{"uid":"cap_zVKBsrVwCDW4GRnIa_QWI","slug":"agentstools-secret-diff-scanner-2155c639","name":"AgentsTools Secret Diff Scanner","description":"Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged. Returns a verdict (pass, caution, block) with per-finding rule, provider, severity, file and line. Secret indicators, not a guarantee.","url":"https://api.agentstools.dev/secret/diff","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"diff":{"type":"string","description":"A unified diff; only added lines are scanned"},"rules":{"type":"array","items":{"type":"string"},"description":"Optional list of rule ids to restrict to"},"min_entropy":{"type":"number","description":"Raise the entropy floor for generic rules"},"allow_test_fixtures":{"type":"boolean","description":"Drop added lines in test/example paths entirely"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_yGQqm3stKlSbOMGpSwwse","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a unified git diff for newly introduced secrets/credentials on added lines only, returning a pass/caution/block verdict with per-finding details","exampleAgentPrompt":"Scan this unified diff for any newly introduced secrets or credentials — flag only lines I'm adding, not stuff that was already there, and give me a verdict on whether it's safe to commit.","exampleUseCases":[{"title":"Pre-commit credential leak check","prompt":"Before I push this diff, scan it for any hardcoded API keys, tokens, or passwords I might have accidentally introduced in the new lines — give me a pass, caution, or block verdict."},{"title":"CI pipeline secret gate","prompt":"Run a secret scan on this pull request's unified diff and tell me if any of the added lines contain credentials from providers like AWS or GitHub — I only care about newly introduced secrets, not pre-existing ones."},{"title":"Security review of third-party patch","prompt":"I received this unified diff from an external contributor — scan only the added lines for any secret indicators and list each finding with the rule, provider, severity, file, and line number so I can review before merging."}],"resultDescription":"A JSON object containing a top-level verdict ('pass', 'caution', or 'block') and an array of findings, each with the matched rule ID, secret provider, severity level, affected file path, and line number within the diff. Only lines added in the diff are reported on; removed or unchanged lines are ignored.","failureModes":["Malformed or non-unified diff format causes a parsing error","Empty diff body returns a pass verdict with no findings","Invalid rule IDs in the rules filter may cause the scan to return an error or skip filtering","Very large diffs may exceed payload limits","False negatives are possible — the service returns indicators, not guarantees of completeness","Test fixture paths may be flagged unless allow_test_fixtures is set to true"],"whenToPreferThis":"Choose this endpoint when you want low-false-positive, pre-commit focused secret detection that ignores already-present secrets in unchanged or removed code. It is ideal for CI/CD pipelines, agent-driven code review, and developer tooling where you only care about credentials being newly introduced by a patch. Prefer it over full-repository scanners when you have a diff already and want a fast, cheap per-call verdict without scanning the entire codebase.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T01:05:08.524Z","isFirstParty":false}