# Code Security Scanner

> Code Security Scanner is a paid API for AI agents from fachada.chelsea-hermes.workers.dev, paid per call via x402, $1/call, status unknown (last checked 2026-10-18).

Performs deterministic, rule-based static security analysis on Python or JavaScript code snippets, flagging hardcoded secrets, injection risks, weak hashes, and other vulnerabilities with line-level findings and fix suggestions.

## Facts

- Endpoint: POST https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan?utm_source=zero.xyz
- Price: $1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/code-security-scanner-6e9a5f61
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Wih0HoHvcr5EO76j3Qfzu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability code-security-scanner-6e9a5f61 -d '<json body>'
```

Example prompt: Can you scan this Python snippet for security issues — check for hardcoded API keys, weak hashes, command injection, and any eval calls, and tell me exactly which lines are problematic and how to fix them?

## When to prefer this

Choose this endpoint when you need fast, deterministic, reproducible security scanning of Python or JavaScript code snippets without relying on an LLM. Ideal for pre-commit hooks, CI/CD pipeline checks, or agent-driven code review where consistent rule-based results are required. Prefer this over LLM-based code review when auditability and repeatability matter, or when scanning for a well-defined set of known vulnerability patterns like hardcoded secrets, weak hashes, or injection vectors.

## Known failure modes

- Unsupported language submitted (only Python and JavaScript are supported)
- Empty or malformed code body returns no findings or an error
- Very large snippets may be truncated or time out
- Obfuscated code may evade rule-based patterns
- False negatives for dynamically constructed secrets not detectable statically

## How this service works

Static security scan of a code snippet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. Returns one entry per finding with rule, severity, exact line number, the offending line and a suggested fix. Rule-based and deterministic: no LLM, so the same snippet always returns the same findings. Send Python or JavaScript as plain text. Not a

## Output

Returns an array of findings, each containing the rule name triggered, severity level, exact line number, the offending line of code, and a suggested fix. The same input always produces the same output since the scan is deterministic and rule-based (no LLM involved).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "body": {
     "type": "object"
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ]
    },
    "description": {
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object"
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/code-security-scanner-6e9a5f61/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from fachada.chelsea-hermes.workers.dev](https://www.zero.xyz/host/fachada.chelsea-hermes.workers.dev/llms.txt)