{"uid":"cap_MVVhcSrwLhl4Vl2yXBd7x","slug":"pkgguard-by-agentgate-package-vulnerability-scanner-21aaca8e","name":"PkgGuard by AgentGate — Package Vulnerability Scanner","description":"Dependency vulnerability scanner API. Dependency security scan for agents and CI: send a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a package list, up to 500). Returns known vulnerabilities (CVE/GHSA ids, severity, CVSS, fixed-in versions) and confirmed-malicious packages per dependency, from OSV.dev. Search intents: dependency vulnerability scan, npm audit api, sca api, lockfile security scan, cve lookup, software supply chain security.","url":"https://api.youraitools.co/pkgguard/v1/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"filename":{"type":"string","description":"Optional file name, helps type detection"},"manifest":{"type":"string","description":"Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)"},"packages":{"type":"array","items":{"type":"object"},"description":"Alternative to manifest: [{ecosystem, name, version}], up to 500"},"include_dev":{"type":"boolean","description":"Include devDependencies (default true)"}}},"responseSchema":{"type":"json","example":{"tier":"full","source":{"name":"OSV.dev"},"verdict":"malicious","packages":[{"name":"flatmap-stream","vulns":[{"id":"MAL-2025-20690","url":"https://osv.dev/vulnerability/MAL-2025-20690","summary":"Malicious code in flatmap-stream (npm)","fixed_in":[],"severity":"CRITICAL","malicious":true}],"version":"0.1.1","ecosystem":"npm","malicious":true,"vuln_count":3,"version_source":"exact","highest_severity":"CRITICAL"}],"range_note":"For version ranges (e.g. ^4.17.0) the lowest allowed version was scanned.","by_severity":{"LOW":0,"HIGH":3,"MEDIUM":3,"UNKNOWN":0,"CRITICAL":3},"manifest_type":"package.json","package_count":3,"scanned_count":3,"advisory_count":9,"unpinned_count":0,"malicious_count":1,"highest_severity":"CRITICAL","vulnerable_count":2}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_89oRre8u8MkKHKMMFmjZP","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans software package manifests or package lists for known vulnerabilities and malicious packages using OSV.dev, returning severity-graded advisory results.","exampleAgentPrompt":"Scan this package.json for malicious or vulnerable packages and tell me if anything is CRITICAL — here are the contents: {paste manifest}","exampleUseCases":[{"title":"Pre-deploy dependency audit","prompt":"Before I ship this release, scan my package-lock.json for any malicious or critically vulnerable npm packages and give me a full breakdown by severity."},{"title":"Python environment security check","prompt":"Can you check my requirements.txt for any known vulnerabilities? I want to know if there are any HIGH or CRITICAL issues before I run this in production."},{"title":"Supply chain malware detection","prompt":"I have a list of npm packages with their versions — can you check each one against OSV.dev to see if any are flagged as malicious or have known exploits?"}],"resultDescription":"A JSON report containing: an overall verdict (e.g. 'malicious' or 'clean'), per-package vulnerability lists with OSV IDs, summaries, severity levels, and fix versions, plus aggregate counts broken down by severity (LOW/MEDIUM/HIGH/CRITICAL), malicious package count, total advisories found, and manifest type detected.","failureModes":["Invalid or unparseable manifest format returns an error","Package ecosystem not recognized causes scan failure","Version ranges result in scanning lowest allowed version rather than actual installed version, noted in range_note field","Empty package list or missing required fields returns validation error","Network timeout reaching OSV.dev backend"],"whenToPreferThis":"Choose PkgGuard when you need fast, per-call vulnerability and malware screening of software dependency manifests or package lists, especially in CI/CD pipelines, agent workflows, or pre-deployment checks. It is ideal when you want OSV.dev advisory data without setting up your own scanning infrastructure, and when you need results in a structured JSON format with severity breakdowns and malicious-package flags specifically. Prefer this over generic SCA tools when operating in an agent or crypto-payment context.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T12:57:37.002Z","isFirstParty":false,"canonicalSlug":"pkgguard-by-agentgate-package-vulnerability-scanner-21aaca8e"}