{"uid":"cap_gIQPX5oqYAY0ZYPCCByt4","slug":"netzhandwerker-secret-scanner-5e17b936","name":"Netzhandwerker Secret Scanner","description":"x402-Werkzeuge für autonome Agenten.","url":"https://tools.netzhandwerker.de/v1/secret/scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"text":{"type":"string","description":"Text oder Quelltext"},"min_entropy":{"type":"number","default":3.2,"description":"Schwelle fuer allgemeine Zuweisungen"}}},"responseSchema":{"type":"json","example":{"note":"Ein Treffer ist ein Verdacht, kein Beweis fuer Gueltigkeit.","by_rule":{"aws_access_key_id":1,"db_connection_string":1},"verdict":"nicht_veroeffentlichen","findings":[{"end":33,"line":1,"rule":"aws_access_key_id","start":13,"column":14,"entropy":3.68,"preview":"AKIA************MPLE","severity":"kritisch"},{"end":112,"line":2,"rule":"db_connection_string","start":49,"column":14,"entropy":4.41,"preview":"post*********************tion","severity":"hoch"}],"findings_count":2,"highest_severity":"kritisch"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pwAD_TjvOm8nqTrTp_qt4","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans text or source code for hardcoded secrets, credentials, and sensitive strings using entropy analysis and pattern rules","exampleAgentPrompt":"Can you scan this source code snippet for any hardcoded secrets or credentials? Here's the code: 'const key = \"AKIAIOSFODNN7EXAMPLE\"; const db = \"postgresql://admin:pass@host/db\";' — use an entropy threshold of 3.5 to catch general assignments too.","exampleUseCases":[{"title":"Pre-commit secret check for developers","prompt":"Before I push this config file to GitHub, scan it for any hardcoded AWS keys, database connection strings, or other secrets — I don't want to leak credentials into a public repo."},{"title":"CI pipeline security gate","prompt":"I need you to check this newly generated environment file for any sensitive secrets or high-entropy strings. Use a minimum entropy threshold of 3.5 and tell me the severity of anything you find."},{"title":"Audit pasted code from a third party","prompt":"A contractor just sent me this Python script. Can you scan the full text for any credentials, API keys, or database URLs they may have accidentally left in there?"}],"resultDescription":"Returns a JSON object with a list of findings, each containing the matched rule name, line/column position, start/end character offsets, an entropy score, a redacted preview of the secret, and a severity rating (e.g. 'kritisch', 'hoch'). Also includes a summary count of findings grouped by rule, the highest severity found, and a verdict (e.g. 'nicht_veroeffentlichen' meaning 'do not publish'). A note clarifies that a match is a suspicion, not proof of validity.","failureModes":["Empty or missing 'text' field returns no findings or an error","Very short or low-entropy text produces zero findings even if suspicious","Entropy threshold set too high may miss weaker secrets","Entropy threshold set too low generates excessive false positives","Malformed JSON request body returns a 400-level error","Payment failure via x402 returns 402 Payment Required before processing begins"],"whenToPreferThis":"Choose this endpoint when you need fast, per-call secret detection in arbitrary text or source code snippets, especially within automated agent pipelines or CI workflows. It is well-suited for scanning code, config files, or environment variable dumps before they are committed, shared, or published. Prefer this over general-purpose regex tools when you need entropy-based detection with severity classification and a structured JSON verdict.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T06:39:19.323Z","isFirstParty":false}