---
title: "Flagged Stat"
method: GET
path: "/api/v1/public/scan-catalog/flagged-stat"
tags: ["public-scan"]
---

# Flagged Stat

`GET /api/v1/public/scan-catalog/flagged-stat`

## Request

- Base URL: `https://agentavow.com` (the document declares no server; this is the origin it was published from)
- URL: `https://agentavow.com/api/v1/public/scan-catalog/flagged-stat`
- Auth: none declared

Single source of truth for the headline stat: the share of SCANNED tools that carry
a high or critical finding. The homepage, the Index and the State of Agent Security
report all read this, computed server-side over the launch corpus + community rows.

Every count is an exclusive bucket (see `_severity_bucket`), so a tool is counted
once no matter how many findings it has, and the denominator is only tools that
actually received a verdict. x402 endpoints are compliance probes, not code scans,
and are excluded entirely.

Response:
- `scanned_total`: tools with a verdict (the denominator). Alias: `scanned`.
- `critical`: tools with >=1 critical finding.
- `high_only`: tools with >=1 high finding and no critical.
- `flagged`: critical + high_only. Every flagged tool counted exactly once.
- `clean`: scanned tools with no high or critical finding.
- `skipped`: catalog rows with no verdict (fetch skipped / scan error). NOT in the
  denominator. `total` = scanned_total + skipped.
- `pct`: flagged / scanned_total, whole percent (None if nothing scanned);
  `flagged_pct` and `critical_pct` carry one decimal.
- `by_surface`: the same keys per surface (mcp, npm, pypi, openclaw, github, ...).

`pct`, `flagged` and `scanned` are kept for existing callers. Before 2026-10-01 they
double-counted tools with both a critical and a high finding and divided by every
catalog row including never-scanned ones; they are now the honest figures.

Agreement guarantee: `critical`, `high_only` and `skipped` (overall and per surface)
equal the `total` of `GET /public/scan-catalog?severity=critical|high|skipped`. The
list's `severity=clean` additionally requires a score >= 80, so it is a subset of
`clean` here.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/agentavow/apis/agentavow-api.md) · [All operations](https://skmtc.dev/agentavow/apis/agentavow-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentavow/apis/agentavow-api/revisions/e1e20476dbfc?raw)