{"uid":"cap_u06D0PHpkr5PCyha6qyF3","slug":"payai-secret-diff-scanner-a488946e","name":"PayAI Secret Diff Scanner","description":"Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged. Returns a verdict (pass, caution, block) with per-finding rule, provider, severity, file and line. Secret indicators, not a guarantee.","url":"https://payai.agentstools.dev/secret/diff","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"diff":{"type":"string","description":"A unified diff; only added lines are scanned"},"rules":{"type":"array","items":{"type":"string"},"description":"Optional list of rule ids to restrict to"},"min_entropy":{"type":"number","description":"Raise the entropy floor for generic rules"},"allow_test_fixtures":{"type":"boolean","description":"Drop added lines in test/example paths entirely"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-3QvHLKqbA4SwpwN7tlVb","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically scans a unified git-diff for newly introduced secrets, flagging only added lines with a pass/caution/block verdict and per-finding details.","exampleAgentPrompt":"Before I commit this diff, scan it for any newly introduced secrets or credentials — only flag things added in this change, not stuff that was already there — and give me a pass, caution, or block verdict with the exact file and line for each finding.","exampleUseCases":[{"title":"Pre-commit credential leak check","prompt":"I'm about to commit these changes — here's the unified diff. Can you scan it for any secrets or API keys I might have accidentally added and tell me if it's safe to push?"},{"title":"CI pipeline secret gate","prompt":"As part of our CI pipeline, scan this git-diff for any newly introduced credentials or tokens and return a block, caution, or pass verdict so we can decide whether to halt the build."},{"title":"Pull request security review","prompt":"Before merging this PR, check the diff for any hardcoded secrets like AWS keys, database passwords, or OAuth tokens that were added in these changes — show me the rule, severity, and exact line for anything flagged."}],"resultDescription":"Returns a verdict string (pass, caution, or block) along with an array of findings, each containing the matched rule name, secret provider category, severity level, affected file path, and line number where the secret was introduced. Only lines added in the diff are evaluated; unchanged and removed lines are excluded from scoring.","failureModes":["Malformed or non-unified diff format may cause parsing errors or empty results","Very large diffs may exceed payload size limits","False negatives possible — novel or obfuscated credential formats may not be detected","False positives can occur for high-entropy strings that resemble secrets but are not","API returns caution rather than block for ambiguous findings, requiring human review"],"whenToPreferThis":"Choose this endpoint when you need a low-false-positive secret scan scoped strictly to newly introduced lines in a git-diff, such as in a pre-commit hook, CI gate, or pull request review workflow. It is preferable over full-repo scanners when you want to avoid noise from pre-existing secrets in the codebase and only care about what a developer is about to introduce.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T01:02:58.029Z","isFirstParty":false}