{"uid":"cap_ygXL-QiDXTrT3iLOqCO1L","slug":"pr-verdict-pull-request-security-scanner-464f8098","name":"PR Verdict — Pull Request Security Scanner","description":"One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and findings with severity, file, line and a fix hint. One call instead of slicing the diff into several. Security indicators, not a guarantee.","url":"https://api.agentstools.dev/pr/verdict","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"pr_url":{"type":"string","description":"Public GitHub pull-request URL (github.com/owner/repo/pull/N)"},"max_files":{"type":"integer","description":"Optional cap on files scanned for a large PR"},"dimensions":{"type":"array","items":{"type":"string"},"description":"Optional subset of code, secret, ci, deps (default: all)"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_BNRkS5ZBdTGy09638KR-8","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a public GitHub PR diff and returns a single merge-safety verdict (pass/caution/block), a risk score, and detailed findings across code, secrets, CI/CD, and dependency dimensions.","exampleAgentPrompt":"Can you do a security scan on this pull request — https://github.com/owner/repo/pull/42 — and tell me if it's safe to merge? I want you to check all dimensions: code, secrets, CI pipelines, and dependencies.","exampleUseCases":[{"title":"Open-source contribution safety check","prompt":"Before I merge this community PR at https://github.com/myorg/myapp/pull/187, can you scan it for any secrets, risky code changes, or supply chain issues and give me a pass/caution/block verdict?"},{"title":"CI/CD pipeline change review","prompt":"Someone just opened https://github.com/acme/infra/pull/55 which touches our GitHub Actions workflows — can you run a security scan focused on the ci and code dimensions and tell me if there's anything alarming?"},{"title":"Dependency update risk assessment","prompt":"This PR at https://github.com/startup/backend/pull/301 upgrades several npm packages — can you scan it with just the deps and secret dimensions and flag any vulnerable or suspicious dependency changes?"}],"resultDescription":"Returns a top-level verdict string (pass, caution, or block), a numeric risk score, and a list of findings each containing severity, the affected file and line number, a description of the issue, and a suggested fix hint. Covers code quality risks, exposed secrets, CI/CD pipeline manipulation, and dependency vulnerabilities in a single response.","failureModes":["PR URL is private or inaccessible — returns an error indicating the repository is not publicly readable","Invalid or malformed GitHub PR URL — returns a validation error","PR diff is too large and exceeds scanner limits — may require setting max_files to reduce scope","Unknown dimension value in the dimensions array — returns a parameter validation error","GitHub rate limiting or temporary unavailability — returns a service error"],"whenToPreferThis":"Use this endpoint when you need a fast, all-in-one security verdict for a public GitHub pull request without orchestrating multiple specialized scanners. It is ideal for autonomous code review agents, CI bots, or developer assistants that need a single actionable signal (pass/caution/block) rather than raw scanner output. Prefer this over building a multi-step pipeline when time and simplicity matter more than exhaustive customization.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:33:17.170Z","isFirstParty":false}