---
title: "TaintCheck"
method: POST
path: "/v1/taint-check"
tags: ["security"]
---

# TaintCheck

`POST /v1/taint-check`

## Request

- Base URL: `https://agent.pocket.network`
- URL: `https://agent.pocket.network/v1/taint-check`
- Auth: none required

Scan a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with a link to a lockfile on GitHub, GitLab or Bitbucket, the file pasted in, or a components array, and get per-dependency verdicts (malicious, vulnerable, suspicious, clean) from OSV.dev and the OpenSSF Malicious Packages feed. Pay per request in USDC; no account, no API key.

## Request body

- object: Provide either a lockfile (a link to it, or its content) or a pre-parsed components array; body size, component limits and the allowed link hosts come from GET /v1/capabilities.
  - `lockfile` object: A lockfile, linked (url) or pasted (format plus content). Send url or content, not both. package.json lists version ranges, so only exact pins are scanned; link the lockfile to scan installed versions.
    - `url` string: Link to one public file on github.com (the page link works), raw.githubusercontent.com, gist.githubusercontent.com, gitlab.com or bitbucket.org. The format is taken from the filename unless format is given.
    - `format` 'package.json' | 'package-lock.json' | 'pnpm-lock.yaml' | 'yarn.lock' | 'requirements.txt' | 'poetry.lock' | 'uv.lock' | 'Pipfile.lock' | 'Cargo.lock' | 'go.sum': Lockfile format. Required with content; optional with url.
    - `content` string: Raw lockfile content, as a string.
  - `components` object[]: Pre-parsed dependencies.
    - `ecosystem` string: e.g. npm, pypi, go, cargo.
    - `name` string: Package name.
    - `version` string: Package version.
  - `options` object: Scan options.
    - `since` string: Only advisories newer than this timestamp (monitor mode).
    - `heuristics` boolean: Add typosquat, install-script and dormancy signals.

## Response `200`

The upstream response, served after payment settles.

- object: For POST /v1/scan, a JSON object with a `findings` array — each dependency's verdict (malicious, vulnerable, suspicious, clean), a summary, and a data_as_of timestamp. Findings vary by each supplier's snapshot freshness and converge as mirrors sync. The exact shape is the service's own and is not pinned here; errors return a JSON object with an `error` field, and the GET routes return their own small JSON documents.

## Other responses

- `400`: Malformed request.
- `402`: Payment required. The x402 v2 terms are in the PAYMENT-REQUIRED header and, identically, in this body; sign the chosen option and retry with the PAYMENT-SIGNATURE header. The receipt arrives in PAYMENT-RESPONSE.
- `503`: This service is not currently available to serve.

---

[API](https://skmtc.dev/pocket/apis/pocket-agentic-portal.md) · [All operations](https://skmtc.dev/pocket/apis/pocket-agentic-portal/llms.txt) · [OpenAPI document](https://skmtc.dev/pocket/apis/pocket-agentic-portal/revisions/96d2176db014?raw)