Agent Supply Trust API

Evaluate packages, containers, MCP servers, agent skills and plugins for provenance, permissions and runtime risk.

Production API: https://agentsupplytrust-api.com

Get a free API key · Documentation · Pricing · Status

Free tier: 100 component scans/month. No card required. Paid plans from $99/month.

Quickstart

Request a key. The token arrives by email; exchange it for the key, which is shown once.

curl -X POST https://agentsupplytrust-api.com/v1/keys \
  -H 'content-type: application/json' \
  -d '{"email": "you@example.com"}'

Then call the API:

curl -X POST https://agentsupplytrust-api.com/v1/scans \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"components":[{"kind":"mcp_server","name":"acme-mcp","version":"1.4.0"}]}'

Endpoints

Every endpoint below has a runnable playground on the documentation page.

Endpoint	Auth	Description
GET /health	public	Liveness and deployed version
GET /	public	Service index — endpoints, auth and error format
POST /v1/scans	API key	Scan one component
POST /v1/demo/scan	public	Public demo — scan components without a key
POST /v1/verdicts	API key	Scan and apply a policy — returns an auditable allow/warn/deny
POST /v1/scans/batch	API key	Scan up to 100 components in one call (CI use case)
POST /v1/checkout	public	Start a hosted Square checkout for a paid tier
POST /v1/keys	public	Request a free sandbox API key (sends a verification email)
GET /v1/keys	API key	List your API keys for this API
POST /v1/keys/claim	public	Exchange an emailed claim token for the API key
POST /v1/keys/{id}/revoke	API key	Revoke one of your API keys
POST /v1/keys/{id}/rotate	API key	Replace one of your API keys with a new secret
GET /v1/usage	API key	Your consumption and remaining allowance for this period
GET /v1/subscription	API key	Your current plan, billing window and available changes (dashboard session required)
POST /v1/subscription/plan	API key	Upgrade or downgrade to another plan (dashboard session required)
POST /v1/subscription/cancel	API key	Cancel this plan and end metered access (dashboard session required)
GET /v1/invoices	API key	Every invoice issued against this account, newest first (dashboard session required)
GET /v1/payments	API key	Every payment attempted against this account and how it went (dashboard session required)

The full machine-readable contract is openapi.json, generated from the deployed route table rather than maintained by hand. A Postman collection is included.

SDKs

Python — sdk/python

from supply_chain_trust import SupplyChainTrust

client = SupplyChainTrust()                 # reads SUPPLY_CHAIN_TRUST_API_KEY

# One component per call. Use /v1/scans/batch for many.
res = client.scan({
    "kind": "mcp_server",
    "name": "acme-mcp",
    "version": "2.1.0",
    "provenance": {"signed": True, "publisherVerified": True,
                   "sourceRepo": "https://github.com/acme/mcp"},
    "permissions": ["tool.invoke"],
})

print("risk score", res["riskScore"], res["severityCounts"])

for f in res["findings"]:
    # facet says which dimension failed; code is the stable enum to branch on.
    print(f["severity"], f["code"], f["facet"], f["message"])

TypeScript — sdk/typescript

import { SupplyChainTrust } from './supply-chain-trust.js'

const client = new SupplyChainTrust()       // reads SUPPLY_CHAIN_TRUST_API_KEY

// One component per call. Use /v1/scans/batch for many.
const res = await client.scan({
  kind: 'mcp_server',
  name: 'acme-mcp',
  version: '2.1.0',
  provenance: { signed: true, publisherVerified: true,
                sourceRepo: 'https://github.com/acme/mcp' },
  permissions: ['tool.invoke'],
})

console.log('risk score', res.riskScore, res.severityCounts)

for (const f of res.findings) {
  // `facet` says which dimension failed; branch on `code`.
  console.log(f.severity, f.code, f.facet, f.message)
}

Errors

Every failure returns the same shape. Branch on code, which is a stable enum; message is for humans and may change.

{"error": {"code": "invalid_api_key", "message": "...", "requestId": "0f3c8b12-…"}}

requestId appears on every response and in the x-request-id header. Quote it in any support request.

Support

Open an issue in this repository, or see the contact route at https://agentsupplytrust-api.com/docs.