# AgentsTools Code Security Scanner

> AgentsTools Code Security Scanner is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-13).

Statically scans source code or a git-diff for CWE Top-25 vulnerabilities across Python, JavaScript, TypeScript, Java, and Go, returning a verdict with per-finding CWE ID, severity, file, and line.

## Facts

- Endpoint: POST https://api.agentstools.dev/code/scan
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstools-code-security-scanner-204cd45f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_k1Oo1ahx_gzJ6BE6xogtG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstools-code-security-scanner-204cd45f -d '<json body>'
```

Example prompt: Can you scan this Python function for security vulnerabilities — specifically check for SQL injection, command injection, and path traversal issues, and tell me if it passes or fails with the exact CWE IDs and line numbers?

## When to prefer this

Choose this endpoint when you need a fast, automated CWE Top-25 security verdict on source code or a git-diff without setting up a local SAST tool. Ideal for CI/CD pipeline gates, pre-merge checks, or agent-driven code review workflows. Covers the most critical logic bug categories across five mainstream languages at low cost per call ($0.02 USDC). Prefer it over general-purpose LLM code review when you need structured, machine-readable findings with CWE IDs and line numbers rather than prose suggestions.

## Known failure modes

- Code too large or exceeds input size limits — truncate or split the file
- Unsupported language submitted — only Python, JavaScript, TypeScript, Java, and Go are supported
- Malformed or unparseable code snippet returns an error or empty findings
- False negatives possible — static analysis cannot catch all runtime vulnerabilities
- Network timeout on very large diffs

## How this service works

Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, insecure randomness, open redirect and XXE across Python, JavaScript, TypeScript, Java and Go. Returns a go/no-go verdict with per-finding CWE, severity, file and line. Static indicators, not a guarantee.

## Output

A go/no-go verdict indicating whether the code passed or failed the security scan, accompanied by a list of per-finding details including the CWE identifier, severity level (e.g. critical/high/medium/low), the affected file name, and the specific line number. Covers CWE Top-25 categories including SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, insecure randomness, open redirect, and XXE.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "diff": {
   "type": "string",
   "description": "A unified git-diff; only added lines are scanned"
  },
  "files": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "Alternatively a batch of objects, each with path, content and optional language"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstools-code-security-scanner-204cd45f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)