DepScan API

Dependency health checker for AI agent skills. Validates external endpoints, SSL certificates, domain reputation and blacklists before your agent trusts a skill's infrastructure.

Live endpoint: https://depscan.net Health check: https://depscan.net/v1/health

Why this exists

A skill can have clean code and still connect to malicious or unreliable infrastructure. DepScan checks the external dependencies a skill reaches out to — the attack surface that code scanners miss.

Related MCP server: websec-auditor

What it checks

• HTTP/HTTPS uptime and response latency

• SSL certificate validity and days until expiration

• Domain age and ownership history (WHOIS)

• IP abuse reputation score (AbuseIPDB)

• Blacklist status (Spamhaus DBL)

Quick start

1. Get an API key

Create a Stripe checkout session — the key is pre-generated and activates after payment:

curl -X POST https://depscan.net/v1/billing/checkout \
  -H "Content-Type: application/json" \
  -d '{"tier": "single_starter"}'

Response:

{
  "checkout_url": "https://checkout.stripe.com/...",
  "api_key": "dsk_live_...",
  "note": "Save your API key now — it will not be shown again."
}

Store api_key. Complete payment at checkout_url. Key activates automatically within seconds.

2. Run a scan

curl -X POST https://depscan.net/v1/scan-deps \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer dsk_live_your_key" \
  -d '{
    "skill_url": "https://github.com/owner/skill-repo",
    "scan_type": "deep"
  }'

3. Response

{
  "scan_id": "dep_x9y8z7w6v5u4t3s2",
  "overall_score": 61,
  "status": "CAUTION",
  "recommendation": "REVIEW_BEFORE_INSTALL",
  "endpoints": [
    {
      "url": "https://api.example.com",
      "status": "UP",
      "latency_ms": 210,
      "ssl_valid": true,
      "ssl_expires_days": 14,
      "domain_age_days": 23,
      "abuse_score": 0,
      "in_blacklist": false,
      "flags": ["SSL_EXPIRING", "NEW_DOMAIN"]
    }
  ],
  "timestamp": "2026-03-01T12:00:00Z"
}

Flags: SSL_EXPIRING · SSL_EXPIRED · NEW_DOMAIN · OWNER_CHANGED · ABUSE_REPORTED · IN_BLACKLIST · HIGH_LATENCY · NO_HTTPS · REDIRECT_CHAIN

Scan types

Results cached 24 hours — rescanning the same domain costs zero credits.

Pricing (MXN)

Endpoints

Input options

{ "skill_url": "https://github.com/owner/skill-repo", "scan_type": "single" }

{ "endpoints": ["https://api.one.com", "https://api.two.com"], "scan_type": "deep" }

Score interpretation

Latency & availability

• Average scan time: < 5 seconds (parallel async checks)

• Uptime: 99.9% (Contabo dedicated VPS)

• Response format: JSON

Companion service

SecurityScan API analyzes skill source code for security vulnerabilities (prompt injection, malware, OWASP LLM Top 10): https://apisecurityscan.net

License

MIT — this repository contains documentation and skill package only. Service source code is proprietary.