# Sentinel402 PII & Secret Guardrail (scan_for_pii)

> Sentinel402 PII & Secret Guardrail (scan_for_pii) is a paid API for AI agents from pii-guardrail.chronokey.workers.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-17).

Scans outbound text payloads for PII and secrets, returning a risk score, categorized findings, and optionally redacted/sanitized output.

## Facts

- Endpoint: POST https://pii-guardrail.chronokey.workers.dev/mcp?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sentinel402-pii-secret-guardrail-scan-for-pii-5e59b391
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cczJ4EL6btT8zoRvxB7_c

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sentinel402-pii-secret-guardrail-scan-for-pii-5e59b391 -d '<json body>'
```

Example prompt: Before sending this response to the user, scan it for any PII or secrets — use redact mode so anything critical like credit card numbers or SSNs gets masked automatically: 'Your card ending in 4242 and SSN 123-45-6789 are on file.'

## When to prefer this

Choose this endpoint when you need a pay-per-call, no-subscription PII and secret scanner that integrates directly into MCP-compatible agent pipelines via x402 micropayments. It is ideal for agent workflows that need an inline guardrail — scanning LLM outputs, API responses, or user-submitted text before forwarding — especially when you want severity-tiered findings with confidence scores and the option to auto-redact rather than just flag. Prefer it over static regex libraries when you need a managed, regularly updated ruleset without hosting infrastructure.

## Known failure modes

- Missing or invalid payment credential returns HTTP 402 with payment-required details
- Text field absent or empty may return an error or trivial allow decision
- Invalid mode or min_severity enum value causes validation error
- Very large payloads may time out on the Cloudflare Worker edge
- If the MCP JSON-RPC envelope is malformed (wrong method, missing jsonrpc field), returns JSON-RPC error response

## How this service works

Paid tools for AI agents over x402: a PII and secret guardrail that scans outbound payloads, live citable data (crypto, weather, GitHub, sports, FX), and an RCP/1 retrieval server backed by that live data.

## Output

Returns a JSON object with a numeric risk score (0-100), a decision enum (allow/redact/block), a findings array with per-rule details including rule name, count, severity, confidence, and redacted samples, counts broken down by severity level, and optionally a sanitized string with PII tokens replaced.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "toolName",
    "inputSchema"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "jsonrpc",
      "method",
      "params"
     ],
     "properties": {
      "id": {
       "type": [
        "string",
        "number",
        "null"
       ]
      },
      "method": {
       "type": "string",
       "const": "tools/call"
      },
      "params": {
       "type": "object",
       "required": [
        "name"
       ],
       "properties": {
        "name": {
         "type": "string",
         "const": "scan_for_pii"
        },
        "_meta": {
         "type": "object",
         "description": "Optional; an MPP payment credential rides at _meta[\"org.paymentauth/credential\"] and the receipt returns at result._meta[\"org.paymentauth/receipt\"]."
        },
        "arguments": {
         "type": "object",
         "properties": {
          "mode": {
           "enum": [
            "detect",
            "redact",
            "block"
           ],
           "type": "string",
           "description": "default detect"
          },
          "text": {
           "type": "string",
           "description": "Text to scan"
          },
          "min_severity": {
           "enum": [
            "low",
            "medium",
            "high",
            "critical"
           ],
           "type": "string"
          }
         }
        }
       }
      },
      "jsonrpc": {
       "type": "string",
       "const": "2.0"
      }
     },
     "description": "JSON-RPC 2.0 request body that invokes the \"scan_for_pii\" MCP tool over streamable HTTP."
    },
    "type": {
     "type": "string",
     "const": "mcp"
    },
    "example": {
     "type": "object"
    },
    "toolName": {
     "type": "string"
    },
    "transport": {
     "enum": [
      "streamable-http"
     ],
     "type": "string"
    },
    "description": {
     "type": "string"
    },
    "inputSchema": {
     "type": "object"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "decision",
      "risk",
      "findings"
     ],
     "properties": {
      "risk": {
       "typ
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": 100,
  "counts": {
   "low": 0,
   "high": 0,
   "medium": 0,
   "critical": 2
  },
  "decision": "redact",
  "findings": [
   {
    "rule": "CREDIT_CARD",
    "count": 1,
    "samples": [
     "[CREDIT_CARD:************4242]"
    ],
    "severity": "critical",
    "confidence": 0.99
   },
   {
    "rule": "SSN_KEYWORD",
    "count": 1,
    "samples": [
     "[SSN_KEYWORD:#ba9f03]"
    ],
    "severity": "critical",
    "confidence": 0.98
   }
  ],
  "sanitized": "card [CREDIT_CARD:************4242], [SSN_KEYWORD:#ba9f03]"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sentinel402-pii-secret-guardrail-scan-for-pii-5e59b391/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pii-guardrail.chronokey.workers.dev](https://www.zero.xyz/host/pii-guardrail.chronokey.workers.dev/llms.txt)