# AgentsTools IaC Inspect — Single-Resource Static Misconfiguration Scan

> AgentsTools IaC Inspect — Single-Resource Static Misconfiguration Scan is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.006/call, status unknown (last checked 2026-09-13).

Statically scans a single infrastructure-as-code resource snippet (Terraform, Kubernetes, Dockerfile, docker-compose, or CloudFormation) for security misconfigurations, returning a verdict, risk score, and actionable findings.

## Facts

- Endpoint: POST https://api.agentstools.dev/iac/inspect
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstools-iac-inspect-single-resource-static-misconfiguration-scan-6db7dc81
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YcneflImR3OTR_EFcviJr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstools-iac-inspect-single-resource-static-misconfiguration-scan-6db7dc81 -d '<json body>'
```

Example prompt: Can you scan this Terraform aws_s3_bucket resource snippet for misconfigurations and tell me the security verdict, risk score, and any findings with fix hints? Here's the config: resource "aws_s3_bucket" "my_bucket" { bucket = "my-bucket" acl = "public-read" }

## When to prefer this

Choose this endpoint when you need a fast, cheap ($0.006) security scan of a single IaC resource snippet in isolation — ideal for inline CI/CD gates, pre-commit hooks, or agent-driven code review where you process one resource at a time. Prefer this over a full /iac/scan when you want minimal latency and cost per resource rather than scanning an entire file or repository.

## Known failure modes

- Missing or empty 'resource' field returns a 400 validation error
- Unsupported or malformed config format may result in no findings or parse error
- Auto-detection ('auto' kind) may misidentify the format for ambiguous snippets
- Multi-resource snippets may only partially analyze or return unexpected results since endpoint is designed for single resources
- Rate limiting or payment failure returns 402 or 429 errors
- Very large snippets may be truncated or rejected

## How this service works

Static misconfiguration scan of a SINGLE infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose or CloudFormation). The lightweight per-resource form of /iac/scan: returns a verdict (pass, caution, block), a risk score and findings with rule, severity, location and fix hint. Security indicators, not a guarantee.

## Output

Returns a JSON object containing: a verdict string ('pass', 'caution', or 'block') indicating overall security posture, a numeric risk score, and an array of findings each with a rule ID, severity level, location within the snippet, and a fix hint describing the recommended remediation. Results are security indicators, not guarantees.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "kind": {
   "enum": [
    "auto",
    "terraform",
    "terraform-plan",
    "kubernetes",
    "dockerfile",
    "docker-compose",
    "cloudformation"
   ],
   "type": "string",
   "description": "Config format of the snippet, or auto to detect"
  },
  "resource": {
   "type": "string",
   "description": "A single-resource config snippet to inspect"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstools-iac-inspect-single-resource-static-misconfiguration-scan-6db7dc81/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)