# PkgGuard by AgentGate — Package Vulnerability Scanner

> PkgGuard by AgentGate — Package Vulnerability Scanner is a paid API for AI agents from api.youraitools.co, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-27).

Scans software package manifests or package lists for known vulnerabilities and malicious packages using OSV.dev, returning severity-graded advisory results.

## Facts

- Endpoint: POST https://api.youraitools.co/pkgguard/v1/scan?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkgguard-by-agentgate-package-vulnerability-scanner-21aaca8e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_MVVhcSrwLhl4Vl2yXBd7x

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkgguard-by-agentgate-package-vulnerability-scanner-21aaca8e -d '<json body>'
```

Example prompt: Scan this package.json for malicious or vulnerable packages and tell me if anything is CRITICAL — here are the contents: {paste manifest}

## When to prefer this

Choose PkgGuard when you need fast, per-call vulnerability and malware screening of software dependency manifests or package lists, especially in CI/CD pipelines, agent workflows, or pre-deployment checks. It is ideal when you want OSV.dev advisory data without setting up your own scanning infrastructure, and when you need results in a structured JSON format with severity breakdowns and malicious-package flags specifically. Prefer this over generic SCA tools when operating in an agent or crypto-payment context.

## Known failure modes

- Invalid or unparseable manifest format returns an error
- Package ecosystem not recognized causes scan failure
- Version ranges result in scanning lowest allowed version rather than actual installed version, noted in range_note field
- Empty package list or missing required fields returns validation error
- Network timeout reaching OSV.dev backend

## How this service works

Dependency vulnerability scanner API. Dependency security scan for agents and CI: send a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a package list, up to 500). Returns known vulnerabilities (CVE/GHSA ids, severity, CVSS, fixed-in versions) and confirmed-malicious packages per dependency, from OSV.dev. Search intents: dependency vulnerability scan, npm audit api, sca api, lockfile security scan, cve lookup, software supply chain security.

## Output

A JSON report containing: an overall verdict (e.g. 'malicious' or 'clean'), per-package vulnerability lists with OSV IDs, summaries, severity levels, and fix versions, plus aggregate counts broken down by severity (LOW/MEDIUM/HIGH/CRITICAL), malicious package count, total advisories found, and manifest type detected.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "filename": {
   "type": "string",
   "description": "Optional file name, helps type detection"
  },
  "manifest": {
   "type": "string",
   "description": "Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)"
  },
  "packages": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "Alternative to manifest: [{ecosystem, name, version}], up to 500"
  },
  "include_dev": {
   "type": "boolean",
   "description": "Include devDependencies (default true)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tier": "full",
  "source": {
   "name": "OSV.dev"
  },
  "verdict": "malicious",
  "packages": [
   {
    "name": "flatmap-stream",
    "vulns": [
     {
      "id": "MAL-2025-20690",
      "url": "https://osv.dev/vulnerability/MAL-2025-20690",
      "summary": "Malicious code in flatmap-stream (npm)",
      "fixed_in": [],
      "severity": "CRITICAL",
      "malicious": true
     }
    ],
    "version": "0.1.1",
    "ecosystem": "npm",
    "malicious": true,
    "vuln_count": 3,
    "version_source": "exact",
    "highest_severity": "CRITICAL"
   }
  ],
  "range_note": "For version ranges (e.g. ^4.17.0) the lowest allowed version was scanned.",
  "by_severity": {
   "LOW": 0,
   "HIGH": 3,
   "MEDIUM": 3,
   "UNKNOWN": 0,
   "CRITICAL": 3
  },
  "manifest_type": "package.json",
  "package_count": 3,
  "scanned_count": 3,
  "advisory_count": 9,
  "unpinned_count": 0,
  "malicious_count": 1,
  "highest_severity": "CRITICAL",
  "vulnerable_count": 2
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkgguard-by-agentgate-package-vulnerability-scanner-21aaca8e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.youraitools.co](https://www.zero.xyz/host/api.youraitools.co/llms.txt)