# PayAI Secret Scanner

> PayAI Secret Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Statically scans source code or config files for hardcoded secrets and credentials, returning a verdict (pass/caution/block) with per-finding details including rule, provider, severity, and location.

## Facts

- Endpoint: POST https://payai.agentstools.dev/secret/scan
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-secret-scanner-55b653b1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_45ybZ1mcs4O781BWI9J2A

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-secret-scanner-55b653b1 -d '<json body>'
```

Example prompt: Scan this source code snippet for any hardcoded secrets, API keys, or credentials before I push it — I need a pass/caution/block verdict with details on each finding including which provider and severity.

## When to prefer this

Choose this endpoint when you need a fast, automated static check for hardcoded secrets in code or config before committing, deploying, or merging. It covers a broad range of secret types — cloud keys, CI/VCS tokens, payment keys, messaging tokens, AI provider keys, database URIs, and private keys — in a single call with a clear go/no-go verdict. Prefer it over manual review or full SAST tools when speed and breadth of secret-type coverage matter more than deep semantic analysis of business logic.

## Known failure modes

- Empty or missing input body returns an error response
- Very large files may exceed payload limits
- High-entropy strings may produce false positives flagged as generic secrets
- Obfuscated or base64-encoded secrets may not be detected
- Service may return caution instead of block for ambiguous patterns
- Network timeout if input is extremely large

## How this service works

Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-entropy generic secrets. Returns a go/no-go verdict (pass, caution, block) with per-finding rule, provider, severity and location. Secret indicators, not a guarantee.

## Output

Returns a top-level verdict of 'pass', 'caution', or 'block' along with an array of per-finding objects. Each finding includes the matched rule name, the provider associated with the secret (e.g. AWS, GitHub, Stripe, OpenAI), a severity rating, and the location (e.g. line number or file path) where the potential secret was detected.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "Alternatively a batch of objects, each with path and content"
  },
  "rules": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional list of rule ids to restrict to (see GET /secret/rules)"
  },
  "content": {
   "type": "string",
   "description": "Source code / config text to scan (single blob)"
  },
  "filename": {
   "type": "string",
   "description": "Optional path/name of the blob (affects fixture downgrade)"
  },
  "min_entropy": {
   "type": "number",
   "description": "Raise the entropy floor for generic rules"
  },
  "allow_test_fixtures": {
   "type": "boolean",
   "description": "Drop findings in test/example/doc paths entirely"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-secret-scanner-55b653b1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)