Sold by: Waltsoft Inc.
Deployed on AWS
Quick Launch
CodePulse is a package security scanner API for AI agents and security teams: one call scans an npm or PyPI package and returns its known CVEs from OSV.dev, its license (SPDX identifier), and flags typosquatting attempts based on name similarity to popular packages. Use it over REST, MCP or A2A.
Overview
What CodePulse does
CodePulse turns a package name into a structured security and compliance profile that an AI agent or a supply-chain pipeline can reason over directly.
- GET /v1/scan?pkg=express&ecosystem=npm returns the package's known CVEs from OSV.dev (ID, severity, summary, affected versions, fixed versions), its SPDX license identifier, and a typosquat risk score (0.0-1.0) based on name similarity to the top 1000 packages in that ecosystem.
- GET /v1/vulns?pkg=lodash&ecosystem=npm returns only the CVE list.
Where the data comes from
CVE data comes from the OSV.dev API (Google's Open Source Vulnerabilities database), which aggregates advisories from npm, PyPI, GitHub Security Advisories, and other sources. License identifiers come from the package registry metadata. Typosquat scoring compares the package name against the most-downloaded packages using edit distance. If OSV.dev is down the API answers 503 and the call is not billed.
Three ways to connect
- REST with an X-API-Key header, described by an OpenAPI 3 schema (https://codepulse.waltsoft.net/openapi.json ).
- MCP: the tool codepulse___scanPackage on the Amazon Bedrock AgentCore Gateway, for Claude, Strands Agents and other MCP clients.
- A2A (Agent2Agent 0.3): the agent card at https://codepulse.waltsoft.net/.well-known/agent-card.json with the skill scanPackage.
Who it is for
Software composition analysis pipelines, dependency-risk agents, open-source governance and license compliance tools, and supply-chain security workflows that need authoritative CVE, license and typosquat data without stitching together multiple package security sources.
Billing
You pay per successful call on your AWS bill. Errors (400, 401, 404, 429, 5xx) are never billed. Rate limit: 50 requests per second, bursts up to 100.
Highlights
- Package security profile in one call: known CVEs from OSV.dev (ID, severity, summary, affected and fixed versions), SPDX license identifier, and typosquat risk score
- npm and PyPI ecosystems: scan Node.js and Python packages with ecosystem=npm or ecosystem=pypi; OSV.dev outage returns 503 and is never billed
- Agent-ready: REST with an OpenAPI 3 schema, an MCP tool on Amazon Bedrock AgentCore Gateway and an A2A agent card; pay only for successful calls on your AWS bill
Details
Sold by
Categories
Delivery method
Integration protocol
Supported services
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Quick Launch
Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/unit |
|---|---|---|
API Call | Single API call to the service | $0.01 |
Vendor refund policy
No refunds for API calls already made. Contact support@waltsoft.net within 7 days of billing issues.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Supported services:
- Amazon Bedrock AgentCore
API-Based Agents & Tools
API-Based Agents and Tools integrate through standard web protocols. Your applications can make API calls to access agent capabilities and receive responses.
Additional details
Usage instructions
To get started using the remote MCP server, follow the instructions below:
Available Tools This MCP server (Amazon Bedrock AgentCore Gateway) supports the following tool:
- codepulse___scanPackage - Scan npm or PyPI package for CVEs (OSV.dev), license (SPDX), and typosquat risk. Arguments: pkg (e.g. express), ecosystem (npm or pypi; optional, default npm), api_key
Prerequisites
- An active subscription to this product. Your API key (it starts with mp_) is stored in your AWS Secrets Manager after you choose Set up your account, and is also shown on the registration page.
- Install Node.js and npm (for mcp-remote), or Python 3.10+ (for the Strands Agents SDK).
Authentication The MCP endpoint needs no connection header. Pass your key as the api_key argument of every tool call; replace YOUR_API_KEY with your actual key below. A wrong or inactive key returns statusCode 401.
MCP endpoint: https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp
Claude Desktop Edit the configuration file at:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json
Add the below code:
{ "mcpServers": { "waltsoft-codepulse": { "command": "npx", "args": [ "mcp-remote", "https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp" ] } } }Then ask, for example: "Use codepulse___scanPackage with pkg express, ecosystem npm and api_key YOUR_API_KEY".
Strands Agents (Python)
pip install strands-agents mcp from mcp.client.streamable_http import streamable_http_client from strands.tools.mcp import MCPClient URL = "https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp" with MCPClient(lambda: streamable_http_client(URL)) as mcp: result = mcp.call_tool_sync("call-1", "codepulse___scanPackage", {"pkg": "express", "ecosystem": "npm", "api_key": "YOUR_API_KEY"}) print(result["content"][0]["text"])Example tool result
{"statusCode": 200, "result": {"package": "express", "ecosystem": "npm", "vulnerabilities": [{"id": "GHSA-...", "severity": "high", "summary": "Path traversal in express"}], "metadata": {"name": "express", "version": "5.0.0", "license": "MIT"}, "typosquat_risk": {"risk_level": "low", "signals": []}}}Rate Limits
- 50 requests per second (bursts up to 100).
- Exceeding returns HTTP 429 Too Many Requests.
- Use retry and exponential backoff to handle limits.
Learn More API Docs: https://codepulse.waltsoft.net Support: support@waltsoft.net
Support
Vendor support
Contact support@waltsoft.net . Documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
ThreatPulse is a CVE exploit intelligence API for security teams, CI/CD pipelines and AI agents: one call tells you whether a vulnerability is exploited (EPSS, CISA KEV, Metasploit, ExploitDB, GitHub PoCs) and how urgently to patch it, with a 0-100 urgency score. Use it over REST, MCP or A2A.
DNSPulse is a domain intelligence API for AI agents and security teams: one call returns a domain's DNS records, TLS certificate and WHOIS (RDAP) registration data, and a second lists its subdomains from Certificate Transparency logs. Use it over REST, MCP or A2A.
WebPulse is a web content API for AI agents: one endpoint extracts clean text, title, and metadata from any URL, and a second endpoint searches the web and returns structured results. Use it over REST, MCP or A2A.
CostPulse is an AWS pricing API for FinOps teams and AI agents: it finds the cheapest commercial AWS region for an EC2, RDS, Lambda, S3 or Bedrock SKU, compares regions, prices a multi-service workload and calculates the savings of moving region. Use it over REST, MCP or A2A.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.