# Code Vulnerability MCP

> Code Vulnerability MCP is a paid API for AI agents from api.m2mcent.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Analyzes submitted code for security vulnerabilities and returns findings

## Facts

- Endpoint: POST https://api.m2mcent.com/codevulnerability-mcp/api/process
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/code-vulnerability-mcp-7c01956b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Pfz6TeDtP4rkp1-sHgV5H

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability code-vulnerability-mcp-7c01956b -d '<json body>'
```

Example prompt: Can you scan this Python function for security vulnerabilities and tell me what issues you find and how severe they are?

```python
def login(username, password):
    query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
    return db.execute(query)
```

## When to prefer this

Choose this endpoint when you need automated static security analysis of code snippets or files without setting up a local SAST tool. Particularly useful in agentic pipelines that review code before deployment, in CI/CD integrations, or when a user pastes code and wants an instant vulnerability scan. It is a pay-per-call service requiring USDC via x402, making it suitable for on-demand analysis without subscription overhead.

## Known failure modes

- Empty or missing 'data' field returns an error
- Non-code input may produce irrelevant or empty findings
- Extremely large code submissions may time out or be truncated
- Minified or obfuscated code may reduce detection accuracy
- Payment failure via x402 protocol returns 402 status before processing

## How this service works

The premier global index of 1,069 monetized MCP nodes across 205 specialized subdomains. Gasless USDC runtime settlements via x402 V2 Spec on Base L2. Save 95% token context.

## Output

Returns a structured report of security vulnerabilities found in the submitted code, typically including vulnerability type (e.g. SQL injection, XSS, buffer overflow), severity level, affected line or code segment, and recommended remediation steps.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "payload": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/code-vulnerability-mcp-7c01956b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.m2mcent.com](https://www.zero.xyz/host/api.m2mcent.com/llms.txt)