# Gitleaks Secret Scanner — The Stall x402

> Gitleaks Secret Scanner — The Stall x402 is a paid API for AI agents from the-stall.intuitek.ai, paid per call via x402, $4/call, status unknown (last checked 2026-09-13).

Scans a public GitHub repository for exposed secrets, credentials, and API keys using Gitleaks

## Facts

- Endpoint: GET https://the-stall.intuitek.ai/cap/gitleaks-scan
- Price: $4/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/gitleaks-secret-scanner-the-stall-x402-95359fcd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bQgT1cjDGx2Bds1syUxrt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability gitleaks-secret-scanner-the-stall-x402-95359fcd
```

Example prompt: Can you scan the public GitHub repo 'openai/openai-python' for any leaked secrets, API keys, or hardcoded credentials using Gitleaks?

## When to prefer this

Choose this endpoint when you need a quick, no-setup secrets scan on a public GitHub repository without configuring your own Gitleaks instance or CI pipeline. Ideal for one-off security audits, supply chain checks before adopting a dependency, or incident response triage. Pay-per-call via USDC means no subscription commitment. Prefer this over manual Gitleaks setup when you need results immediately from an agent workflow.

## Known failure modes

- Repository is private or inaccessible — returns an error since only public repos are supported
- Invalid 'owner/repo' format — returns a validation error
- Repository does not exist — returns a not-found error
- Very large repositories may time out or return partial results
- Rate limiting on GitHub's side may cause scan failures
- False positives — test fixtures or example keys flagged as real secrets

## How this service works

Domain-agnostic x402 capability chassis by IntuiTek¹. 300 AI-callable data services — pay USDC on Base mainnet. No accounts or API keys required.

## Output

Returns a list of detected secrets found in the repository, including the type of secret (e.g. AWS key, GitHub token, generic API key), the file path, line number, commit reference, and the matched rule that triggered the detection. If no secrets are found, returns a clean result.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "github_repo"
     ],
     "properties": {
      "github_repo": {
       "type": "string",
       "description": "Public GitHub repo in 'owner/repo' format (e.g. 'vercel/next.js'). Must be publicly accessible without authentication."
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/gitleaks-secret-scanner-the-stall-x402-95359fcd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from the-stall.intuitek.ai](https://www.zero.xyz/host/the-stall.intuitek.ai/llms.txt)