{"uid":"cap_4pb2a5G_5F-M7cQCzJNuX","slug":"payai-code-security-inspector-857d9a86","name":"PayAI Code Security Inspector","description":"Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its language; returns a verdict with per-finding CWE, severity and line. Static indicators, not a guarantee.","url":"https://payai.agentstools.dev/code/inspect","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"code":{"type":"string","description":"The source code blob to inspect"},"language":{"type":"string","description":"Language of the blob: python, javascript, java, go, php or ruby"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.008","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.008/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_YRT28B4gMqKuzbW8BsG_m","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.008","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs static analysis of a code snippet to detect CWE Top-25 vulnerabilities including SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, and weak crypto, returning per-finding CWE IDs, severity levels, and line numbers.","exampleAgentPrompt":"Can you run a static security scan on this Python function for CWE Top-25 vulnerabilities — I'm particularly worried about SQL injection and command injection — and tell me which lines are affected and how severe each issue is?","exampleUseCases":[{"title":"Pre-merge security gate in CI","prompt":"Before we merge this PR, scan the changed Python code for any CWE Top-25 issues like SQL injection or path traversal and flag any high-severity findings with their line numbers."},{"title":"Audit legacy PHP for XSS","prompt":"I have this old PHP file I inherited — can you inspect it for cross-site scripting and SQL injection vulnerabilities and give me the CWE IDs and exact lines where problems are found?"},{"title":"Security check on generated code","prompt":"I just had an LLM write this Node.js API handler — please do a static security scan on it to check for SSRF, command injection, or insecure deserialization before I deploy it."}],"resultDescription":"A security verdict listing all discovered vulnerabilities in the code, each with its CWE identifier (e.g. CWE-89 for SQL injection), a severity rating (critical/high/medium/low), and the specific line number where the issue was found. The response is a static analysis result and does not guarantee runtime safety.","failureModes":["Unsupported programming language — endpoint may return an error or empty findings","Code blob too large — may time out or be rejected","False negatives — static analysis may miss runtime-only vulnerabilities","No findings returned for genuinely vulnerable code due to obfuscation or unusual patterns","Malformed request body missing required code or language fields"],"whenToPreferThis":"Choose this endpoint when you need a quick, automated static security scan of a single code snippet without setting up a local SAST tool. Ideal for CI pipeline checks, pre-merge reviews, or auditing AI-generated code before deployment. Best for CWE Top-25 class vulnerabilities; not a substitute for full dynamic testing or manual penetration testing.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-16T00:30:21.682Z","isFirstParty":false}