{"uid":"cap_DaefY1kl5bJAXoaWrYaR5","slug":"sentinel402-pii-secret-guardrail-scanner-30ab2d76","name":"Sentinel402 PII & Secret Guardrail Scanner","description":"Paid tools for AI agents over x402: a PII and secret guardrail that scans outbound payloads, live citable data (crypto, weather, GitHub, sports, FX), and an RCP/1 retrieval server backed by that live data.","url":"https://pii-guardrail.chronokey.workers.dev/v1/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"mode":{"enum":["detect","redact","block"],"type":"string","description":"detect = report only (default). redact = also return sanitized text. block = fail closed when findings exist."},"text":{"type":"string","description":"Text to scan for PII and leaked secrets. Mutually exclusive with `payload`. Max 32000 chars."},"rules":{"type":"array","items":{"type":"string"},"description":"Explicit rule ids, e.g. [\"CREDIT_CARD\",\"SSN\"]. Defaults to the standard profile (34 rules)."},"enable":{"type":"array","items":{"type":"string"},"description":"Rule ids to add to the default profile, e.g. [\"IPV6\",\"SWIFT_BIC\"]."},"disable":{"type":"array","items":{"type":"string"},"description":"Rule ids to remove, e.g. [\"IPV4\"] if client IPs are expected."},"payload":{"description":"Any JSON to scan instead of raw text. Returns a structurally identical sanitized clone as `sanitizedPayload`."},"minSeverity":{"enum":["low","medium","high","critical"],"type":"string","description":"Only report findings at or above this severity."},"blockThreshold":{"type":"number","description":"Risk score (0-100) at which `block` mode refuses. Default 40."}}},"responseSchema":{"type":"json","example":{"ok":true,"meta":{"mode":"redact","cpuMs":1,"rulesApplied":34,"engineVersion":"1.1.0"},"risk":100,"x402":{"network":"eip155:8453","settled":true,"facilitator":"https://facilitator.payai.network","transaction":"0xabc123"},"counts":{"low":0,"high":0,"medium":0,"critical":1},"decision":"redact","findings":[{"rule":"CREDIT_CARD","count":1,"label":"Credit / debit card number (PAN)","samples":[{"end":31,"start":12,"preview":"[CREDIT_CARD:************4242]","confidence":0.99,"contextual":false}],"severity":"critical","confidence":0.99}],"sanitized":"Charge card [CREDIT_CARD:************4242] for order 991.","truncated":false,"scannedChars":51}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_xacpy90Y43__6ug5XCctk","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans outbound text or JSON payloads for PII and leaked secrets using 34 configurable rules, returning risk scores, findings, and optionally redacted or blocked output","exampleAgentPrompt":"Before sending this response to the user, redact any PII or secrets from it — use block mode if the risk score exceeds 40, and only flag findings at medium severity or above.","exampleUseCases":[{"title":"Guardrail outbound AI agent responses","prompt":"Scan this text my AI agent is about to send to a customer and redact any credit card numbers, SSNs, or secrets before it goes out — use redact mode and flag everything at medium severity or above."},{"title":"Validate JSON payload before logging","prompt":"Check this JSON object for any PII or leaked API keys before we write it to our logs — return a sanitized version with all sensitive fields masked, and block it entirely if the risk score is over 60."},{"title":"Audit user-submitted content for compliance","prompt":"Detect any personally identifiable information in this user-submitted text using all 34 default rules and tell me the risk score and what types of PII were found, without modifying the original text."}],"resultDescription":"Returns a JSON object with: overall risk score (0-100), decision (detect/redact/block), counts of findings by severity (low/medium/high/critical), detailed findings list per rule (rule name, count, severity, confidence, character positions, preview with redaction tokens), sanitized text or sanitized JSON payload clone, scan metadata (CPU time, rules applied, engine version), and x402 payment settlement details.","failureModes":["Text exceeds 32,000 character limit — request rejected","Invalid mode enum value — validation error returned","Conflicting `text` and `payload` fields both provided — mutually exclusive","Payment not settled via x402 — 402 Payment Required response","Unknown rule ID in `rules`, `enable`, or `disable` arrays — rule not found error","Empty input text or payload — no findings, risk score 0","blockThreshold set but mode is not block — threshold ignored silently"],"whenToPreferThis":"Use this endpoint when you need real-time PII and secret detection on outbound text or JSON payloads before they are sent, logged, or stored — especially in AI agent pipelines where LLM outputs may inadvertently echo sensitive user data. Prefer this over client-side regex when you need a scored, multi-rule engine with 34 built-in patterns covering credit cards, SSNs, API keys, and more. The block mode makes it suitable as a hard guardrail, not just a reporting tool.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T00:34:22.138Z","isFirstParty":false,"canonicalSlug":"sentinel402-pii-secret-guardrail-scanner-30ab2d76"}