# DCL Trust Oracle – Secrets Scanner

> DCL Trust Oracle – Secrets Scanner is a paid API for AI agents from bazaar.fronesislabs.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-13).

Scans a text string for exposed credentials, API keys, private keys, database URLs, and webhook secrets, returning a COMMIT verdict when clean or NO_COMMIT when a finding is detected.

## Facts

- Endpoint: POST https://bazaar.fronesislabs.com/evaluate/secrets?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dcl-trust-oracle-secrets-scanner-1a0c3253
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_z6YssRBLO9TCgrkNOv5WT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dcl-trust-oracle-secrets-scanner-1a0c3253 -d '<json body>'
```

Example prompt: Before you send that response, run it through the DCL Trust Oracle secrets scanner to make sure it doesn't contain any exposed API keys, private keys, database URLs, or webhook secrets — use my agent ID 'agent-42' so it gets logged correctly.

## When to prefer this

Choose this endpoint when you need to scan a single block of text for secrets, credentials, private keys, database URLs, or webhook tokens before an agent takes an irreversible action such as sending a message, committing code, or calling an external service. Prefer it over generic content moderation endpoints when the specific concern is credential or secret leakage rather than toxicity, PII, or quality issues.

## Known failure modes

- Empty or missing 'response' field returns a validation error
- Malformed JSON body returns 400
- Payment not included or insufficient funds returns 402
- Very large text payloads may time out or be truncated
- False positives on high-entropy strings that resemble keys but are not

## How this service works

Scan text for exposed credentials, API keys, private keys, database URLs, and webhook secrets. COMMIT when nothing matches. NO_COMMIT on any finding. POST JSON {"response","agent_id"}.

## Output

Returns a verdict of COMMIT (no secrets found) or NO_COMMIT (one or more secrets detected), along with finding details describing what was matched. An audit record is stored on the audit chain linking the result to the provided agent_id and optional task_type.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "agent_id": {
   "type": "string",
   "description": "Caller id stored on the audit record. Omitted values are stored as unknown."
  },
  "response": {
   "type": "string",
   "minLength": 1,
   "description": "Text to scan. Raw content is not stored."
  },
  "task_type": {
   "type": "string",
   "description": "Optional task tag stored on the audit record. Defaults to unknown."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dcl-trust-oracle-secrets-scanner-1a0c3253/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bazaar.fronesislabs.com](https://www.zero.xyz/host/bazaar.fronesislabs.com/llms.txt)