# Code Security Scan API

> Code Security Scan API is a paid API for AI agents from scan-api-production-e73f.up.railway.app, paid per call via x402, $0.25/call, status unknown (last checked 2026-10-16).

Performs pay-per-scan static security analysis on source code using Semgrep, ESLint, Bandit, and npm audit, returning vulnerability findings.

## Facts

- Endpoint: POST https://scan-api-production-e73f.up.railway.app/scan/deep?utm_source=zero.xyz
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/code-security-scan-api-306485f2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bIXIy_1ftNO-CGKdIrqGI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability code-security-scan-api-306485f2 -d '<json body>'
```

Example prompt: Can you scan this Python script for security vulnerabilities? Here's the code: `import os; password = 'hardcoded123'; os.system('rm -rf ' + user_input)`

## When to prefer this

Choose this endpoint when you need on-demand, pay-per-use static security analysis across multiple languages (JavaScript, TypeScript, Python, HTML) without committing to a subscription. It's ideal for CI/CD pipelines, code review automation, or one-off security audits where you want results from multiple tools (Semgrep + ESLint + Bandit + npm audit) aggregated in a single call.

## Known failure modes

- Code field is empty or missing — returns validation error
- Language not auto-detectable and not specified — may produce incomplete results
- Unsupported language submitted — returns error or empty findings
- Code too large — may time out or be rejected
- Payment not processed via x402 — returns 402 Payment Required

## How this service works

Pay-per-scan code security scanning (Semgrep, ESLint, Bandit, npm audit) via x402.

## Output

Returns a structured object containing security scan results, including identified vulnerabilities, their severity levels, affected lines or patterns, the tool(s) that flagged each issue (Semgrep, ESLint, Bandit, or npm audit), and remediation guidance where available.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "code"
 ],
 "properties": {
  "code": {
   "type": "string",
   "description": "Source code to scan"
  },
  "language": {
   "enum": [
    "javascript",
    "python",
    "typescript",
    "html"
   ],
   "type": "string",
   "description": "Optional; auto-detected if omitted"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/code-security-scan-api-306485f2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scan-api-production-e73f.up.railway.app](https://www.zero.xyz/host/scan-api-production-e73f.up.railway.app/llms.txt)