{"uid":"cap_NCglsksDY9fCjqp-Z9bNB","slug":"code-security-scan-api-ebb26cb1","name":"Code Security Scan API","description":"Pay-per-scan code security scanning (Semgrep, ESLint, Bandit, npm audit) via x402.","url":"https://scan-api-production-e73f.up.railway.app/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","required":["code"],"properties":{"code":{"type":"string","description":"Source code to scan"},"language":{"enum":["javascript","python","typescript","html"],"type":"string","description":"Optional; auto-detected if omitted"}}},"responseSchema":{"type":"object"},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__nSmZs7h-5vLyDXmT5Qmf","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.1","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans source code for security vulnerabilities using Semgrep, ESLint, Bandit, and npm audit on a pay-per-scan basis via x402.","exampleAgentPrompt":"Can you scan this Python function for security vulnerabilities? Here's the code: `import subprocess; subprocess.call(input())`","exampleUseCases":[{"title":"Pre-deployment security check","prompt":"Before I push this JavaScript file to production, scan it for security issues — here's the code: `eval(userInput)` inside a Node.js handler."},{"title":"Python script vulnerability audit","prompt":"I just wrote this Python script that handles user authentication — can you run a security scan on it and tell me if there are any vulnerabilities? Here's the code: `password = request.args.get('password'); query = 'SELECT * FROM users WHERE password=' + password`"},{"title":"TypeScript API security review","prompt":"Run a security scan on this TypeScript API handler code and flag any issues: `app.get('/user', (req, res) => { res.send(db.query(req.query.id)) })`"}],"resultDescription":"A JSON object containing identified security vulnerabilities, warnings, and findings from the applicable scanners (Semgrep, ESLint, Bandit, or npm audit) based on the detected or specified language, including issue descriptions, severity levels, and line references.","failureModes":["Missing required 'code' field returns a validation error","Unsupported language values outside the enum cause rejection","Extremely large code payloads may time out or be rejected","Payment failure via x402 prevents scan from executing","Auto-detection may misidentify language if code is ambiguous"],"whenToPreferThis":"Choose this endpoint when you need on-demand, pay-per-use security scanning of code snippets without managing your own SAST toolchain. It is ideal for agents that need to gate code on security checks before deployment, or for developers who want to audit individual functions or files without setting up Semgrep, Bandit, ESLint, or npm audit locally. Prefer it over full CI/CD integrations when scanning isolated code blocks programmatically.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-16T06:40:50.294Z","isFirstParty":false,"canonicalSlug":"code-security-scan-api-586c219f"}