{"slug":"tanod-dev-v1-scan-package-e2ef89","title":"toolsniff (Tanod) static security scan of an AI-agent skill or MCP server packag","host":"tanod.dev","method":"POST","resource":"https://tanod.dev/v1/scan/package","category":"code","description":"toolsniff (Tanod) static security scan of an AI-agent skill or MCP server package: prompt injection, hidden text, remote code, credential access, exfiltration, install hooks, over-broad MCP tools, typosquats and known-vulnerable dependencies; JSON report. The package is never run.","price_listed":0.02,"price_asked":0.02,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":383,"reported_calls_30d":2,"reported_payers_30d":2,"networks":["eip155:137","eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"source":"npm:@modelcontextprotocol/server-filesystem"},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"content_base64":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"An uploaded package instead of a source: base64 of a .zip/.tar(.gz/.bz2/.xz) archive (up to 20 MB), or of a single file (then give filename, e.g. SKILL.md). Uploads are never sent to OSV.dev."},"filename":{"anyOf":[{"pattern":"^[A-Za-z0-9._\\- ]{1,128}$","type":"string"},{"type":"null"}],"default":null,"description":"File name of a single-file upload (e.g. SKILL.md, server.py)."},"source":{"anyOf":[{"maxLength":512,"type":"string"},{"type":"null"}],"default":null,"description":"npm:name[@version] | pypi:name[==version] | github:owner/repo[@ref][//subdir] | https://github.com/owner/repo[/tree/ref/dir] | clawhub:[owner/]slug[@version]. Pin a version (or a 40-hex commit) to get cached answers."}},"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"properties":{"disclaimer":{"type":"string"},"error":{"type":["object","null"]},"findings":{"items":{"properties":{"check":{"type":"string"},"confidence":{"type":"string"},"evidence":{"type":"string"},"file":{"type":"string"},"id":{"type":"string"},"line":{"type":"integer"},"severity":{"type":"string"}},"type":"object"},"type":"array"},"risk_score":{"maximum":100,"minimum":0,"type":"integer"},"schema_version":{"type":"string"},"status":{"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["safe-looking","review","dangerous","unknown"],"type":"string"}},"required":["schema_version","status","verdict","risk_score","findings"],"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-10","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.02,"price_match":true,"latency_ms":383,"error":null}],"description_full":"toolsniff (Tanod) static security scan of an AI-agent skill or MCP server package: prompt injection, hidden text, remote code, credential access, exfiltration, install hooks, over-broad MCP tools, typosquats and known-vulnerable dependencies; JSON report. The package is never run.","last_updated":"2026-10-08T06:09:46.213Z","schemes":["exact"]}