TaintCheck

security

Serving

Scan a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with a raw lockfile or a components array and get per-dependency verdicts (malicious, vulnerable, suspicious, clean) from OSV.dev and the OpenSSF Malicious Packages feed, each with a summary and snapshot timestamp. Pay per request in USDC; no account, no API key.

Endpoint: POST https://agent.pocket.network/v1/taint-check/v1/scan
Price per call: $0.005 USD
Networks payable on: Base (eip155:8453), Tempo (eip155:4217)
Protocol: rest

Calling it

The first call returns 402 Payment Required with the terms. Sign for those terms and retry the same request with the payment attached.

Example request

A real, working call — the request the service card verifies against.

curl -X POST https://agent.pocket.network/v1/taint-check/v1/scan \
  -H 'content-type: application/json' \
  -d '{"components":[{"ecosystem":"npm","name":"minimist","version":"1.2.0"}],"options":{"heuristics":false}}'

Example response

The response this call returned, captured 2026-09-21 23:44:32 UTC.

{
  "portal": {
    "provenance": "third-party-supplier",
    "serviceId": "taint-check",
    "schemaCheck": "unchecked"
  },
  "data": {
    "service": "taint-check",
    "schema_version": "1",
    "data_as_of": "2026-09-21T20:55:52.146Z",
    "sources": [
      "osv.dev",
      "ossf/malicious-packages"
    ],
    "request": {
      "format": null,
      "ecosystems": [
        "npm"
      ],
      "components_scanned": 1,
      "mode": "full",
      "heuristics": false
    },
    "summary": {
      "malicious": 0,
      "vulnerable": 1,
      "suspicious": 0,
      "clean": 0,
      "highest": "critical",
      "action_required": true
    },
    "findings": [
      {
        "ecosystem": "npm",
        "name": "minimist",
        "version": "1.2.0",
        "verdict": "vulnerable",
        "malicious": [],
        "vulnerabilities": [
          {
            "id": "GHSA-vh95-rmgr-6w4m",
            "aliases": "…",
            "summary": "Prototype Pollution in minimist",
            "published": "2020-04-03T21:48:32Z",
            "modified": "2026-03-13T22:11:31.390433Z",
            "reference": "https://osv.dev/vulnerability/GHSA-vh95-rmgr-6w4m",
            "severity": "medium",
            "fixed": "1.2.3"
          },
          {
            "id": "GHSA-xvch-5gv4-984h",
            "aliases": "…",
            "summary": "Prototype Pollution in minimist",
            "published": "2022-03-18T00:01:09Z",
            "modified": "2026-03-13T22:11:59.523514Z",
            "reference": "https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h",
            "severity": "critical",
            "fixed": "1.2.6"
          }
        ],
        "signals": [],
        "recommendation": "Upgrade to >=1.2.3."
      }
    ],
    "unresolved": []
  }
}

Try it

Make one real paid call from your own wallet — about $0.005 on Base (eip155:8453). The wallet signs; nothing here holds a key. You'll see exactly what the service answers.

No browser wallet found. Install MetaMask, Rabby, or Coinbase Wallet to try a call here.

EndpointRequest body

Supported methods

Methods the registry lists for this service. The portal forwards any call as sent; the supplier decides what it answers, and a delivered answer is settled.

Methods TaintCheck accepts, and whether each reads or writes.
Method	Effect
`GET /healthz`	read
`GET /v1/capabilities`	read
`GET /v1/openapi.json`	read
`GET /v1/version`	read
`POST /v1/scan`	read

Schemas

Published by the service itself. The example above is generated from these.

Request schema

{
  "type": "object",
  "description": "Provide either a raw lockfile or a pre-parsed components array; body size and component limits come from GET /v1/capabilities.",
  "properties": {
    "lockfile": {
      "type": "object",
      "description": "A raw lockfile.",
      "properties": {
        "format": {
          "type": "string",
          "enum": [
            "package-lock.json",
            "pnpm-lock.yaml",
            "yarn.lock",
            "requirements.txt",
            "poetry.lock",
            "uv.lock",
            "Pipfile.lock",
            "Cargo.lock",
            "go.sum"
          ],
          "description": "Lockfile format."
        },
        "content": {
          "type": "string",
          "description": "Raw lockfile content."
        }
      }
    },
    "components": {
      "type": "array",
      "description": "Pre-parsed dependencies.",
      "items": {
        "type": "object",
        "properties": {
          "ecosystem": {
            "type": "string",
            "description": "e.g. npm, pypi, go, cargo."
          },
          "name": {
            "type": "string",
            "description": "Package name."
          },
          "version": {
            "type": "string",
            "description": "Package version."
          }
        }
      }
    },
    "options": {
      "type": "object",
      "description": "Scan options.",
      "properties": {
        "since": {
          "type": "string",
          "description": "Only advisories newer than this timestamp (monitor mode)."
        },
        "heuristics": {
          "type": "boolean",
          "description": "Add typosquat, install-script and dormancy signals."
        }
      }
    }
  },
  "required": []
}

Response schema

{
  "type": "object",
  "description": "For POST /v1/scan, a JSON object with a `findings` array — each dependency's verdict (malicious, vulnerable, suspicious, clean), a summary, and a data_as_of timestamp. Findings vary by each supplier's snapshot freshness and converge as mirrors sync. The exact shape is the service's own and is not pinned here; errors return a JSON object with an `error` field, and the GET routes return their own small JSON documents."
}