Scan a dependency manifest for vulnerable and malicious packages
scan_dependenciesRead-onlyIdempotent
Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Free preview tier: verdict and counts, up to 25 packages. The paid x402 endpoint /v1/scan adds per-package advisory ids, severity, CVSS and fixed-in versions (up to 500 packages).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filename | No | Optional file name, helps type detection | |
| manifest | No | Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock) | |
| packages | No | Alternative to manifest: [{ecosystem, name, version}], up to 500 | |
| include_dev | No | Include devDependencies (default true) |