# TrollBridge Secret Scan

> TrollBridge Secret Scan is a paid API for AI agents from mini-tollbooth.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-12).

Scans a public URL or raw text for exposed credentials and leaked secrets such as AWS keys, GitHub tokens, and private keys

## Facts

- Endpoint: GET https://mini-tollbooth.onrender.com/secret-scan?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/trollbridge-secret-scan-2088ea67
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cBsDshzWLI2xPq_5uhAdM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability trollbridge-secret-scan-2088ea67
```

Example prompt: Can you sweep this URL for leaked secrets like AWS keys, GitHub tokens, or private keys: https://raw.githubusercontent.com/someuser/somerepo/main/config.env

## When to prefer this

Use this endpoint when you need a fast, cheap ($0.02 USDC) heuristic sweep of a URL or text blob for common credential patterns before sharing, deploying, or transacting. It is not a full security audit but is ideal for quick pre-flight checks on config files, smart contract URLs, agent outputs, or pasted code snippets. Prefer this over manual review or heavier audit tools when speed and cost matter and the goal is catching obvious leaks.

## Known failure modes

- URL is not publicly accessible — returns error or empty sweep
- Text or URL parameter missing — returns validation error requiring either url or text
- URL returns non-text content (binary, image) — sweep may produce no findings
- Heuristic patterns may miss novel or obfuscated secret formats (false negatives)
- Rate limiting or payment failure at $0.02 USDC per call via x402 protocol

## How this service works

The insurance booth for AI agents, with Mini's Agent Supply Store on the side of the road. One hundred checkpoints: pre-transaction safety lanes (honeypot, approval-risk, rug-score, receipt-check, tx-dryrun, permit-scan, airdrop-verdict, deployer-history, wallet-watch, secret-scan at $0.02 USDC per call; the protection tier — /contract-check, /approval-screen, /tx-plain-english, /honeypot-check, /tx-simulate, /redteam, /skill-scan, /verdict, /egress-audit, /tool-gate, /airlock, /repo-scan, /prove, /task-scope — at $0.10; the one-call /shield don't-get-rugged screen at $0.25; the full /preflight bundle at $0.05), bounty intel (bounties, fresh, verdicts, deadlines, sweepstakes, opportunities) at $0.02 USDC per call, trader intel (/prices and /quant at $0.02; /enrich and /token-check at $0.05; /contract-check and /honeypot-check at $0.10; /sec-facts at $0.05), market intel (/markets and /search at $0.05; /grants at $0.02), DeFi intel (/yields and /new-pairs at $0.05; /gas and /defi at $0.02), AI intel (/models at $0.02), agent-ops intel (/prompt-cost, /model-picks, /rpc-speed, /terms-tldr, /scrape, /gigs, /retry-verify, /idempotency, /verify-independent at $0.02; /site-watch, /wallet-check, /code-run, /regulatory-pack, /sage, /cron-watch, /caveat-check, /tripwire, /escrow, /trust, /bridge-fees, /dao-votes, /dev-activity, /dex-arb, /dydx-perps, /funding-rates, /gas-predict, /hack-tracker, /long-short-ratio, /lp-yields, /mev-scan, /open-interest, /perp-basis, /polymarket-odds, /rwa-watch, /sentiment, /stablecoin-flows, /tokenomics, /top-movers, /whale-watch, and /yield-stable at $0.05; /approval-screen, /tx-plain-english, /tx-simulate, and /task-scope at $0.10; /scam-scan deep scan at $5.00 or 30-day subscription at $30.00), supply store (/road-pack combo meal at $0.05; curated datasets, the /audit-prep pre-audit review, and the /prove-state symbolic-execution run at $1.00; the /audit AI-agent audit at $25.00). Every lane answers before money moves — heuristic verdicts, not audits. Don't get rugged.

## Output

Returns a JSON object with a verdict ('clean' or findings present), a list of redacted findings (never echoing the actual secrets), the source type (url or text), the lane identifier, a total findings count, and a disclaimer that this is a heuristic pattern sweep rather than a full security audit.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "url": {
       "type": "string",
       "description": "Public URL to sweep for leaked secrets (pass url OR text)."
      },
      "text": {
       "type": "string",
       "description": "Raw text to sweep for leaked secrets (pass url OR text)."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "lane": "/secret-scan",
  "source": "url",
  "verdict": "clean",
  "findings": [],
  "description": "NOT AN AUDIT — heuristic pattern sweep, not a security audit: leaked-secret sweep ($0.02) — scan a URL or pasted text for exposed AWS keys, GitHub tokens, private keys, and other credentials. Findings redacted, never echoed.",
  "total_findings": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/trollbridge-secret-scan-2088ea67/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from mini-tollbooth.onrender.com](https://www.zero.xyz/host/mini-tollbooth.onrender.com/llms.txt)