# Deploy Config Risk Scanner

> Deploy Config Risk Scanner is a paid API for AI agents from relay402.georgespring.workers.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Scans YAML, Docker Compose, or Kubernetes configuration snippets for deployment security risks including privileged containers, latest image tags, host networking, and plaintext secrets.

## Facts

- Endpoint: GET https://relay402.georgespring.workers.dev/api/security-deploy-config-risk
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/deploy-config-risk-scanner-3ca71913
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5SFmo2pfiBirEhEbV3q6D

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability deploy-config-risk-scanner-3ca71913
```

Example prompt: Can you scan this docker-compose.yml snippet for security risks and flag anything dangerous like privileged containers, host networking, plaintext secrets, or latest image tags? Here's the config: `version: '3' services: web: image: nginx:latest network_mode: host privileged: true`

## When to prefer this

Use this endpoint when you need a fast, automated security scan of deployment configuration files (YAML, Docker Compose, Kubernetes manifests) before shipping or merging. It's ideal for CI/CD pipelines, pre-commit hooks, or agent workflows that need to catch common misconfigurations like privileged containers, latest image tags, host networking, or hardcoded secrets without running a full SAST tool. Prefer this over general-purpose code scanners when the input is specifically a container or Kubernetes config snippet.

## Known failure modes

- Empty or missing config query parameter returns an error
- Config snippet exceeds 64,000 character limit and is rejected
- Malformed or non-YAML/non-Docker/non-Kubernetes input may produce no findings or a parse error
- Network timeout on the worker edge function
- GET method required — other HTTP methods will fail

## How this service works

deployment configuration risk scan for YAML, Docker Compose or Kubernetes snippets: flags privileged containers, latest tags, host networking and plaintext secrets.

## Output

Returns a list of security risk findings for the scanned configuration, each identifying the type of issue (e.g. privileged container, latest image tag, host networking enabled, plaintext secret), the relevant config key or line, and a severity or risk description. The response is structured for easy automated consumption by an agent or CI pipeline.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "config"
     ],
     "properties": {
      "config": {
       "type": "string",
       "maxLength": 64000,
       "minLength": 1
      },
      "filename": {
       "type": "string",
       "maxLength": 200
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/deploy-config-risk-scanner-3ca71913/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from relay402.georgespring.workers.dev](https://www.zero.xyz/host/relay402.georgespring.workers.dev/llms.txt)