public-scan

Scan Package Endpoint

Grade a PUBLISHED npm or PyPI package directly by coordinate — no GitHub repo required. The signed A+..F grade is computed over the real artifact bytes (scan_depth = artifact) with the package's own build provenance verified. E.g. /public/scan/package/npm/chalk or /public/scan/package/pypi/requests?version=2.32.5. Cached 1h.

get/api/v1/public/scan/package/{surface}/{name}

Request

  • Base URL: https://agentavow.com (the document declares no server; this is the origin it was published from)
  • URL: https://agentavow.com/api/v1/public/scan/package/{surface}/{name}
  • Auth: none declared

Path parameters

surfacestring required
namestring required

Query parameters

forceboolean

Bypass cache and force a fresh scan

behavioralboolean

Force a fresh behavioral sandbox run (npm/PyPI)

versionstring nullable

Exact version; default = latest

storedboolean

Return the last STORED grade (up to 7 days old) at once and never run a fresh scan inline; a grade older than 1h is refreshed in the background. 202 {status: queued} when nothing is stored yet (a scan is queued). For hooks and bulk callers that must not block or burn the fresh-scan budget.

Response

Successful Response

staleboolean
repostring required
trust_scoreinteger required
security_scoreinteger
trust_tierstring required
scan_resultstring required
verdictstring
verdict_reasonstring
decisionstring
decision_finalboolean
decision_reasonstring
capabilitiesobject[]
positive_signalsstring[]
gradestring

Deprecated legacy field; read decision, trust_score and certified.

certifiedobject
certified_markboolean
certified_mark_reasonstring
coverageobject
supply_chainobject
coverage_gapsobject
not_checkedstring[]
incident_historyobject
deprecationstring nullable
package_versionstring nullable
published_atstring nullable
behavioral_score_effectobject
provenanceobject
surface_detailobject
declared_scopeobject
env_readsstring[]
package_coordinateobject
tool_descriptionstring
long_descriptionstring
category_scoresobject
scanned_atstring required
cachedboolean
tool_manifest_digeststring nullable
tool_digestsobject
tool_listobject[]
skill_collectionobject nullable
tool_driftobject nullable
jwsstring required
algorithmstring
key_idstring
jwks_urlstring
entity_trustobject nullable
trust_envelopeobject nullable
behavioralobject nullable
score_notestring
gateway_infoobject

Changes

No recorded changes to this operation across all 1 revision of this API.