Scan a package
scan_packageRead-onlyIdempotent
Scan a published package (npm, PyPI, crates, Docker, or Hugging Face) with AgentAvow. Returns one of three answers with its reason (Safe to connect, Review before you connect, or Do not connect), a 0-100 trust score, an adoption score from real usage (downloads per week), findings with remediation, and a signed attestation. Also reports published advisories that affect the scanned version, the maintainer's deprecation notice, repo-vs-artifact drift (files shipped that aren't in the source), and AgentAvow's behavioral sandbox results when available. Scans the latest version unless version (or a pin in the name) names one. Read-only; calls agentavow.com.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name, e.g. 'chalk' (or 'org/model' for hf). | |
| force | No | Re-scan now instead of returning the cached verdict (results cache ~1h). Use after a new version ships. | |
| surface | No | Alias for registry. | |
| version | No | Exact version to scan, e.g. '5.3.0'. Optional: the latest version by default. A pin in the name ('chalk@5.3.0', 'requests==2.32.5') works too. | |
| registry | No | Package registry: npm, pypi, crates, docker, or hf. | |
| ecosystem | No | Alias for registry. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| high | No | High findings, static and sandbox. | |
| tier | No | Trust tier for the score (detail, not the headline). | |
| cached | No | Served from the ~1h cache. | |
| signed | No | True when a signed (Ed25519/JWS) attestation backs this. | |
| target | Yes | What was scanned, as given. | |
| install | No | Install command, only when nothing blocks it. | |
| sandbox | No | What the behavioral sandbox observed; null if it does not apply. | |
| verdict | Yes | Binary form of the decision, kept for older clients. | |
| adoption | No | The adoption score: real usage (downloads per week, stars or installs). Never changes the decision. | |
| critical | No | Critical findings, static and sandbox. | |
| decision | Yes | The answer to lead with: safe = Safe to connect, review = Review before you connect, do_not_connect = Do not connect. | |
| incident | No | Known past compromise (context only, never scored). | |
| certified | No | Matches the signed attestation's certified.eligible. | |
| subscores | No | Per-category 0-100 scores behind the trust score. | |
| deprecated | No | The maintainer's deprecation notice, or null. | |
| report_url | Yes | Full report page. | |
| scanned_at | No | When the scan ran (ISO 8601, UTC). | |
| verify_url | No | How to verify offline. | |
| target_type | Yes | github, npm, pypi, crates, docker, hf, or mcp. | |
| trust_score | Yes | Trust score, 0-100. Evidence under the decision. | |
| published_at | No | When that version was published. | |
| top_findings | No | Up to five most important findings. | |
| certified_mark | No | Certified and safe: show the Certified mark. | |
| decision_final | Yes | False while the behavioral sandbox is still running; the decision can still change. | |
| findings_total | No | All findings, every severity. | |
| rescan_pending | No | A fresh scan was started; this is the previous result. | |
| verdict_reason | No | Machine reason for the binary verdict, e.g. clean, blocking_findings, thin_coverage. | |
| decision_reason | Yes | One sentence naming what decided it. | |
| package_version | No | Package version scanned. | |
| report_json_url | No | The full verdict as JSON. | |
| static_findings_total | No | Findings from static analysis only. | |
| advisories_affecting_version | No | Published advisories that affect this version. |