Sold by: Waltsoft Inc.
Deployed on AWS
Quick Launch
CodePulse is a package security scanner API for AI agents and security teams: one call returns a package's known vulnerabilities from OSV.dev (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems), its registry licence and metadata for npm and PyPI, and typosquat name signals. Use it over REST, MCP or A2A.
Overview
What CodePulse does
CodePulse turns a package name into a structured security profile that an AI agent or a supply-chain pipeline can reason over directly.
- GET /v1/scan?pkg=express&ecosystem=npm returns up to 20 known vulnerabilities from OSV.dev (ID, summary, severity, published date, first fixed version), registry metadata for npm and PyPI packages (name, latest version, licence, description, homepage; npm adds repository, maintainer and dependency counts, PyPI adds author and requires_python), and a typosquat check with a low, medium or high risk level and the signals behind it (for example a name within two edits of a popular package).
- GET /v1/vulns?pkg=lodash&ecosystem=npm returns only the vulnerability list and its count.
Ecosystems for vulnerabilities: npm, pypi, go, maven, cargo, nuget and rubygems. Registry metadata is returned for npm and PyPI; for the others metadata is null.
Where the data comes from
Each call queries the OSV.dev API live, which aggregates advisories such as the GitHub Advisory Database, PyPI, RustSec and Go. Metadata comes from the npm registry and PyPI. The typosquat check is a set of name heuristics computed by CodePulse. Every answer carries attribution and data_sources fields.
- Vulnerability data from OSV.dev; records keep their source licences.
Three ways to connect
- REST with an X-API-Key header, described by an OpenAPI 3 schema (https://codepulse.waltsoft.net/openapi.json ).
- MCP: the tool codepulse___analyzePackage (package, ecosystem) on the Amazon Bedrock AgentCore Gateway, for Claude, Strands Agents and other MCP clients.
- A2A (Agent2Agent 0.3): the agent card at https://codepulse.waltsoft.net/.well-known/agent-card.json with the skills scanPackage and getVulnerabilities.
Who it is for
Software composition analysis pipelines, dependency-risk agents, open-source governance tools and supply-chain security workflows that need vulnerability, licence and typosquat signals for a package in one call.
Billing
On AWS Marketplace, every successful call is one unit at $0.01, on any route, billed on your AWS bill. With x402 (USDC, no subscription): $0.005 per call. Only successful calls are billed; errors (400, 401, 404, 429, 5xx) are never billed. Rate limit: 50 requests per second, bursts up to 100.
Highlights
- Package security profile in one call: up to 20 known vulnerabilities from OSV.dev (ID, severity, summary, first fixed version), registry licence and metadata for npm and PyPI, and typosquat name signals
- Seven ecosystems for vulnerabilities: npm, PyPI, Go, Maven, Cargo, NuGet and RubyGems, queried live from OSV.dev on every call
- Agent-ready: REST with an OpenAPI 3 schema, an MCP tool on Amazon Bedrock AgentCore Gateway and an A2A agent card; pay only for successful calls on your AWS bill
Details
Sold by
Categories
Delivery method
Integration protocol
Supported services
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Quick Launch
Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/unit |
|---|---|---|
API Call | Single API call to the service | $0.01 |
Vendor refund policy
No refunds for API calls already made. Contact support@waltsoft.net within 7 days of billing issues.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Supported services:
- Amazon Bedrock AgentCore
API-Based Agents & Tools
API-Based Agents and Tools integrate through standard web protocols. Your applications can make API calls to access agent capabilities and receive responses.
Additional details
Usage instructions
To get started using the remote MCP server, follow the instructions below:
Available Tools This MCP server (Amazon Bedrock AgentCore Gateway) supports the following tool:
- codepulse___analyzePackage - Known vulnerabilities from OSV.dev (up to 20), registry metadata with the licence (npm and PyPI), and typosquat name signals for one package; the same answer as GET /v1/scan. Arguments: package (e.g. express), ecosystem (npm, pypi, go, maven, cargo, nuget or rubygems), api_key. Results cover every version OSV.dev lists for the package; metadata is the latest release.
Prerequisites
- An active subscription to this product. Your API key (it starts with mp_) is stored in your AWS Secrets Manager after you choose Set up your account, and is also shown on the registration page.
- Install Node.js and npm (for mcp-remote), or Python 3.10+ (for the Strands Agents SDK).
Authentication The MCP endpoint needs no connection header. Pass your key as the api_key argument of every tool call; replace YOUR_API_KEY with your actual key below. A wrong or inactive key returns statusCode 401.
MCP endpoint: https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp
Claude Desktop Edit the configuration file at:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json
Add the below code:
{ "mcpServers": { "waltsoft-codepulse": { "command": "npx", "args": [ "mcp-remote", "https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp" ] } } }Then ask, for example: "Use codepulse___analyzePackage with package express, ecosystem npm and api_key YOUR_API_KEY".
Strands Agents (Python)
pip install strands-agents mcp from mcp.client.streamable_http import streamable_http_client from strands.tools.mcp import MCPClient URL = "https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp" with MCPClient(lambda: streamable_http_client(URL)) as mcp: result = mcp.call_tool_sync("call-1", "codepulse___analyzePackage", {"package": "express", "ecosystem": "npm", "api_key": "YOUR_API_KEY"}) print(result["content"][0]["text"])Example tool result
{"statusCode": 200, "result": {"package": "express", "ecosystem": "npm", "vulnerabilities": [{"id": "GHSA-qw6h-vgh9-j6wx", "summary": "express vulnerable to XSS via response.redirect()", "severity": "LOW", "published": "2024-09-10T19:41:04Z", "fixed_in": "4.20.0"}], "metadata": {"name": "express", "version": "5.3.0", "license": "MIT"}, "typosquat_risk": {"risk_level": "low", "signals": []}, "attribution": "Vulnerability data from OSV.dev; records keep their source licences."}}Vulnerability data from OSV.dev; records keep their source licences. The vulnerabilities-only view is available over REST (GET /v1/vulns) and A2A.
Rate Limits
- 50 requests per second (bursts up to 100).
- Exceeding returns HTTP 429 Too Many Requests.
- Use retry and exponential backoff to handle limits.
Learn More API Docs: https://codepulse.waltsoft.net Support: support@waltsoft.net
Support
Vendor support
Contact support@waltsoft.net . Documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
ThreatPulse is a CVE exploit intelligence API for security teams, CI/CD pipelines and AI agents: one call tells you whether a vulnerability is exploited (EPSS, CISA KEV, Metasploit, Exploit Database, GitHub PoCs) and how urgently to patch it, with a 0-100 urgency score. Use it over REST, MCP or A2A.
Identify vulnerabilities within your AWS infrastructure and associated applications with CyberPulse Penetration Testing Services.
DNSPulse is a domain intelligence API for AI agents and security teams: one call returns a domain's DNS records, TLS certificate and WHOIS (RDAP) registration data, and a second lists its subdomains from Certificate Transparency logs. Use it over REST, MCP or A2A.
CostPulse is an AWS pricing API for FinOps teams and AI agents: it finds the cheapest commercial AWS region for an EC2, RDS, Lambda, S3 or Bedrock SKU, compares regions, prices a multi-service workload and calculates the savings of moving region. Use it over REST, MCP or A2A.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.