# agent402.tools Solidity Smart Contract Security Scanner

> agent402.tools Solidity Smart Contract Security Scanner is a paid API for AI agents from agent402.tools, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Runs a deterministic static analysis scan on Solidity source code, flagging common security vulnerabilities using a fixed ruleset

## Facts

- Endpoint: POST https://agent402.tools/api/solidity-scan
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-tools-solidity-smart-contract-security-scanner-ed28ca27
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_DNkfgpCLrVmGz0-SZpW9V

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-tools-solidity-smart-contract-security-scanner-ed28ca27 -d '<json body>'
```

Example prompt: Can you scan this Solidity contract source code for security vulnerabilities? I want to check it for things like tx.origin authentication, delegatecall, selfdestruct, unchecked low-level calls, and floating pragmas.

## When to prefer this

Choose this endpoint when you need fast, deterministic, rule-based static analysis of Solidity smart contract source code without setting up a local toolchain. It is ideal for quick pre-deployment security checks, CI pipeline integration via AI agents, or auditing third-party contracts. Prefer it over full formal verification tools when speed and cost matter and a fixed-ruleset scan is sufficient. Not suitable for runtime analysis, fuzzing, or detecting logic-level business vulnerabilities.

## Known failure modes

- Source text exceeds 512KB limit — request rejected
- Invalid or non-Solidity text submitted — may produce empty or misleading results
- Payment of $0.01 USDC not fulfilled — 402 Payment Required response
- Malformed JSON request body — 400 error
- Network timeout for very large contracts near the size limit

## How this service works

Deterministic static pattern scan of Solidity smart-contract source text - a fixed ruleset flagging tx.origin authentication, delegatecall, selfdestruct, unchecked low-level calls, unchecked .send(), floating pragmas, block-timestamp dependence, weak block-derived randomness, value-call reentrancy surface, inline assembly, ecrecover, and missing SPDX headers. Returns line-anchored findings with severities.

## Output

A list of flagged security issues found in the submitted Solidity source, including which vulnerability patterns were detected (e.g., tx.origin auth, delegatecall usage, selfdestruct, unchecked .send(), floating pragma, block-timestamp dependence) with relevant details about each finding.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "source": {
   "type": "string",
   "description": "Solidity source text to scan (max 512KB)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "lines": 7,
  "summary": {
   "low": 1,
   "high": 2,
   "info": 1,
   "medium": 1
  },
  "findings": [
   {
    "line": 4,
    "rule": "tx-origin",
    "message": "tx.origin used - authentication via tx.origin is phishable; use msg.sender.",
    "snippet": "require(tx.origin == msg.sender);",
    "severity": "high"
   }
  ],
  "disclaimer": "Deterministic heuristic pattern check - not a compiler, not an audit."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-tools-solidity-smart-contract-security-scanner-ed28ca27/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)