Pocket Network

Scan a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with a link to a lockfile on GitHub, GitLab or Bitbucket, the file pasted in, or a components array, and get per-dependency verdicts (malicious, vulnerable, suspicious, clean) from OSV.dev and the OpenSSF Malicious Packages feed. Pay per request in USDC; no account, no API key.

Open endpoint ↗

Price per call: $0.005
Chain: Base
Method: POST
Paid calls · 30 days: 3,683

Call it from code

This API is run by its own provider and paid directly through x402. We list it so you can find it; we don't route or hold the payment.

import { x402Client, wrapFetchWithPayment } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";

const client = new x402Client();
registerExactEvmScheme(client, { signer: agentAccount });

const pay = wrapFetchWithPayment(fetch, client);
const res = await pay("https://agent.pocket.network/v1/taint-check", { method: "POST" });
console.log(await res.json());

https://agent.pocket.network/v1/taint-check