# IaC Static Misconfiguration Scanner

> IaC Static Misconfiguration Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Statically scans infrastructure-as-code configs (Terraform, Kubernetes, Dockerfile, docker-compose, CloudFormation) for security misconfigurations, returning a verdict, risk score, and per-finding details with fix hints.

## Facts

- Endpoint: POST https://payai.agentstools.dev/iac/scan
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/iac-static-misconfiguration-scanner-f18ec87c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HxnyV4qKGEsziAtnCeIrh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability iac-static-misconfiguration-scanner-f18ec87c -d '<json body>'
```

Example prompt: Scan this Terraform HCL for security misconfigurations — I want to know if there are any open security groups, public storage, or over-broad IAM policies, and what the overall risk score is.

## When to prefer this

Use this endpoint when you need fast, per-finding security feedback on IaC configs before deployment, CI gate decisions, or due-diligence audits. Prefer it over generic linters when you need a structured verdict and risk score across multiple IaC formats (Terraform HCL and plan JSON, Kubernetes/Helm, Dockerfile, docker-compose, CloudFormation) in a single call. It is not a runtime security scanner — use it for static config analysis only.

## Known failure modes

- Unsupported or malformed config content returns a parsing error
- Auto-detection may misidentify format if content is ambiguous — specify format explicitly to avoid
- Very large configs may be truncated or timeout
- Some niche Terraform providers or custom Kubernetes CRDs may not have rule coverage
- False positives possible for intentionally public resources (e.g., CDN buckets)

## How this service works

Static misconfiguration scan of an infrastructure-as-code config: Terraform (plan JSON or HCL), Kubernetes / Helm, Dockerfile, docker-compose or CloudFormation. Detects public storage, open security groups, unencrypted data at rest, over-broad IAM, privileged / root containers, host mounts and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, resource, location and fix hint. Security indicators, not a guarantee.

## Output

Returns a verdict string (pass, caution, or block), a 0-100 integer risk score, and a list of per-finding objects each containing the rule name, severity, affected resource name, file location, and a plain-English fix hint. These are security indicators, not guarantees.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "format": {
   "enum": [
    "auto",
    "terraform",
    "terraform-plan",
    "kubernetes",
    "dockerfile",
    "docker-compose",
    "cloudformation"
   ],
   "type": "string",
   "description": "Config format, or auto to detect from the content"
  },
  "content": {
   "type": "string",
   "description": "The IaC config text to scan (one or many resources)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/iac-static-misconfiguration-scanner-f18ec87c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)