# cicd-scan

> cicd-scan is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-12).

Statically scans a CI/CD pipeline configuration file (GitHub Actions, GitLab CI, or CircleCI) for security vulnerabilities and misconfigurations, returning a verdict, risk score, and per-finding details with fix hints.

## Facts

- Endpoint: POST https://payai.agentstools.dev/ci/scan?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cicd-scan-8052d301
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_22JRmYGOTnQDFJRVcFBQg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cicd-scan-8052d301 -d '<json body>'
```

Example prompt: Can you scan this GitHub Actions workflow file for security issues and tell me whether it passes, needs caution, or should be blocked, along with a risk score and any specific fixes I should make?

## When to prefer this

Choose this endpoint when you need a fast, structured, per-rule security analysis of a CI/CD config file specifically for GitHub Actions, GitLab CI, or CircleCI — especially when you need actionable fix hints and a machine-readable verdict (pass/caution/block) suitable for automated pipeline gating. Prefer this over generic SAST tools when your primary concern is supply-chain risks like unpinned actions, secret leakage, permission sprawl, and injection in CI workflows.

## Known failure modes

- Unrecognized or malformed YAML/config content returns a parsing error
- Content too large may be rejected or truncated
- Auto-detection may misidentify the CI format if the file is ambiguous — use explicit format enum to avoid this
- False negatives are possible; results are security indicators, not guarantees
- Empty or missing content field returns a validation error

## How this service works

Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.

## Output

Returns a verdict string (pass, caution, or block), a 0–100 integer risk score, and an array of per-finding objects each containing: the rule ID triggered, severity level, the affected object/step, its location in the file, and a concrete fix hint. Multiple findings can be returned for a single scan.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "format": {
   "enum": [
    "auto",
    "github-actions",
    "gitlab-ci",
    "circleci"
   ],
   "type": "string",
   "description": "CI system, or auto to detect from the content"
  },
  "content": {
   "type": "string",
   "description": "The CI/CD config text to scan (workflow file)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cicd-scan-8052d301/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)