# PR Verdict — Pull Request Security Scanner

> PR Verdict — Pull Request Security Scanner is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-13).

Fetches a public GitHub PR diff and returns a single merge-safety verdict (pass/caution/block), a risk score, and detailed findings across code, secrets, CI/CD, and dependency dimensions.

## Facts

- Endpoint: POST https://api.agentstools.dev/pr/verdict
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pr-verdict-pull-request-security-scanner-464f8098
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ygXL-QiDXTrT3iLOqCO1L

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pr-verdict-pull-request-security-scanner-464f8098 -d '<json body>'
```

Example prompt: Can you do a security scan on this pull request — https://github.com/owner/repo/pull/42 — and tell me if it's safe to merge? I want you to check all dimensions: code, secrets, CI pipelines, and dependencies.

## When to prefer this

Use this endpoint when you need a fast, all-in-one security verdict for a public GitHub pull request without orchestrating multiple specialized scanners. It is ideal for autonomous code review agents, CI bots, or developer assistants that need a single actionable signal (pass/caution/block) rather than raw scanner output. Prefer this over building a multi-step pipeline when time and simplicity matter more than exhaustive customization.

## Known failure modes

- PR URL is private or inaccessible — returns an error indicating the repository is not publicly readable
- Invalid or malformed GitHub PR URL — returns a validation error
- PR diff is too large and exceeds scanner limits — may require setting max_files to reduce scope
- Unknown dimension value in the dimensions array — returns a parameter validation error
- GitHub rate limiting or temporary unavailability — returns a service error

## How this service works

One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and findings with severity, file, line and a fix hint. One call instead of slicing the diff into several. Security indicators, not a guarantee.

## Output

Returns a top-level verdict string (pass, caution, or block), a numeric risk score, and a list of findings each containing severity, the affected file and line number, a description of the issue, and a suggested fix hint. Covers code quality risks, exposed secrets, CI/CD pipeline manipulation, and dependency vulnerabilities in a single response.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "pr_url": {
   "type": "string",
   "description": "Public GitHub pull-request URL (github.com/owner/repo/pull/N)"
  },
  "max_files": {
   "type": "integer",
   "description": "Optional cap on files scanned for a large PR"
  },
  "dimensions": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional subset of code, secret, ci, deps (default: all)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pr-verdict-pull-request-security-scanner-464f8098/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)