---
title: "Scan a list of package names for known vulnerabilities via OSV."
method: POST
path: "/v1/scan/vulnerabilities"
tags: ["security"]
---

# Scan a list of package names for known vulnerabilities via OSV.

`POST /v1/scan/vulnerabilities`

## Request

- Base URL: `https://api.agent-toolbox.ai`
- URL: `https://api.agent-toolbox.ai/v1/scan/vulnerabilities`
- Auth: one of:
  - HTTP bearer
  - none

Cost: 2 credit(s). Free tier: 10 calls per IP (no auth).

## Request body

- ScanVulnerabilitiesRequest
  - `packages` string[], required
  - `language` 'python' | 'javascript' | 'typescript' | 'rust' | 'go', required
  - `timeoutMs` number

## Response `200`

Success.

- ScanVulnerabilitiesResponse
  - `findings` object[], required
    - `package` string, required
    - `vulnerabilities` object[], required
      - `id` string, required
      - `summary` string, required
      - `severity` string, required
      - `aliases` string[], required
  - `totalPackages` integer, required
  - `vulnerablePackages` integer, required
  - `safe` boolean, required
  - `latencyMs` number, required: Server compute time in ms.

## Other responses

- `400`: Invalid request body.
- `402`: Free tier exhausted or insufficient credits.

---

[API](https://skmtc.dev/agent-toolbox/apis/agent-toolbox-ai-api.md) · [All operations](https://skmtc.dev/agent-toolbox/apis/agent-toolbox-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agent-toolbox/apis/agent-toolbox-ai-api/revisions/07132043190b?raw)