Documentation

REST API

One endpoint. Submit 1–500 packages and get back risk scores for each. The full OpenAPI spec is available at /openapi.yaml.

Authentication

All requests require a Bearer token. Create an API key from your dashboard.

Authorization: Bearer YOUR_API_KEY

POST /api/v1/checks

Request body

Example request

curl -X POST https://www.coderecon.com/api/v1/checks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "registry": "rubygems",
    "packages": [
      { "name": "nokogiri", "version": "1.16.5" },
      { "name": "devise", "version": "4.9.4" }
    ]
  }'

Example response

{
  "status": "complete",
  "package_count": 2,
  "results": {
    "nokogiri": {
      "version": "1.16.5",
      "status": "analyzed",
      "scores": {
        "license_compliance": {
          "score": 0.95,
          "confidence": 1.0,
          "analyzer": "static",
          "signals": [
            { "signal": "permissive_license", "description": "MIT license detected" }
          ]
        },
        "security_surface": {
          "score": 0.45,
          "confidence": 0.9,
          "analyzer": "static",
          "signals": [
            {
              "signal": "eval_usage",
              "description": "Dynamic code evaluation detected",
              "detail": ["lib/nokogiri/html5.rb:87"]
            }
          ]
        }
      }
    },
    "devise": {
      "version": "4.9.4",
      "status": "pending"
    }
  }
}

Result statuses

Facet scores

Each analyzed package returns scores across five facets. Scores range from 0 (high risk) to 1 (low risk).

Error responses

Billing

Each package with analyzed status counts as one billable check. Packages with pending or unknown status are not billed. Each (organization, package_version) pair is billed at most once per billing period, so re-checking the same versions costs nothing.

Policy Gates

Policy gates let you define organization-wide rules that automatically evaluate every package check against your risk tolerance. When a package violates a rule, the API response includes a policy verdict (pass, warn, or fail) and details on each violation, so your agents and CI pipelines can act on it.

Available on Team plans and above. Configure via the dashboard or the API.

Rule types

Each rule has an action: fail or warn. The overall verdict is fail if any rule fails, warn if any rule warns (and none fail), or pass if no rules trigger.

API configuration

Manage your policy programmatically via the policy API. All endpoints require an API key with an organization on a Team plan or above.

GET /api/v1/policy

Returns the current policy for your organization.

PUT /api/v1/policy

Replace the current policy. Accepts a JSON body with any combination of rule types.

Example request

curl -X PUT https://www.coderecon.com/api/v1/policy \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "policy": {
      "score_thresholds": {
        "security_surface": { "minimum": 0.5, "action": "fail" },
        "license_compliance": { "minimum": 0.7, "action": "warn" }
      },
      "signal_rules": {
        "eval": { "action": "fail" },
        "single_publisher": { "action": "warn" }
      },
      "signal_value_rules": {
        "version_age_days": { "operator": "less_than", "value": 7, "action": "fail" }
      }
    }
  }'

DELETE /api/v1/policy

Clear the policy for your organization. Subsequent checks will not include policy evaluation.

Policy in check responses

When a policy is configured, each analyzed package in a check response includes a policy object:

{
  "policy": {
    "verdict": "fail",
    "violations": [
      {
        "rule_type": "score_threshold",
        "name": "security_surface",
        "action": "fail",
        "message": "security_surface score 0.3 is below minimum 0.5"
      },
      {
        "rule_type": "signal_rule",
        "name": "eval",
        "action": "fail",
        "message": "signal 'eval' detected"
      }
    ]
  }
}

GitHub Actions

- name: Check dependencies
  run: |
    curl -sf -X POST https://www.coderecon.com/api/v1/checks \
      -H "Authorization: Bearer ${{ secrets.CODERECON_API_KEY }}" \
      -H "Content-Type: application/json" \
      -d '{
        "registry": "rubygems",
        "packages": [
          { "name": "rails", "version": "8.0.0" }
        ]
      }'

Limits & Quotas

Both the REST API and MCP server share the same rate limits and query quotas.