# PayAI Secret Diff Scanner

> PayAI Secret Diff Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Statically scans a unified git-diff for newly introduced secrets, flagging only added lines with a pass/caution/block verdict and per-finding details.

## Facts

- Endpoint: POST https://payai.agentstools.dev/secret/diff
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-secret-diff-scanner-a488946e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_u06D0PHpkr5PCyha6qyF3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-secret-diff-scanner-a488946e -d '<json body>'
```

Example prompt: Before I commit this diff, scan it for any newly introduced secrets or credentials — only flag things added in this change, not stuff that was already there — and give me a pass, caution, or block verdict with the exact file and line for each finding.

## When to prefer this

Choose this endpoint when you need a low-false-positive secret scan scoped strictly to newly introduced lines in a git-diff, such as in a pre-commit hook, CI gate, or pull request review workflow. It is preferable over full-repo scanners when you want to avoid noise from pre-existing secrets in the codebase and only care about what a developer is about to introduce.

## Known failure modes

- Malformed or non-unified diff format may cause parsing errors or empty results
- Very large diffs may exceed payload size limits
- False negatives possible — novel or obfuscated credential formats may not be detected
- False positives can occur for high-entropy strings that resemble secrets but are not
- API returns caution rather than block for ambiguous findings, requiring human review

## How this service works

Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged. Returns a verdict (pass, caution, block) with per-finding rule, provider, severity, file and line. Secret indicators, not a guarantee.

## Output

Returns a verdict string (pass, caution, or block) along with an array of findings, each containing the matched rule name, secret provider category, severity level, affected file path, and line number where the secret was introduced. Only lines added in the diff are evaluated; unchanged and removed lines are excluded from scoring.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "diff": {
   "type": "string",
   "description": "A unified diff; only added lines are scanned"
  },
  "rules": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional list of rule ids to restrict to"
  },
  "min_entropy": {
   "type": "number",
   "description": "Raise the entropy floor for generic rules"
  },
  "allow_test_fixtures": {
   "type": "boolean",
   "description": "Drop added lines in test/example paths entirely"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-secret-diff-scanner-a488946e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)