# Docker Compose Security Risk Analyzer > Docker Compose Security Risk Analyzer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15). Reviews a built-in risky Docker Compose control-plane configuration for security vulnerabilities including privileged execution, host namespaces, broad capabilities, exposed Docker API ports, and mounted sockets without running containers ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/docker-compose-risk - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-15 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/docker-compose-security-risk-analyzer-a1a10573 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Uoi40bZkbOKSW2SGdkcMv Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability docker-compose-security-risk-analyzer-a1a10573 ``` Example prompt: Can you run a security review on the privileged-control-plane Docker Compose scenario and tell me what risks it has — things like privileged execution, exposed Docker socket, host namespaces, or hardcoded secrets? ## When to prefer this Use this endpoint when you need a static, no-execution security audit of a Docker Compose configuration specifically for control-plane or privileged workloads, checking for container escape risks, capability abuse, secret leakage, and missing hardening — without spinning up any containers. Prefer over generic linters when you need a structured risk score and BLOCK/WARN/PASS verdict with explicit approval gates. ## Known failure modes - Invalid scenario enum value returns a 400 validation error - Unsupported HTTP method returns a 405 error - Service temporarily unavailable returns a 500 or timeout - Payment not provided or insufficient returns a 402 Payment Required - Missing required input object returns a 400 schema validation error ## How this service works An autonomous paid API accepting USDC on Base mainnet. ## Output Returns a structured security analysis including a risk score (0-100), a PASS/WARN/BLOCK verdict, a summary narrative, per-service findings with specific issues flagged, approval gates required before deployment, analyzer version, analysis ID, and coverage statistics — all without starting any containers. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "privileged-control-plane" ], "type": "string", "description": "Built-in paid Docker Compose security-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "profile", "verdict", "risk_score", "summary", "stats", "services", "findings", "approval_gates", "coverage" ], "properties": { "label": { "type": "string" }, "stats": { "type": "object" }, "profile": { "enum": [ "production", "development" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "services": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "analysis_id": { "type": "string" }, "approval_gates": { "type": "array", "items": { "type": "string" } }, "analyzer_version": { "type": "string" } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "paid-demo:privileged-control-plane", "stats": { "volume_count": 0, "compose_bytes": 334, "network_count": 0, "service_count": 1, "tree_node_count": 19, "findings_by_severity": { "low": 2, "high": 6, "medium": 4, "critical": 4 }, "secret_definition_count": 0 }, "profile": "production", "summary": "BLOCK: 16 finding(s) across 1 service(s); 10 require resolution or explicit approval.", "verdict": "BLOCK", "coverage": { "mode": "static-parsed-docker-compose-json", "checks": [ "privilege and namespace isolation", "capabilities and security profiles", "runtime user and read-only filesystem", "secret and environment handling", "published ports and host mounts", "image and build immutability", "resource limits, health, and logging", "external network and volume boundaries" ], "limitations": [ "Accepts the caller's already parsed Compose JSON and does not resolve interpolation, profiles, includes, extends, anchors, or environment files.", "Does not inspect image metadata, layers, vulnerabilities, signatures, provenance, or Dockerfile contents.", "Does not verify host firewall rules, runtime defaults, secret-manager policy, external resource ownership, or the effective deployed model.", "Static findings do not replace docker compose config validation, image scanning, runtime policy, or a sandboxed deployment test." ], "builds_executed": false, "host_files_read": false, "environment_files_read": false, "secret_values_returned": false, "compose_project_started": false, "docker_daemon_contacted": false, "images_pulled_or_inspected": false }, "findings": [ { "code": "all_capabilities_added", "path": "services.control-plane.cap_add", "message": "The service adds all Linux capabilities.", "severity": "critical", "standard": "docker-runtime-least-privilege", "remediation": "Drop all capabilities and add back only the minimum required set." }, { "code": "literal_secret_environment", "path": "services.control-plane.environment", "message": "The service assigns 1 secret-like environment value(s); values are intentionally omitted.", "severity": "critical", "standard": "docker-compose-secrets", "remediation": "Use Compose secrets or an external secret manager and rotate any exposed value." }, { "code": "privileged_container", … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/docker-compose-security-risk-analyzer-a1a10573/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)