# Delx XSS Signal Scan

> Delx XSS Signal Scan is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-13).

Scans untrusted text for cross-site scripting (XSS) signals and returns a deterministic, machine-readable JSON result without echoing or retaining the input.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/xss-signal-scan
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/delx-xss-signal-scan-32e693be
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vCUUc6z8Nz9KU29E7lBom

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability delx-xss-signal-scan-32e693be -d '<json body>'
```

Example prompt: Before we process this user-submitted comment, scan it for XSS signals: '<script>alert(1)</script> Great product!'

## When to prefer this

Choose this endpoint when you need a fast, stateless, privacy-preserving preflight XSS signal check inside an agent workflow before data reaches production systems. It is ideal when you cannot afford to echo or retain user input, need deterministic JSON output for downstream logic, and want a lightweight bounded check rather than a full WAF or runtime sanitizer. Prefer it over general-purpose LLM-based security checks when reproducibility and machine-readability of results matter.

## Known failure modes

- Empty or missing 'text' field returns a validation error
- Oversized input may be rejected with a payload-too-large error
- Payment failure via x402 protocol results in a 402 response before scan executes
- Network timeout if the endpoint is temporarily unavailable
- Ambiguous or edge-case payloads may produce advisory results that require caller-side interpretation

## How this service works

Screen untrusted text for common cross-site scripting signals without echoing it. Use it as a bounded preflight or analysis step inside an enterprise agent workflow before data, policy, integration, security, or commercial decisions reach production. Returns deterministic machine-readable JSON for $0.003 USDC via x402 on Base. Execution is first-party, local-only, stateless, memory-only, and has no paid upstream or input retention. Results are advisory; the caller remains responsible for author…

## Output

A deterministic machine-readable JSON object indicating whether XSS signals were detected in the submitted text, along with relevant signal details. The result is advisory and stateless — no input is retained or echoed back. The caller remains responsible for final security decisions.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "text": {
   "type": "string",
   "description": "Input field: text."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": "high",
  "schema": "delx/util-xss-signal-scan/v1",
  "advisory": "Heuristic only; use parameterization, contextual encoding, and allowlists.",
  "text_sha256": "5c140d35dcb46a622e2cedf5ef5cc3638cdffd1c118c9331f8c84669f0b74783",
  "signal_count": 1,
  "values_returned": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/delx-xss-signal-scan-32e693be/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)