# Strale Secret Scan

> Strale Secret Scan is a paid API for AI agents from api.strale.io, paid per call via x402, $0.0216/call, status unknown (last checked 2026-09-15).

Scans code, config, or log output for exposed secrets, credentials, and sensitive values

## Facts

- Endpoint: GET https://api.strale.io/x402/v2/secret-scan
- Price: $0.0216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/strale-secret-scan-03589364
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_WeVlEJtuFWX6TkrntfyE7

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability strale-secret-scan-03589364
```

Example prompt: Can you scan this code snippet for any exposed secrets, API keys, or hardcoded credentials? Here's the text: `DB_PASSWORD=supersecret123 AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`

## When to prefer this

Choose this endpoint when you need a fast, auditable secret scan with a cryptographic chain hash for compliance or tamper-evident record-keeping. Ideal for AI agents that need to verify code, configs, or logs before committing, deploying, or sharing — especially in regulated environments where audit trails matter. Prefer over general-purpose static analysis tools when you need a per-call audit record and multi-protocol access (REST, MCP, x402).

## Known failure modes

- Missing or empty 'text' query parameter returns a validation error
- Extremely large text inputs may be truncated or rejected
- False negatives possible if secrets use non-standard formats not in detection patterns
- Network timeout on unusually long payloads
- Payment failure (402) if USDC balance is insufficient for the $0.0216 per-call fee

## How this service works

The trust layer for AI agents — 250+ independently tested data capabilities across 27 countries. Execute capabilities via REST, MCP, A2A, or x402 micropayments. Every call returns an audit record with cryptographic chain hashing.

## Output

Returns a list of detected secrets or sensitive values found in the submitted text, including the type of secret (e.g. API key, password, private key), location or context within the input, severity indicators, and a cryptographic audit record with chain hashing for tamper-evident logging.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "text"
     ],
     "properties": {
      "text": {
       "type": "string",
       "description": "Code, config, or log output"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/strale-secret-scan-03589364/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.strale.io](https://www.zero.xyz/host/api.strale.io/llms.txt)