# AgentsTools Code Security Inspector

> AgentsTools Code Security Inspector is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-13).

Performs static application security testing (SAST) on a code blob, detecting CWE Top-25 vulnerabilities like SQL injection, XSS, and SSRF with per-finding severity and line numbers.

## Facts

- Endpoint: POST https://api.agentstools.dev/code/inspect
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstools-code-security-inspector-4686dd85
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RaxiXXWr3fRbYBCZ139Um

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstools-code-security-inspector-4686dd85 -d '<json body>'
```

Example prompt: Scan this Python code snippet for security vulnerabilities — I want to know if there are any SQL injection, XSS, or command injection issues, with the CWE ID, severity, and line number for each finding: `cursor.execute('SELECT * FROM users WHERE id=' + user_id)`

## When to prefer this

Choose this endpoint when you need a fast, per-snippet static security scan against CWE Top-25 vulnerabilities with structured machine-readable output (CWE ID, severity, line number) suitable for automated pipelines. Prefer it over manual code review for quick pre-commit checks, AI-generated code validation, or lightweight SAST without standing up a full security toolchain. Not a replacement for dynamic analysis or full-repo scanners.

## Known failure modes

- Unsupported language (only python, javascript, java, go, php, ruby accepted) returns an error
- Malformed or empty code blob may return no findings or an error
- Static analysis may produce false positives or miss runtime-only vulnerabilities
- Very large code blobs may time out or exceed payload limits
- Complex obfuscated code may reduce detection accuracy

## How this service works

Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its language; returns a verdict with per-finding CWE, severity and line. Static indicators, not a guarantee.

## Output

Returns a security verdict for the submitted code blob containing a list of per-finding details: each finding includes the CWE identifier (e.g. CWE-89 for SQL injection), a severity level, and the line number where the issue was detected. The overall verdict indicates whether the code passed or has flagged vulnerabilities.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "code": {
   "type": "string",
   "description": "The source code blob to inspect"
  },
  "language": {
   "type": "string",
   "description": "Language of the blob: python, javascript, java, go, php or ruby"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstools-code-security-inspector-4686dd85/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)