{"uid":"cap_YcneflImR3OTR_EFcviJr","slug":"agentstools-iac-inspect-single-resource-static-misconfiguration-scan-6db7dc81","name":"AgentsTools IaC Inspect — Single-Resource Static Misconfiguration Scan","description":"Static misconfiguration scan of a SINGLE infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose or CloudFormation). The lightweight per-resource form of /iac/scan: returns a verdict (pass, caution, block), a risk score and findings with rule, severity, location and fix hint. Security indicators, not a guarantee.","url":"https://api.agentstools.dev/iac/inspect","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"kind":{"enum":["auto","terraform","terraform-plan","kubernetes","dockerfile","docker-compose","cloudformation"],"type":"string","description":"Config format of the snippet, or auto to detect"},"resource":{"type":"string","description":"A single-resource config snippet to inspect"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.006","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.006/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oXH2zifxamOK1IvPsesbA","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.006","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically scans a single infrastructure-as-code resource snippet (Terraform, Kubernetes, Dockerfile, docker-compose, or CloudFormation) for security misconfigurations, returning a verdict, risk score, and actionable findings.","exampleAgentPrompt":"Can you scan this Terraform aws_s3_bucket resource snippet for misconfigurations and tell me the security verdict, risk score, and any findings with fix hints? Here's the config: resource \"aws_s3_bucket\" \"my_bucket\" { bucket = \"my-bucket\" acl = \"public-read\" }","exampleUseCases":[{"title":"Terraform S3 bucket security audit","prompt":"I'm about to deploy this Terraform aws_s3_bucket resource — can you inspect it for security misconfigurations and give me a pass/caution/block verdict with any findings and how to fix them? resource \"aws_s3_bucket\" \"data\" { bucket = \"corp-data\" acl = \"public-read\" }"},{"title":"Kubernetes pod spec privilege check","prompt":"Can you check this Kubernetes Pod spec for security issues before I apply it to the cluster? Tell me the risk score and any rules it violates: spec: containers: - name: app image: myapp:latest securityContext: privileged: true"},{"title":"Dockerfile hardening review","prompt":"Please inspect this Dockerfile snippet for security misconfigurations — I want to know if it passes or should be blocked, and what I need to fix: FROM ubuntu:latest RUN apt-get install -y curl && chmod 777 /app COPY . /app CMD [\"/app/start.sh\"]"}],"resultDescription":"Returns a JSON object containing: a verdict string ('pass', 'caution', or 'block') indicating overall security posture, a numeric risk score, and an array of findings each with a rule ID, severity level, location within the snippet, and a fix hint describing the recommended remediation. Results are security indicators, not guarantees.","failureModes":["Missing or empty 'resource' field returns a 400 validation error","Unsupported or malformed config format may result in no findings or parse error","Auto-detection ('auto' kind) may misidentify the format for ambiguous snippets","Multi-resource snippets may only partially analyze or return unexpected results since endpoint is designed for single resources","Rate limiting or payment failure returns 402 or 429 errors","Very large snippets may be truncated or rejected"],"whenToPreferThis":"Choose this endpoint when you need a fast, cheap ($0.006) security scan of a single IaC resource snippet in isolation — ideal for inline CI/CD gates, pre-commit hooks, or agent-driven code review where you process one resource at a time. Prefer this over a full /iac/scan when you want minimal latency and cost per resource rather than scanning an entire file or repository.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:49:15.337Z","isFirstParty":false}