# CoinOpSelect Solidity & JavaScript Vulnerability Scanner

> CoinOpSelect Solidity & JavaScript Vulnerability Scanner is a paid API for AI agents from coinop.publicvm.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Scans Solidity or JavaScript source code for security vulnerabilities and returns structured findings with risk scores and severity levels.

## Facts

- Endpoint: POST https://coinop.publicvm.com/api/v1/audit/vulnerability-scan?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/coinopselect-solidity-javascript-vulnerability-scanner-2144983b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JYY9u5RHwN5iDkyx1DaHu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability coinopselect-solidity-javascript-vulnerability-scanner-2144983b -d '<json body>'
```

Example prompt: Can you scan this Solidity smart contract code for security vulnerabilities and give me a risk score and list of any findings? Here's the code: [paste contract source]

## When to prefer this

Choose this endpoint when you need a fast, pay-per-call on-chain vulnerability scan of Solidity or JavaScript code without a subscription, especially in automated agent pipelines where cost-per-scan control matters. It is well-suited for pre-deployment audits of smart contracts on Base or other EVM chains and returns machine-readable structured findings ideal for downstream agent decision-making.

## Known failure modes

- Empty or malformed source code input returns zero findings with scannedBytes of 0
- Unsupported language value causes fallback to Solidity default or error
- Payment failure via x402 (insufficient USDC balance) results in 402 response before scan executes
- Very large code inputs may time out or return partial results
- Network instability on Base may cause payment confirmation delays

## How this service works

Paid on-chain token, wallet, contract and research data over x402 on Base.

## Output

Returns a JSON object with a summary string (e.g. 'No findings'), an array of vulnerability findings each with severity and details, an overall riskScore (numeric), the number of scannedBytes, and a severityOrder array ranking levels from critical down to info. Source attribution is also included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "code": {
   "type": "string",
   "description": "Source code to scan"
  },
  "language": {
   "type": "string",
   "default": "solidity",
   "description": "solidity|javascript"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "source": "stream-2-a2a/scanner",
  "summary": "No findings",
  "findings": [],
  "riskScore": 0,
  "scannedBytes": 0,
  "severityOrder": [
   "critical",
   "high",
   "medium",
   "low",
   "info"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/coinopselect-solidity-javascript-vulnerability-scanner-2144983b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from coinop.publicvm.com](https://www.zero.xyz/host/coinop.publicvm.com/llms.txt)