# Fablerlabs Secret Scanner

> Fablerlabs Secret Scanner is a paid API for AI agents from x402.fablerlabs.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-16).

Scans text or source code for accidentally-committed secrets such as API keys, tokens, and private keys before publication.

## Facts

- Endpoint: POST https://x402.fablerlabs.com/scan/secrets
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fablerlabs-secret-scanner-8b966dc6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QrTnNGZ-Ojzv-zVMg700u

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fablerlabs-secret-scanner-8b966dc6 -d '<json body>'
```

Example prompt: Scan this code snippet for any accidentally exposed secrets like API keys, tokens, or private keys before I publish it: `const apiKey = 'sk-abc123xyz...'`

## When to prefer this

Use this endpoint when you need a lightweight, per-call secret scanning service without standing up a dedicated secrets detection tool. Ideal for CI/CD pre-commit hooks, paste-before-publish checks, or agent workflows that need to verify code or config text is safe to share. Best for small-to-medium text snippets rather than full repository scans.

## Known failure modes

- Empty or missing 'text' field returns a validation error
- Extremely large text payloads may be rejected or time out
- Payment failure (insufficient USDC balance) results in a 402 response
- False negatives possible for obfuscated or non-standard credential formats
- Service unavailable returns a 5xx error

## How this service works

Scan text for accidentally-committed secrets (API keys, tokens, private keys) before you publish it.

## Output

Returns a list of detected secrets found in the submitted text, including the type of credential (e.g. API key, private key, token), the matched value or pattern, and its location within the input. If no secrets are found, returns a clean result.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "text": {
   "type": "string",
   "description": "Text or source code to scan for exposed credentials."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "clean": true,
  "findings": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fablerlabs-secret-scanner-8b966dc6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.fablerlabs.com](https://www.zero.xyz/host/x402.fablerlabs.com/llms.txt)