":"Dependency security scan for AI agents, coding agents and CI. Send a manifest or lockfile (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock) or a package list and get known vulnerabilities (CVE/GHSA ids, severity, CVSS, fixed-in versions) and confirmed-malicious packages per dependency. Data: OSV.dev (CC-BY 4.0). Informational, not a security audit.","x-guidance":"POST /v1/scan {\"manifest\": \"<file contents>\"} ($0.003, up to 500 packages) or GET /v1/package?ecosystem=npm&name=lodash&version=4.17.15 ($0.001). USDC on Base via x402, charged only on HTTP 200. Free preview (verdict + counts): /v1/preview."},"servers":[{"url":"https://api.youraitools.co/pkgguard"}],"externalDocs":{"description":"Source and docs","url":"https://agentgate-source.pages.dev/x402-pkgguard/"},"paths":{"/v1/scan":{"post":{"operationId":"scan_dependencies","summary":"Scan a manifest / lockfile / package list for vulnerable and malicious packages (up to 500)","tags":["paid"],"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.003"},"protocols":[{"x402":{}}]},"x-x402":{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","amount":"3000","assetSymbol":"USDC","x402Versions":[2,1]},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"manifest":{"type":"string","maxLength":512000,"description":"File contents: package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock"},"filename":{"type":"string"},"type":{"type":"string","enum":["package.json","package-lock.json","requirements.txt","Pipfile.lock","poetry.lock","go.mod","Cargo.lock","composer.lock"]},"include_dev":{"type":"boolean","default":true},"packages":{"type":"array","maxItems":500,"items":{"type":"object","properties":{"ecosystem":{"type":"string","enum":["npm","PyPI","Go","crates.io","Packagist","RubyGems","Maven","NuGet","Pub","Hex"]},"name":{"type":"string"},"version":{"type":"string"}},"required":["name","version"]}}}}}}},"responses":{"200":{"description":"Scan result (payment settled)","content":{"application/json":{"schema":{"type":"object","properties":{"tier":{"type":"string"},"manifest_type":{"type":"string"},"package_count":{"type":"integer"},"scanned_count":{"type":"integer"},"unpinned_count":{"type":"integer"},"vulnerable_count":{"type":"integer"},"malicious_count":{"type":"integer"},"advisory_count":{"type":"integer"},"verdict":{"type":"string","enum":["clean","vulnerable","malicious"]},"highest_severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"by_severity":{"type":"object"},"packages":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"version_source":{"type":"string","enum":["exact","range_floor"]},"malicious":{"type":"boolean"},"highest_severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"vuln_count":{"type":"integer"},"vulns":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"malicious":{"type":"boolean"},"severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"cvss_score":{"type":["number","null"]},"cvss_vector":{"type":["string","null"]},"summary":{"type":["string","null"]},"aliases":{"type":"array","items":{"type":"string"}},"fixed_in":{"type":"array","items":{"type":"string"}},"published":{"type":["string","null"]},"url":{"type":"string"}}}}}},"description":"Only packages with at least one advisory"},"unpinned":{"type":"array","items":{"type":"object"}},"source":{"type":"object"},"scanned_at":{"type":"string","format":"date-time"},"disclaimer":{"type":"string"}}}}}},"400":{"description":"Invalid input (never charged)"},"402":{"description":"Payment Required (x402 v2 terms in the PAYMENT-REQUIRED header, v1 terms in the body)"},"503":{"description":"OSV.dev unavailable (never charged)"}}}},"/v1/package":{"get":{"operationId":"check_package","summary":"Known vulnerabilities and malicious flag for one package version","tags":["paid"],"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.001"},"protocols":[{"x402":{}}]},"x-x402":{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","amount":"1000","assetSymbol":"USDC","x402Versions":[2,1]},"parameters":[{"name":"ecosystem","in":"query","required":false,"schema":{"type":"string","enum":["npm","PyPI","Go","crates.io","Packagist","RubyGems","Maven","NuGet","Pub","Hex"],"default":"npm"}},{"name":"name","in":"query","required":true,"schema":{"type":"string","maxLength":214},"description":"Package name, e.g. lodash, requests, github.com/gin-gonic/gin"},{"name":"version","in":"query","required":true,"schema":{"type":"string","maxLength":64},"description":"Exact version, e.g. 4.17.15"}],"responses":{"200":{"description":"Package result (payment settled)","content":{"application/json":{"schema":{"type":"object","properties":{"tier":{"type":"string"},"manifest_type":{"type":"string"},"package_count":{"type":"integer"},"scanned_count":{"type":"integer"},"unpinned_count":{"type":"integer"},"vulnerable_count":{"type":"integer"},"malicious_count":{"type":"integer"},"advisory_count":{"type":"integer"},"verdict":{"type":"string","enum":["clean","vulnerable","malicious"]},"highest_severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"by_severity":{"type":"object"},"packages":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"version_source":{"type":"string","enum":["exact","range_floor"]},"malicious":{"type":"boolean"},"highest_severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"vuln_count":{"type":"integer"},"vulns":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"malicious":{"type":"boolean"},"severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"cvss_score":{"type":["number","null"]},"cvss_vector":{"type":["string","null"]},"summary":{"type":["string","null"]},"aliases":{"type":"array","items":{"type":"string"}},"fixed_in":{"type":"array","items":{"type":"string"}},"published":{"type":["string","null"]},"url":{"type":"string"}}}}}},"description":"Only packages with at least one advisory"},"unpinned":{"type":"array","items":{"type":"object"}},"source":{"type":"object"},"scanned_at":{"type":"string","format":"date-time"},"disclaimer":{"type":"string"}}}}}},"400":{"description":"Invalid input (never charged)"},"402":{"description":"Payment Required (x402 v2 terms in the PAYMENT-REQUIRED header, v1 terms in the body)"},"503":{"description":"OSV.dev unavailable (never charged)"}}},"post":{"operationId":"check_package_post","summary":"Same as GET, POST {\"ecosystem\",\"name\",\"version\"}","tags":["paid"],"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.001"},"protocols":[{"x402":{}}]},"x-x402":{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F","amount":"1000","assetSymbol":"USDC","x402Versions":[2,1]},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"ecosystem":{"type":"string","enum":["npm","PyPI","Go","crates.io","Packagist","RubyGems","Maven","NuGet","Pub","Hex"],"default":"npm"},"name":{"type":"string"},"version":{"type":"string"}},"required":["name","version"]}}}},"responses":{"200":{"description":"Package result (payment settled)","content":{"application/json":{"schema":{"type":"object","properties":{"tier":{"type":"string"},"manifest_type":{"type":"string"},"package_count":{"type":"integer"},"scanned_count":{"type":"integer"},"unpinned_count":{"type":"integer"},"vulnerable_count":{"type":"integer"},"malicious_count":{"type":"integer"},"advisory_count":{"type":"integer"},"verdict":{"type":"string","enum":["clean","vulnerable","malicious"]},"highest_severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"by_severity":{"type":"object"},"packages":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"version_source":{"type":"string","enum":["exact","range_floor"]},"malicious":{"type":"boolean"},"highest_severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"vuln_count":{"type":"integer"},"vulns":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"malicious":{"type":"boolean"},"severity":{"type":"string","enum":["CRITICAL","HIGH","MEDIUM","LOW","UNKNOWN","NONE"]},"cvss_score":{"type":["number","null"]},"cvss_vector":{"type":["string","null"]},"summary":{"type":["string","null"]},"aliases":{"type":"array","items":{"type":"string"}},"fixed_in":{"type":"array","items":{"type":"string"}},"published":{"type":["string","null"]},"url":{"type":"string"}}}}}},"description":"Only packages with at least one advisory"},"unpinned":{"type":"array","items":{"type":"object"}},"source":{"type":"object"},"scanned_at":{"type":"string","format":"date-time"},"disclaimer":{"type":"string"}}}}}},"400":{"description":"Invalid input (never charged)"},"402":{"description":"Payment Required (x402 v2 terms in the PAYMENT-REQUIRED header, v1 terms in the body)"},"503":{"description":"OSV.dev unavailable (never charged)"}}}},"/v1/preview":{"get":{"operationId":"preview_package","summary":"Free verdict + counts for one package (10/min/IP)","security":[],"responses":{"200":{"description":"OK"},"429":{"description":"Free tier rate limit"},"503":{"description":"OSV.dev unavailable"}},"parameters":[{"name":"ecosystem","in":"query","required":false,"schema":{"type":"string","enum":["npm","PyPI","Go","crates.io","Packagist","RubyGems","Maven","NuGet","Pub","Hex"],"default":"npm"}},{"name":"name","in":"query","required":true,"schema":{"type":"string","maxLength":214},"description":"Package name, e.g. lodash, requests, github.com/gin-gonic/gin"},{"name":"version","in":"query","required":true,"schema":{"type":"string","maxLength":64},"description":"Exact version, e.g. 4.17.15"}]},"post":{"operationId":"preview_scan","summary":"Free verdict + counts for a manifest or up to 25 packages","security":[],"responses":{"200":{"description":"OK"},"429":{"description":"Free tier rate limit"},"503":{"description":"OSV.dev unavailable"}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"manifest":{"type":"string","maxLength":512000,"description":"File contents: package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock"},"filename":{"type":"string"},"type":{"type":"string","enum":["package.json","package-lock.json","requirements.txt","Pipfile.lock","poetry.lock","go.mod","Cargo.lock","composer.lock"]},"include_dev":{"type":"boolean","default":true},"packages":{"type":"array","maxItems":500,"items":{"type":"object","properties":{"ecosystem":{"type":"string","enum":["npm","PyPI","Go","crates.io","Packagist","RubyGems","Maven","NuGet","Pub","Hex"]},"name":{"type":"string"},"version":{"type":"string"}},"required":["name","version"]}}}}}}}}}}}