{"uid":"cap_RaxiXXWr3fRbYBCZ139Um","slug":"agentstools-code-security-inspector-4686dd85","name":"AgentsTools Code Security Inspector","description":"Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its language; returns a verdict with per-finding CWE, severity and line. Static indicators, not a guarantee.","url":"https://api.agentstools.dev/code/inspect","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"code":{"type":"string","description":"The source code blob to inspect"},"language":{"type":"string","description":"Language of the blob: python, javascript, java, go, php or ruby"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.008","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.008/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_vWPrmicjMG_nZBQXyn1SR","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.008","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs static application security testing (SAST) on a code blob, detecting CWE Top-25 vulnerabilities like SQL injection, XSS, and SSRF with per-finding severity and line numbers.","exampleAgentPrompt":"Scan this Python code snippet for security vulnerabilities — I want to know if there are any SQL injection, XSS, or command injection issues, with the CWE ID, severity, and line number for each finding: `cursor.execute('SELECT * FROM users WHERE id=' + user_id)`","exampleUseCases":[{"title":"Pre-commit security gate for CI","prompt":"Before I merge this pull request, scan the following JavaScript function for any CWE Top-25 security issues like XSS or prototype pollution and tell me the severity and exact line of each finding."},{"title":"Audit legacy PHP for injection bugs","prompt":"I have an old PHP file I need to audit — can you inspect it for SQL injection, command injection, and path traversal vulnerabilities and give me a breakdown with CWE IDs and line numbers?"},{"title":"Validate AI-generated Go code safety","prompt":"I just had an AI generate this Go HTTP handler for me — please check it for SSRF and insecure deserialization vulnerabilities before I deploy it, and tell me how severe any issues are."}],"resultDescription":"Returns a security verdict for the submitted code blob containing a list of per-finding details: each finding includes the CWE identifier (e.g. CWE-89 for SQL injection), a severity level, and the line number where the issue was detected. The overall verdict indicates whether the code passed or has flagged vulnerabilities.","failureModes":["Unsupported language (only python, javascript, java, go, php, ruby accepted) returns an error","Malformed or empty code blob may return no findings or an error","Static analysis may produce false positives or miss runtime-only vulnerabilities","Very large code blobs may time out or exceed payload limits","Complex obfuscated code may reduce detection accuracy"],"whenToPreferThis":"Choose this endpoint when you need a fast, per-snippet static security scan against CWE Top-25 vulnerabilities with structured machine-readable output (CWE ID, severity, line number) suitable for automated pipelines. Prefer it over manual code review for quick pre-commit checks, AI-generated code validation, or lightweight SAST without standing up a full security toolchain. Not a replacement for dynamic analysis or full-repo scanners.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:02:27.696Z","isFirstParty":false}