# Code Security Scan API

> Code Security Scan API is a paid API for AI agents from scan-api-production-e73f.up.railway.app, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-16).

Scans source code for security vulnerabilities using Semgrep, ESLint, Bandit, and npm audit on a pay-per-scan basis via x402.

## Facts

- Endpoint: POST https://scan-api-production-e73f.up.railway.app/scan?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/code-security-scan-api-ebb26cb1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_NCglsksDY9fCjqp-Z9bNB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability code-security-scan-api-ebb26cb1 -d '<json body>'
```

Example prompt: Can you scan this Python function for security vulnerabilities? Here's the code: `import subprocess; subprocess.call(input())`

## When to prefer this

Choose this endpoint when you need on-demand, pay-per-use security scanning of code snippets without managing your own SAST toolchain. It is ideal for agents that need to gate code on security checks before deployment, or for developers who want to audit individual functions or files without setting up Semgrep, Bandit, ESLint, or npm audit locally. Prefer it over full CI/CD integrations when scanning isolated code blocks programmatically.

## Known failure modes

- Missing required 'code' field returns a validation error
- Unsupported language values outside the enum cause rejection
- Extremely large code payloads may time out or be rejected
- Payment failure via x402 prevents scan from executing
- Auto-detection may misidentify language if code is ambiguous

## How this service works

Pay-per-scan code security scanning (Semgrep, ESLint, Bandit, npm audit) via x402.

## Output

A JSON object containing identified security vulnerabilities, warnings, and findings from the applicable scanners (Semgrep, ESLint, Bandit, or npm audit) based on the detected or specified language, including issue descriptions, severity levels, and line references.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "code"
 ],
 "properties": {
  "code": {
   "type": "string",
   "description": "Source code to scan"
  },
  "language": {
   "enum": [
    "javascript",
    "python",
    "typescript",
    "html"
   ],
   "type": "string",
   "description": "Optional; auto-detected if omitted"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/code-security-scan-api-ebb26cb1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scan-api-production-e73f.up.railway.app](https://www.zero.xyz/host/scan-api-production-e73f.up.railway.app/llms.txt)