# The Stall — Code Security Scan

> The Stall — Code Security Scan is a paid API for AI agents from the-stall.intuitek.ai, paid per call via x402, $2/call, status unknown (last checked 2026-09-14).

Scans a public GitHub repository for security vulnerabilities and code security issues, returning a structured audit report.

## Facts

- Endpoint: GET https://the-stall.intuitek.ai/cap/code-security-scan
- Price: $2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/the-stall-code-security-scan-1dea380f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_O5hhXb7UBSLOmJNMVMTM0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability the-stall-code-security-scan-1dea380f
```

Example prompt: Can you run a security scan on my GitHub repo at https://github.com/myorg/myproject? I own it and authorize the audit — tell me what vulnerabilities you find.

## When to prefer this

Choose this endpoint when you need a quick, account-free, pay-per-use security scan of a public GitHub repository without setting up dedicated SAST tooling or CI/CD integrations. Ideal for one-off audits, pre-release checks, or evaluating third-party open-source code. Prefer alternatives like Snyk, CodeQL, or GitHub Advanced Security for private repos, continuous monitoring, or deep IDE integration.

## Known failure modes

- Private or non-existent repository URL causes scan failure — only public GitHub repos are supported
- Missing or false 'authorized' parameter results in request rejection
- Malformed GitHub URL (not HTTPS github.com format) causes input validation error
- Very large repositories may time out or return partial results
- GitHub rate limiting on the backend may delay or fail the scan
- Non-GitHub repository URLs (GitLab, Bitbucket) are not supported

## How this service works

Domain-agnostic x402 capability chassis by IntuiTek¹. 300 AI-callable data services — pay USDC on Base mainnet. No accounts or API keys required.

## Output

A structured security audit report listing detected vulnerabilities, their severity levels, affected files or code sections, descriptions of each issue, and potentially recommended remediations — covering common vulnerability classes such as injection flaws, insecure dependencies, hardcoded secrets, and misconfigured access controls.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "repo_url",
      "authorized"
     ],
     "properties": {
      "repo_url": {
       "type": "string",
       "description": "Public GitHub HTTPS URL of the repository to scan, e.g. 'https://github.com/owner/repo'. Must be a public repo (no auth is provided)."
      },
      "authorized": {
       "type": "string",
       "description": "Must be 'true'. By submitting you certify you own this repository or have explicit written authorization to perform a security audit against it."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/the-stall-code-security-scan-1dea380f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from the-stall.intuitek.ai](https://www.zero.xyz/host/the-stall.intuitek.ai/llms.txt)