# Tanod pactlint: Solidity Smart Contract Security Scanner

> Tanod pactlint: Solidity Smart Contract Security Scanner is a paid API for AI agents from tanod.dev, paid per call via x402, $0.25/call, status unknown (last checked 2026-10-10).

Scans a Solidity smart contract source file or project for security vulnerabilities using static analysis, returning structured findings with severity and location.

## Facts

- Endpoint: POST https://tanod.dev/v1/scan/source?utm_source=zero.xyz
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-pactlint-solidity-smart-contract-security-scanner-20ab45b2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Z_ny8ydl5tvfN4bSyWo_C

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-pactlint-solidity-smart-contract-security-scanner-20ab45b2 -d '<json body>'
```

Example prompt: Can you run a security scan on this Solidity contract I wrote — include high and medium severity findings but skip informational noise — and tell me what vulnerabilities it has before I deploy it?

## When to prefer this

Choose this endpoint when you need a fast, pay-per-call, no-signup Solidity security scan integrated directly into an AI agent workflow or automated CI pipeline. It is ideal when you want machine-readable structured findings (detector name, severity, file/line) rather than a human-readable report. Prefer it over full audit services when speed and low cost matter more than exhaustive manual review. It supports both single-file contracts and multi-file projects via standard JSON, making it flexible for real-world codebases.

## Known failure modes

- Invalid Solidity syntax causes compilation failure and no findings returned
- Import statements in single-file mode are rejected — all imports must be inlined via standard_json
- Unsupported or unrecognized compiler version causes scan failure
- Payload exceeds 204800 character limit for single-file source
- Malformed standard_json input (e.g. using 'urls' instead of inline 'content') causes rejection
- Payment not provided or insufficient USDC causes x402 payment required error

## How this service works

One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.

## Output

Returns a JSON object with a status field, a unique scan_id, and a findings array where each finding includes the detector name (e.g. 'swap-zero-min-out'), severity level (e.g. 'high'), and the file and line where the issue was found. Also includes a disclaimer noting it is an automated scan and not a formal audit, plus a schema_version field.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "source": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 204800
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "One Solidity file. Imports are not allowed; use standard_json for projects."
  },
  "options": {
   "type": "object",
   "properties": {
    "include_noisy": {
     "type": "boolean",
     "default": false,
     "description": "Keep results of noisy stock Slither detectors."
    },
    "include_dependencies": {
     "type": "boolean",
     "default": false,
     "description": "Keep findings located in libraries, tests and mocks."
    },
    "include_informational": {
     "type": "boolean",
     "default": false,
     "description": "Keep informational findings."
    }
   },
   "additionalProperties": false
  },
  "filename": {
   "type": "string",
   "default": "Contract.sol",
   "pattern": "^[A-Za-z0-9_\\-.]{1,100}\\.sol$",
   "description": "File name for a single-file source (used in findings)."
  },
  "standard_json": {
   "anyOf": [
    {
     "type": "object",
     "additionalProperties": true
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "solc standard-JSON input: {language, sources: {path: {content}}, settings}. Every imported file must be included inline; 'urls' are rejected."
  },
  "compiler_version": {
   "anyOf": [
    {
     "type": "string",
     "pattern": "^\\d{1,2}\\.\\d{1,2}\\.\\d{1,3}$"
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "Exact solc version; default: highest release matching the pragmas."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "status": "ok",
  "scan_id": "00000000-0000-4000-8000-000000000000",
  "findings": [
   {
    "detector": "swap-zero-min-out",
    "severity": "high",
    "file_line": "Swapper.sol:21"
   }
  ],
  "disclaimer": "Automated scan, not an audit. Findings may be false positives; absence of findings does not mean the code is safe.",
  "schema_version": "1.2"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-pactlint-solidity-smart-contract-security-scanner-20ab45b2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tanod.dev](https://www.zero.xyz/host/tanod.dev/llms.txt)