---
title: "Package Security Advisories"
method: POST
path: "/v1/package-advisories"
tags: ["security"]
---

# Package Security Advisories

`POST /v1/package-advisories`

## Request

- Base URL: `https://agent.pocket.network`
- URL: `https://agent.pocket.network/v1/package-advisories`
- Auth: none required

Dependency health across PyPI, npm, Go, Cargo, Maven, Composer, and NuGet via deps.dev and OSV: versions, licenses, and known vulnerabilities. POST /v1/tool with {package, ecosystem}, or GET /v1/package for the Bazaar listing. Deterministic per advisory state. Pay per request in USDC; no account, no API key.

## Request body

- object: A package to audit. On the MCP relay route POST /v1/tool these fields are wrapped under an `arguments` object; the direct route takes them at the top level. GET /v1/package is the direct Bazaar query route.
  - `package` string, required: Package name, e.g. requests.
  - `ecosystem` string: Ecosystem, e.g. pypi, npm, go, cargo, maven, composer, nuget.
  - `version` string: Optional specific version.

## Response `200`

The upstream response, served after payment settles.

- object: For POST /v1/tool, a JSON object with the latest_version, versions, licenses, and known vulnerabilities. The exact shape is the service's own and is not pinned here; errors return a JSON object with an `error` field, and the GET routes return their own small JSON documents.

## Other responses

- `400`: Malformed request.
- `402`: Payment required. The x402 v2 terms are in the PAYMENT-REQUIRED header and, identically, in this body; sign the chosen option and retry with the PAYMENT-SIGNATURE header. The receipt arrives in PAYMENT-RESPONSE.
- `503`: This service is not currently available to serve.

---

[API](https://skmtc.dev/pocket/apis/pocket-agentic-portal.md) · [All operations](https://skmtc.dev/pocket/apis/pocket-agentic-portal/llms.txt) · [OpenAPI document](https://skmtc.dev/pocket/apis/pocket-agentic-portal/revisions/96d2176db014?raw)