# PR Verdict — Merge-Safety Scanner

> PR Verdict — Merge-Safety Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-15).

Fetches a public GitHub pull request diff and runs it through code, secret, CI/CD, and dependency scanners, returning a single pass/caution/block verdict with a risk score and per-finding details.

## Facts

- Endpoint: POST https://payai.agentstools.dev/pr/verdict
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pr-verdict-merge-safety-scanner-c99c850c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bbgW3XCAEuT8aH53JmHml

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pr-verdict-merge-safety-scanner-c99c850c -d '<json body>'
```

Example prompt: Can you run a merge-safety check on this PR — https://github.com/acme/backend/pull/412 — and tell me the verdict, the risk score, and any critical findings with fix hints? Scan all dimensions: code, secrets, CI, and deps.

## When to prefer this

Choose this endpoint when you need a single-call, multi-dimensional security assessment of a GitHub PR diff without orchestrating separate secret, code, CI, and dependency scanners yourself. It is ideal for automated pre-merge gates, AI code review agents, or open-source contribution audits where speed and consolidated output matter. Prefer it over manual diff inspection or assembling multiple scanning tools when a consolidated verdict and risk score are the goal.

## Known failure modes

- Private or non-existent repository URL returns an error — PR must be publicly accessible
- Invalid GitHub PR URL format causes a validation error
- Very large PRs may hit timeout or file-count limits — use max_files to cap
- If the diff is empty or PR is already merged with no diff, scanning may return no findings
- Unsupported dimension values in the dimensions array cause parameter errors

## How this service works

One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and findings with severity, file, line and a fix hint. One call instead of slicing the diff into several. Security indicators, not a guarantee.

## Output

Returns a single top-level verdict (pass, caution, or block), a numeric risk score, and a list of findings each containing severity, affected file, line number, a description of the issue, and a fix hint. Covers code quality risks, exposed secrets, CI/CD pipeline manipulation, and vulnerable dependency updates.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "pr_url": {
   "type": "string",
   "description": "Public GitHub pull-request URL (github.com/owner/repo/pull/N)"
  },
  "max_files": {
   "type": "integer",
   "description": "Optional cap on files scanned for a large PR"
  },
  "dimensions": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional subset of code, secret, ci, deps (default: all)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pr-verdict-merge-safety-scanner-c99c850c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)