Package Security Advisories

security

Serving

Dependency health across PyPI, npm, Go, Cargo, Maven, Composer, and NuGet via deps.dev and OSV: versions, licenses, and known vulnerabilities. POST /v1/tool with {package, ecosystem}, or GET /v1/package for the Bazaar listing. Deterministic per advisory state. Pay per request in USDC; no account, no API key.

Endpoint: POST https://agent.pocket.network/v1/package-advisories/v1/tool
Price per call: $0.005 USD
Networks payable on: Base (eip155:8453), Tempo (eip155:4217)
Protocol: rest

Calling it

The first call returns 402 Payment Required with the terms. Sign for those terms and retry the same request with the payment attached.

Example request

A real, working call — the request the service card verifies against.

curl -X POST https://agent.pocket.network/v1/package-advisories/v1/tool \
  -H 'content-type: application/json' \
  -d '{"arguments":{"package":"requests","ecosystem":"pypi"}}'

Example response

The response this call returned, captured 2026-09-21 23:48:39 UTC.

{
  "portal": {
    "provenance": "third-party-supplier",
    "serviceId": "package-advisories",
    "schemaCheck": "unchecked"
  },
  "data": {
    "as_of": "2026-09-21T23:48:38Z",
    "dependent_count": null,
    "ecosystem": "pypi",
    "latest_version": "2.34.2",
    "licenses": [
      "Apache-2.0"
    ],
    "open_source_vulns": [],
    "package": "requests",
    "version": "2.34.2",
    "vuln_details": []
  }
}

Try it

Make one real paid call from your own wallet — about $0.005 on Base (eip155:8453). The wallet signs; nothing here holds a key. You'll see exactly what the service answers.

No browser wallet found. Install MetaMask, Rabby, or Coinbase Wallet to try a call here.

EndpointRequest body

Supported methods

Methods the registry lists for this service. The portal forwards any call as sent; the supplier decides what it answers, and a delivered answer is settled.

Methods Package Security Advisories accepts, and whether each reads or writes.
Method	Effect
`GET /v1/health`	read
`GET /v1/package`	read
`GET /v1/version`	read
`POST /v1/tool`	read

Schemas

Published by the service itself. The example above is generated from these.

Request schema

{
  "type": "object",
  "description": "A package to audit. On the MCP relay route POST /v1/tool these fields are wrapped under an `arguments` object; the direct route takes them at the top level. GET /v1/package is the direct Bazaar query route.",
  "properties": {
    "package": {
      "type": "string",
      "description": "Package name, e.g. requests."
    },
    "ecosystem": {
      "type": "string",
      "description": "Ecosystem, e.g. pypi, npm, go, cargo, maven, composer, nuget."
    },
    "version": {
      "type": "string",
      "description": "Optional specific version."
    }
  },
  "required": [
    "package"
  ]
}

Response schema

{
  "type": "object",
  "description": "For POST /v1/tool, a JSON object with the latest_version, versions, licenses, and known vulnerabilities. The exact shape is the service's own and is not pinned here; errors return a JSON object with an `error` field, and the GET routes return their own small JSON documents."
}