# LineageLint Terraform Plan Risk Analyzer > LineageLint Terraform Plan Risk Analyzer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13). Analyzes a Terraform plan for security risks, destructive changes, and policy violations, returning a risk score and BLOCK/WARN/PASS verdict ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/terraform-plan-risk - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-13 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/lineagelint-terraform-plan-risk-analyzer-87080699 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PjbceP_Vax5YUAb4JG_xX Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability lineagelint-terraform-plan-risk-analyzer-87080699 ``` Example prompt: Run the risky-production-replacement scenario through LineageLint's Terraform plan risk analyzer and tell me if it would be blocked, what the risk score is, and what critical or high findings it flagged. ## When to prefer this Use this endpoint when you need a fast, automated static analysis of a Terraform plan for production safety gates — especially when you want a structured risk score, per-finding severity breakdown, and explicit BLOCK/WARN/PASS verdict without needing to execute the plan or call cloud APIs. Prefer this over manual review or general-purpose code review tools when you need consistent, rule-based checks covering IAM wildcards, destructive replacements, public exposure, and encryption disablement. ## Known failure modes - Missing required 'input' object in query params returns 400 validation error - Invalid method enum value (e.g. POST) returns schema validation error - Invalid or unsupported scenario enum value returns 400 - Payment not received (x402 flow) returns 402 Payment Required before analysis runs - Service unavailable returns 503 with no analysis result ## How this service works An autonomous paid API accepting USDC on Base mainnet. ## Output Returns a JSON object with a verdict (BLOCK, WARN, or PASS), integer risk score (0-100), a human-readable summary, list of findings with severity and remediation advice, resource change stats (creates, deletes, replacements), approval gates required, and coverage metadata about what rules were applied and what limitations exist. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "risky-production-replacement" ], "type": "string", "description": "Built-in paid Terraform plan-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "profile", "verdict", "risk_score", "summary", "stats", "resource_changes", "findings", "approval_gates", "coverage" ], "properties": { "label": { "type": "string" }, "stats": { "type": "object" }, "profile": { "enum": [ "production", "development" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "analysis_id": { "type": "string" }, "approval_gates": { "type": "array", "items": { "type": "string" } }, "analyzer_version": { "type": "string" }, "resource_changes": { "type": "array", "items": { "type": "object" } } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "paid-demo:risky-production-replacement", "stats": { "low": 0, "high": 6, "read": 0, "no-op": 0, "create": 2, "delete": 0, "medium": 1, "update": 0, "replace": 1, "critical": 1, "findings": 8, "failed_checks": 1, "format_version": "1.2", "resource_drift": 1, "resource_changes": 3, "terraform_version": "1.9.8", "destructive_changes": 1, "destroy_exemptions_used": 0, "sensitive_paths_respected": 1 }, "profile": "production", "summary": "BLOCK: 8 finding(s) across 3 resource change(s); 1 critical, 6 high, 1 medium.", "verdict": "BLOCK", "coverage": { "input": "terraform show -json plan output", "rules": [ "resource deletion, replacement, taint, and blast radius", "world-open networks and public resource exposure", "wildcard IAM and administrator access", "explicitly disabled encryption and deletion safeguards", "privileged workload and host namespace settings", "unmasked secret-like values and outputs", "resource drift and failed Terraform checks" ], "limitations": "Static plan inspection cannot prove runtime reachability, provider defaults, organizational policy, or successful rollback. Plan JSON can contain plaintext sensitive values; submit only to a trusted processor and retain the report, not the raw plan.", "terraform_executed": false, "cloud_apis_contacted": false, "supported_format_major": 1, "planned_values_returned": false, "sensitive_masks_respected": true }, "findings": [ { "code": "broad_iam_permissions", "address": "aws_iam_policy.admin", "summary": "A planned IAM policy grants wildcard or administrator-level access.", "category": "identity-and-access", "evidence": "broad statements: policy[0].Statement[0].", "severity": "critical", "remediation": "Replace wildcard permissions with reviewed actions and resource scopes; add policy tests.", "risk_weight": 32, "resource_type": "aws_iam_policy" }, { "code": "terraform_checks_failed", "address": "$plan.checks", "summary": "One or more Terraform checks report fail or error.", "category": "policy-and-checks", "evidence": "Affected check addresses/paths: aws_db_instance.production.", "severity": "high", "remediation": "Resolve failed preconditions, postconditions, or checks before apply.", "risk_weight": 15, "resource_type": "multiple" }, { "cod … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lineagelint-terraform-plan-risk-analyzer-87080699/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)