# LineageLint CloudFormation Template Risk Analyzer > LineageLint CloudFormation Template Risk Analyzer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13). Statically analyzes AWS CloudFormation templates for security risks, returning a structured verdict (BLOCK/WARN/PASS), risk score, and detailed findings by severity. ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/cloudformation-template-risk - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-13 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/lineagelint-cloudformation-template-risk-analyzer-ca54e8f4 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YCspea2FWaWIWp3Y7OIo_ Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability lineagelint-cloudformation-template-risk-analyzer-ca54e8f4 ``` Example prompt: Can you run a security review on the risky-public-database-stack CloudFormation scenario and tell me whether it should be blocked, warned, or passed — including any critical findings I need to fix before deploying? ## When to prefer this Choose this endpoint when you need automated, structured CloudFormation security analysis with machine-readable verdicts and severity-bucketed findings suitable for CI/CD gates. It is especially useful when you want BLOCK/WARN/PASS decisions with approval gate lists for production deployments. Prefer it over manual cfn-lint when you need IAM policy analysis, public exposure checks, and database protection audits combined in a single call. Note it performs static analysis only and does not execute transforms or access live AWS APIs. ## Known failure modes - Invalid or missing 'input' object returns a 400-level error - Unsupported HTTP method (e.g. POST) returns an error since only GET/HEAD/DELETE are allowed - Invalid 'scenario' enum value returns a validation error - Payment not completed via x402 protocol returns a 402 Payment Required response - Network or server errors may return 5xx responses ## How this service works An autonomous paid API accepting USDC on Base mainnet. ## Output A JSON object containing: a BLOCK/WARN/PASS verdict, integer risk score (0-100), human-readable summary, array of findings with severity codes (critical/high/medium/low) and remediation advice, list of resources analyzed, approval gates required for deployment, and a coverage object describing what was and wasn't checked (e.g. no credentials loaded, no transforms executed). ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "risky-public-database-stack" ], "type": "string", "description": "Built-in paid CloudFormation security-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "profile", "verdict", "risk_score", "summary", "stats", "resources", "findings", "approval_gates", "coverage" ], "properties": { "label": { "type": "string" }, "stats": { "type": "object" }, "profile": { "enum": [ "production", "development" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "resources": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "analysis_id": { "type": "string" }, "approval_gates": { "type": "array", "items": { "type": "string" } }, "analyzer_version": { "type": "string" } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "paid-demo:risky-public-database-stack", "stats": { "output_count": 1, "resource_count": 3, "template_bytes": 892, "parameter_count": 1, "tree_node_count": 45, "findings_by_severity": { "low": 0, "high": 5, "medium": 8, "critical": 6 }, "custom_resource_count": 0, "dynamic_iam_policy_count": 0, "embedded_iam_policy_count": 2, "stateful_without_retention_count": 1 }, "profile": "production", "summary": "BLOCK: 19 finding(s) across 3 resource(s); 11 require resolution or explicit approval.", "verdict": "BLOCK", "coverage": { "mode": "static-parsed-cloudformation-template", "checks": [ "sensitive parameters, dynamic references, and outputs", "embedded IAM identity, resource, trust, and key policies", "public network and unauthenticated function exposure", "storage encryption, recovery, deletion, and replacement controls", "database backup and deletion protection", "custom resources and macro execution boundaries", "immutable Lambda artifacts and IMDSv2" ], "limitations": [ "Does not execute transforms, macros, custom resources, hooks, or CloudFormation Rules.", "Does not validate every resource property against current provider schemas; use cfn-lint for schema validation.", "Cannot inspect referenced artifacts, nested templates, existing account defaults, stack policies, service roles, or runtime resource state.", "Static review does not replace change sets, CloudFormation Guard, Hooks, IAM Access Analyzer, drift detection, or a live security assessment." ], "aws_api_contacted": false, "template_deployed": false, "credentials_loaded": false, "transforms_executed": false, "secret_values_returned": false }, "findings": [ { "code": "secret_parameter_literal_default", "path": "Parameters..Default", "message": "A secret-like parameter has a literal default; the value is omitted.", "severity": "critical", "standard": "aws-cloudformation-sensitive-parameters", "remediation": "Remove the default and use a dynamic Secrets Manager or SSM SecureString reference." }, { "code": "embedded_iam_wildcard_allow_principal", "path": "Resources.AdminRole.Properties.AssumeRolePolicyDocument.Statement[0].Principal", "message": "The allow statement trusts a wildcard principal selector.", "severity": "critical", "standard": "aws-iam-principal … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lineagelint-cloudformation-template-risk-analyzer-ca54e8f4/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)