{"uid":"cap_5QzL_6KXzPGS-OPo7LtXJ","slug":"payai-code-security-scanner-1332d94c","name":"PayAI Code Security Scanner","description":"Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, insecure randomness, open redirect and XXE across Python, JavaScript, TypeScript, Java and Go. Returns a go/no-go verdict with per-finding CWE, severity, file and line. Static indicators, not a guarantee.","url":"https://payai.agentstools.dev/code/scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"diff":{"type":"string","description":"A unified git-diff; only added lines are scanned"},"files":{"type":"array","items":{"type":"object"},"description":"Alternatively a batch of objects, each with path, content and optional language"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ST9mDskWhS2d20xmW4y-O","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs static application security analysis on source code or git diffs, detecting CWE Top-25 vulnerabilities across Python, JavaScript, TypeScript, Java, and Go","exampleAgentPrompt":"Can you security-scan this git diff for me? I want to know if it introduces any CWE Top-25 issues like SQL injection, XSS, or command injection — give me a go/no-go verdict with file and line details for any findings.","exampleUseCases":[{"title":"Pre-merge PR security gate","prompt":"Before I merge this pull request, scan the unified diff for any CWE Top-25 vulnerabilities — SQL injection, XSS, path traversal, the usual suspects — and tell me if it's safe to merge or flag any specific lines I need to fix."},{"title":"Security audit of new Python service","prompt":"I've got three Python source files for a new microservice. Can you run a static security scan across all of them and flag any issues like insecure deserialization, SSRF, or weak crypto, with the severity and exact line numbers?"},{"title":"CI pipeline vulnerability check","prompt":"Here's the diff from our latest commit to the Go payment service — scan it for any command injection, open redirect, or XXE vulnerabilities and give me a pass/fail verdict I can use to block the build if something's found."}],"resultDescription":"Returns a go/no-go verdict indicating whether the scanned code is considered safe, along with a list of per-finding details including: CWE identifier (e.g. CWE-89 for SQL injection), severity rating, the file path and line number where the issue was detected, and a description of the vulnerability type. Only added lines in diffs are scanned. Results are static indicators, not runtime guarantees.","failureModes":["Unsupported language submitted (only Python, JavaScript, TypeScript, Java, Go are supported)","Empty or malformed diff/files input returns no findings","False negatives possible — static analysis cannot catch all runtime vulnerabilities","False positives may be flagged for code patterns that look dangerous but are safe in context","Very large diffs or file batches may time out or be truncated","Non-unified diff formats may not be parsed correctly"],"whenToPreferThis":"Choose this endpoint when you need a fast, automated security pre-check on code changes before merging, deploying, or reviewing — especially in CI/CD pipelines or agent workflows where you want per-finding CWE classification with file and line precision. It covers the CWE Top-25 most dangerous weaknesses across five major languages. Prefer it over generic linting tools when security-specific vulnerability detection (SQL injection, XSS, SSRF, etc.) is the primary concern, and when you need a structured go/no-go verdict rather than style or quality feedback.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T01:03:14.714Z","isFirstParty":false}