# AgentsTools Secret Diff Scanner

> AgentsTools Secret Diff Scanner is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Scans a unified git diff for newly introduced secrets/credentials on added lines only, returning a pass/caution/block verdict with per-finding details

## Facts

- Endpoint: POST https://api.agentstools.dev/secret/diff
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstools-secret-diff-scanner-2155c639
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zVKBsrVwCDW4GRnIa_QWI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstools-secret-diff-scanner-2155c639 -d '<json body>'
```

Example prompt: Scan this unified diff for any newly introduced secrets or credentials — flag only lines I'm adding, not stuff that was already there, and give me a verdict on whether it's safe to commit.

## When to prefer this

Choose this endpoint when you want low-false-positive, pre-commit focused secret detection that ignores already-present secrets in unchanged or removed code. It is ideal for CI/CD pipelines, agent-driven code review, and developer tooling where you only care about credentials being newly introduced by a patch. Prefer it over full-repository scanners when you have a diff already and want a fast, cheap per-call verdict without scanning the entire codebase.

## Known failure modes

- Malformed or non-unified diff format causes a parsing error
- Empty diff body returns a pass verdict with no findings
- Invalid rule IDs in the rules filter may cause the scan to return an error or skip filtering
- Very large diffs may exceed payload limits
- False negatives are possible — the service returns indicators, not guarantees of completeness
- Test fixture paths may be flagged unless allow_test_fixtures is set to true

## How this service works

Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged. Returns a verdict (pass, caution, block) with per-finding rule, provider, severity, file and line. Secret indicators, not a guarantee.

## Output

A JSON object containing a top-level verdict ('pass', 'caution', or 'block') and an array of findings, each with the matched rule ID, secret provider, severity level, affected file path, and line number within the diff. Only lines added in the diff are reported on; removed or unchanged lines are ignored.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "diff": {
   "type": "string",
   "description": "A unified diff; only added lines are scanned"
  },
  "rules": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional list of rule ids to restrict to"
  },
  "min_entropy": {
   "type": "number",
   "description": "Raise the entropy floor for generic rules"
  },
  "allow_test_fixtures": {
   "type": "boolean",
   "description": "Drop added lines in test/example paths entirely"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstools-secret-diff-scanner-2155c639/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)