{"uid":"cap_7pDQJnpG9zJFdMYrg1b-1","slug":"agentstools-secret-scanner-c39c1d94","name":"AgentsTools Secret Scanner","description":"Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-entropy generic secrets. Returns a go/no-go verdict (pass, caution, block) with per-finding rule, provider, severity and location. Secret indicators, not a guarantee.","url":"https://api.agentstools.dev/secret/scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"files":{"type":"array","items":{"type":"object"},"description":"Alternatively a batch of objects, each with path and content"},"rules":{"type":"array","items":{"type":"string"},"description":"Optional list of rule ids to restrict to (see GET /secret/rules)"},"content":{"type":"string","description":"Source code / config text to scan (single blob)"},"filename":{"type":"string","description":"Optional path/name of the blob (affects fixture downgrade)"},"min_entropy":{"type":"number","description":"Raise the entropy floor for generic rules"},"allow_test_fixtures":{"type":"boolean","description":"Drop findings in test/example/doc paths entirely"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_YDmQa-GyLOm5X2fe38N4k","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically scans source code or config text for hardcoded secrets and credentials, returning a pass/caution/block verdict with per-finding details on rule, provider, severity, and location.","exampleAgentPrompt":"Can you scan this source code snippet for any hardcoded secrets or credentials — I want to know if it's safe to commit, and if not, which specific keys or tokens were found and how severe they are.","exampleUseCases":[{"title":"Pre-commit secret leak check","prompt":"Before I push this code to GitHub, scan it for any hardcoded API keys, passwords, or tokens — give me a pass or block verdict and tell me exactly what was found and where."},{"title":"CI pipeline security gate","prompt":"Scan this deployment config file for exposed credentials like database URIs with passwords, cloud provider keys, or private keys, and flag anything with a caution or block severity so I can fix it before deploying."},{"title":"Third-party code vetting","prompt":"I just received this code from a contractor — can you check it for hardcoded secrets like AWS keys, payment tokens, or AI provider API keys, and tell me if there's anything I should be concerned about before running it?"}],"resultDescription":"Returns a top-level verdict (pass, caution, or block) along with an array of per-finding objects, each specifying the matched rule, the secret provider (e.g. AWS, Stripe, OpenAI), severity level, and the location within the text. Findings are indicators, not guaranteed confirmations.","failureModes":["Empty or missing input text returns an error","Oversized payloads may be rejected","High-entropy random strings may trigger false positives for generic secrets","Obfuscated or encoded secrets may not be detected","Only static patterns are matched — runtime-injected secrets are invisible to this scan"],"whenToPreferThis":"Choose this endpoint when you need a fast, cheap ($0.01) static scan of a single text blob, source file, or config snippet for secrets before committing, deploying, or sharing code. It is purpose-built for agentic workflows that need a go/no-go security signal without standing up a full SAST pipeline. Prefer it over general-purpose LLM analysis when you need structured, deterministic findings with severity and provider attribution.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T07:01:42.657Z","isFirstParty":false}