PkgGuard by AgentGate

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "X-PAYMENT header is required",
  "usage": {
    "method": "POST",
    "message": "GET only shows the price. To scan, POST a JSON body {\"manifest\": \"<file contents>\", \"filename\": \"package.json\"} or {\"packages\": [{\"ecosystem\": \"npm\", \"name\": \"lodash\", \"version\": \"4.17.15\"}]} with an x402 payment.",
    "single_package": "GET /v1/package?ecosystem=npm&name=lodash&version=4.17.15 ($0.001)"
  },
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://api.youraitools.co/pkgguard/v1/scan",
      "description": "Dependency security scan for agents and CI: send a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a package list, up to 500). Returns known vulnerabilities (CVE/GHSA ids, severity, CVSS, fixed-in versions) and confirmed-malicious packages per dependency, from OSV.dev.",
      "outputSchema": {
        "input": {
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "bodyFields": {
            "manifest": {
              "type": "string",
              "required": false,
              "description": "Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)"
            },
            "packages": {
              "type": "array",
              "required": false,
              "description": "Alternative to manifest: [{ecosystem, name, version}], up to 500"
            }
          },
          "discoverable": true
        },
        "output": {
          "tier": "full",
          "source": {
            "name": "OSV.dev"
          },
          "verdict": "malicious",
          "packages": [
            {
              "name": "flatmap-stream",
              "vulns": [
                {
                  "id": "MAL-2025-20690",
                  "url": "https://osv.dev/vulnerability/MAL-2025-20690",
                  "summary": "Malicious code in flatmap-stream (npm)",
                  "fixed_in": [],
                  "severity": "CRITICAL",
                  "malicious": true
                }
              ],
              "version": "0.1.1",
              "ecosystem": "npm",
              "malicious": true,
              "vuln_count": 3,
              "version_source": "exact",
              "highest_severity": "CRITICAL"
            }
          ],
          "range_note": "For version ranges (e.g. ^4.17.0) the lowest allowed version was scanned.",
          "by_severity": {
            "LOW": 0,
            "HIGH": 3,
            "MEDIUM": 3,
            "UNKNOWN": 0,
            "CRITICAL": 3
          },
          "manifest_type": "package.json",
          "package_count": 3,
          "scanned_count": 3,
          "advisory_count": 9,
          "unpinned_count": 0,
          "malicious_count": 1,
          "highest_severity": "CRITICAL",
          "vulnerable_count": 2
        }
      },
      "maxAmountRequired": "3000",
      "maxTimeoutSeconds": 120
    }
  ],
  "message": "Payment required: PkgGuard GET /pkgguard/v1/scan costs $0.003 per call in USDC. Is this dependency safe to install? Pay per call in USDC with any x402 client: read the PAYMENT-REQUIRED header (x402 v2) or the accepts list in this body (x402 v1), sign the payment and retry the same request with the PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1) header. Networks: Base, Polygon, Arbitrum, Solana. No account, no API key. No crypto wallet? Buy prepaid credits by card or USDC at https://api.youraitools.co/credits/ and send them as a Bearer key. Free: 30 calls/day (full results via remote MCP, up to 100 packages per scan: check_package, scan_dependencies), then $0.001 per package / $0.003 per scan in USDC (safety check only)",
  "x402Version": 1,
  "payment_help": {
    "docs": "https://api.youraitools.co/pkgguard/",
    "tool": "PkgGuard",
    "what": "Is this dependency safe to install? Known vulnerabilities (CVE/GHSA, severity, fixed-in) and confirmed-malicious packages for a package.json, lockfile, requirements.txt, go.mod or Cargo.lock (OSV.dev data).",
    "price": "$0.003 per call (USDC)",
    "route": "GET https://api.youraitools.co/pkgguard/v1/scan",
    "mcp_hub": "https://api.youraitools.co/mcp/hub",
    "free_tier": "30 calls/day (full results via remote MCP, up to 100 packages per scan: check_package, scan_dependencies), then $0.001 per package / $0.003 per scan in USDC (safety check only)",
    "pay_with_x402": "Pay per call in USDC with any x402 client: read the PAYMENT-REQUIRED header (x402 v2) or the accepts list in this body (x402 v1), sign the payment and retry the same request with the PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1) header. Networks: Base, Polygon, Arbitrum, Solana. No account, no API key.",
    "pay_with_credits": {
      "url": "https://api.youraitools.co/credits/",
      "use": "Send the key as Authorization: Bearer yatc_... on the same request; each call is deducted at the listed price.",
      "card": "Pay by card (Stripe): $5, $20 or $50 credit packs, no crypto wallet needed.",
      "wallet": "Or buy $1 or $5 of credits in USDC with the one-click browser wallet button on the same page.",
      "card_checkout": "https://api.youraitools.co/credits/ (choose a pack under Pay by card; Stripe checkout opens in one click)"
    }
  }
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
    "amount": "3000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 120
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "filename": "package.json",
          "manifest": "{\"name\":\"demo\",\"dependencies\":{\"lodash\":\"4.17.15\",\"flatmap-stream\":\"0.1.1\",\"express\":\"^4.18.2\"}}"
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "tier": "full",
          "source": {
            "name": "OSV.dev"
          },
          "verdict": "malicious",
          "packages": [
            {
              "name": "flatmap-stream",
              "vulns": [
                {
                  "id": "MAL-2025-20690",
                  "url": "https://osv.dev/vulnerability/MAL-2025-20690",
                  "summary": "Malicious code in flatmap-stream (npm)",
                  "fixed_in": [],
                  "severity": "CRITICAL",
                  "malicious": true
                }
              ],
              "version": "0.1.1",
              "ecosystem": "npm",
              "malicious": true,
              "vuln_count": 3,
              "version_source": "exact",
              "highest_severity": "CRITICAL"
            }
          ],
          "range_note": "For version ranges (e.g. ^4.17.0) the lowest allowed version was scanned.",
          "by_severity": {
            "LOW": 0,
            "HIGH": 3,
            "MEDIUM": 3,
            "UNKNOWN": 0,
            "CRITICAL": 3
          },
          "manifest_type": "package.json",
          "package_count": 3,
          "scanned_count": 3,
          "advisory_count": 9,
          "unpinned_count": 0,
          "malicious_count": 1,
          "highest_severity": "CRITICAL",
          "vulnerable_count": 2
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "properties": {
                "filename": {
                  "type": "string",
                  "description": "Optional file name, helps type detection"
                },
                "manifest": {
                  "type": "string",
                  "description": "Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)"
                },
                "packages": {
                  "type": "array",
                  "items": {
                    "type": "object"
                  },
                  "description": "Alternative to manifest: [{ecosystem, name, version}], up to 500"
                },
                "include_dev": {
                  "type": "boolean",
                  "description": "Include devDependencies (default true)"
                }
              }
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-24 22:10Z

Last indexed by Roundhouse

2026-10-26 20:46Z

Last enriched (probe, favicon, geo)

2026-10-25 11:46Z

x402 version

2

Max timeout

120s

Liveness probe

HTTP 402