# CodePulse

> CodePulse is a package security scanner API: one call scans an npm or PyPI package and returns its known CVEs from OSV.dev, its license (SPDX identifier), and flags typosquatting attempts based on name similarity to popular packages.

Base URL: https://codepulse.waltsoft.net/v1 — authenticate with the header X-API-Key: <your AWS Marketplace key (mp_...)>, or pay $0.005 per call with x402 (USDC on Base or Solana) and no key.

## Endpoints
- GET https://codepulse.waltsoft.net/v1/scan?pkg=express&ecosystem=npm: Scan package for CVEs, license, and typosquat risk
- GET https://codepulse.waltsoft.net/v1/vulns?pkg=lodash&ecosystem=npm: List CVEs only (no license or typosquat check)

## Agent access
- MCP (Amazon Bedrock AgentCore Gateway): https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp — tools: codepulse___scanPackage(pkg, ecosystem, api_key)
- A2A agent card: https://codepulse.waltsoft.net/.well-known/agent-card.json (JSON-RPC endpoint https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/a2a-gw/codepulse)

## Docs
- [OpenAPI 3 schema](https://codepulse.waltsoft.net/openapi.json)
- [Agent guide](https://codepulse.waltsoft.net/agents.md)
- [Full reference](https://codepulse.waltsoft.net/llms-full.txt)
- [Buy on AWS Marketplace](https://aws.amazon.com/marketplace/search/results?searchTerms=Waltsoft%20CodePulse)