# PayAI Code Security Scanner

> PayAI Code Security Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Performs static application security analysis on source code or git diffs, detecting CWE Top-25 vulnerabilities across Python, JavaScript, TypeScript, Java, and Go

## Facts

- Endpoint: POST https://payai.agentstools.dev/code/scan
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-code-security-scanner-1332d94c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5QzL_6KXzPGS-OPo7LtXJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-code-security-scanner-1332d94c -d '<json body>'
```

Example prompt: Can you security-scan this git diff for me? I want to know if it introduces any CWE Top-25 issues like SQL injection, XSS, or command injection — give me a go/no-go verdict with file and line details for any findings.

## When to prefer this

Choose this endpoint when you need a fast, automated security pre-check on code changes before merging, deploying, or reviewing — especially in CI/CD pipelines or agent workflows where you want per-finding CWE classification with file and line precision. It covers the CWE Top-25 most dangerous weaknesses across five major languages. Prefer it over generic linting tools when security-specific vulnerability detection (SQL injection, XSS, SSRF, etc.) is the primary concern, and when you need a structured go/no-go verdict rather than style or quality feedback.

## Known failure modes

- Unsupported language submitted (only Python, JavaScript, TypeScript, Java, Go are supported)
- Empty or malformed diff/files input returns no findings
- False negatives possible — static analysis cannot catch all runtime vulnerabilities
- False positives may be flagged for code patterns that look dangerous but are safe in context
- Very large diffs or file batches may time out or be truncated
- Non-unified diff formats may not be parsed correctly

## How this service works

Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, insecure randomness, open redirect and XXE across Python, JavaScript, TypeScript, Java and Go. Returns a go/no-go verdict with per-finding CWE, severity, file and line. Static indicators, not a guarantee.

## Output

Returns a go/no-go verdict indicating whether the scanned code is considered safe, along with a list of per-finding details including: CWE identifier (e.g. CWE-89 for SQL injection), severity rating, the file path and line number where the issue was detected, and a description of the vulnerability type. Only added lines in diffs are scanned. Results are static indicators, not runtime guarantees.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "diff": {
   "type": "string",
   "description": "A unified git-diff; only added lines are scanned"
  },
  "files": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "Alternatively a batch of objects, each with path, content and optional language"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-code-security-scanner-1332d94c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)