# ScanPay Code Security Scanner

> ScanPay Code Security Scanner is a paid API for AI agents from scanpay-edge.alextaghiashvili.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-11-01).

Statically scans AI-generated Python, JavaScript, or TypeScript source code using 45 deterministic AST rules and returns structured security findings with severity, line ranges, and remediation guidance in ~100ms.

## Facts

- Endpoint: POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/scan?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-01
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scanpay-code-security-scanner-6f67efb5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0jsR5qB2pfboZfbkd7s6J

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scanpay-code-security-scanner-6f67efb5 -d '<json body>'
```

Example prompt: Before you run that Python script you just generated, scan it for security vulnerabilities using the deterministic AST scanner — I need to see any high-severity findings, the affected line ranges, and what to fix before we execute anything.

## When to prefer this

Choose this endpoint when you need a fast, deterministic, zero-data-retention pre-execution security gate for AI-generated or user-submitted Python/JS/TS code in an agent loop. It is ideal when you cannot afford to execute code speculatively, when LLM-based review would be too slow or unreliable, or when you need structured, rule-referenced findings rather than natural language analysis. Prefer it over LLM-based code review when consistency, auditability, and sub-200ms latency are required.

## Known failure modes

- Unsupported language submitted — only Python, JavaScript, and TypeScript are analyzed
- Code payload too large or malformed request body
- Payment not included or insufficient — endpoint requires $0.05 USDC per call via x402 protocol
- Network timeout if Cloudflare Worker is cold-starting
- False negatives: obfuscated or dynamically constructed malicious code may evade AST-level rules
- False positives: legitimate patterns that match security rule heuristics flagged incorrectly

## How this service works

Pay-per-call x402 APIs for AI agents: OpenAI-compatible LLM chat, perp funding and arbitrage spreads, crypto prices, gas, FX, Solana SPL mint audit, token price by contract, x402 delivery-receipt verification, web search, clean page extraction, batch tools and deterministic code-security scanning. USDC on Base or Solana, no signup, no API key, from $0.0001 a call.

## Output

Returns structured security findings per rule triggered: each finding includes a rule_id, severity level (e.g. low/medium/high/critical), the affected line ranges in the source file, and a remediation suggestion. An overall PASS/WARN/BLOCK verdict is also returned. Response arrives in approximately 100ms with no code executed and no data retained.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "source_code"
     ],
     "properties": {
      "language": {
       "enum": [
        "python",
        "javascript",
        "typescript",
        "tsx"
       ],
       "type": "string",
       "default": "python"
      },
      "source_code": {
       "type": "string",
       "description": "UTF-8 source code to scan (max 100 KB)"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "charged": true,
  "findings": [],
  "language": "python",
  "syntax_ok": true,
  "max_severity": null,
  "payment_mode": "x402-dual-rail",
  "source_sha256": "9f56e761d79bfdb34304a012586cb04d16b435ef6130091a97702e559260a2f2",
  "engine_version": "1.1.0",
  "findings_count": 0,
  "scan_duration_ms": 0.5
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scanpay-code-security-scanner-6f67efb5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scanpay-edge.alextaghiashvili.workers.dev](https://www.zero.xyz/host/scanpay-edge.alextaghiashvili.workers.dev/llms.txt)