# AgentsTools Secret Scanner

> AgentsTools Secret Scanner is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Statically scans source code or config text for hardcoded secrets and credentials, returning a pass/caution/block verdict with per-finding details on rule, provider, severity, and location.

## Facts

- Endpoint: POST https://api.agentstools.dev/secret/scan
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstools-secret-scanner-c39c1d94
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7pDQJnpG9zJFdMYrg1b-1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstools-secret-scanner-c39c1d94 -d '<json body>'
```

Example prompt: Can you scan this source code snippet for any hardcoded secrets or credentials — I want to know if it's safe to commit, and if not, which specific keys or tokens were found and how severe they are.

## When to prefer this

Choose this endpoint when you need a fast, cheap ($0.01) static scan of a single text blob, source file, or config snippet for secrets before committing, deploying, or sharing code. It is purpose-built for agentic workflows that need a go/no-go security signal without standing up a full SAST pipeline. Prefer it over general-purpose LLM analysis when you need structured, deterministic findings with severity and provider attribution.

## Known failure modes

- Empty or missing input text returns an error
- Oversized payloads may be rejected
- High-entropy random strings may trigger false positives for generic secrets
- Obfuscated or encoded secrets may not be detected
- Only static patterns are matched — runtime-injected secrets are invisible to this scan

## How this service works

Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-entropy generic secrets. Returns a go/no-go verdict (pass, caution, block) with per-finding rule, provider, severity and location. Secret indicators, not a guarantee.

## Output

Returns a top-level verdict (pass, caution, or block) along with an array of per-finding objects, each specifying the matched rule, the secret provider (e.g. AWS, Stripe, OpenAI), severity level, and the location within the text. Findings are indicators, not guaranteed confirmations.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "Alternatively a batch of objects, each with path and content"
  },
  "rules": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional list of rule ids to restrict to (see GET /secret/rules)"
  },
  "content": {
   "type": "string",
   "description": "Source code / config text to scan (single blob)"
  },
  "filename": {
   "type": "string",
   "description": "Optional path/name of the blob (affects fixture downgrade)"
  },
  "min_entropy": {
   "type": "number",
   "description": "Raise the entropy floor for generic rules"
  },
  "allow_test_fixtures": {
   "type": "boolean",
   "description": "Drop findings in test/example/doc paths entirely"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstools-secret-scanner-c39c1d94/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)