ScanPay — Code Security Scanner with x402 v2 Micropayments

🚀 Try ScanPay Live (Solana Mainnet)

Pay 0.0007 SOL (~$0.10) per scan. No account. No API key.

• Live API: https://theoretical-config-hobby-kruger.trycloudflare.com

• Landing page: https://misterio070.github.io/scanpay-landing/

• AgentBridge: https://invest-ftp-cast-surround.trycloudflare.com

• MCP Server: npx scanpay-mcp-server

• CLI: npx scanpay-cli scan --language python --file ./code.py

• llms.txt: https://github.com/Misterio070/scanpay/blob/main/llms.txt

Related MCP server: SAST MCP Server

💰 Pricing

• Python / JavaScript / TypeScript scan: 0.0007 SOL

• AgentBridge job escrow commission: 10%

• No subscriptions, no free trial abuse.

Deterministic AST-based security scanning for Python and JavaScript/TypeScript. No code execution. No AI inference. Just fast, reliable vulnerability detection. Pay per scan with Solana micropayments — $0.10/scan.

🎯 What It Does

ScanPay analyzes source code for security vulnerabilities using deterministic AST parsing. No AI, no code execution — just fast, reliable pattern matching that catches 45+ vulnerability classes before code runs.

Built for AI agents that generate code: scan before execution, block dangerous patterns, log audit trails.

✨ Features

• 45+ vulnerability patterns across Python and JS/TS/TSX

• Deterministic analysis — same input always produces same output

• x402 v2 payment protocol — pay per scan with SOL on Solana

• Dual language support — Python (ast module) and JS/TS (tree-sitter)

• No false AI hallucinations — pure rule-based detection

• FastAPI-powered — sub-100ms scan latency

• SARIF output — industry-standard vulnerability report format

• Batch scanning — scan multiple files in one request

🌐 Live Demo

ScanPay is deployed and running:

• Public API: https://theoretical-config-hobby-kruger.trycloudflare.com

• Products: https://theoretical-config-hobby-kruger.trycloudflare.com/api/v1/products

• Payment: x402 v2 on Solana mainnet (0.0007 SOL ≈ $0.10 per scan)

• Wallet: JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4

Try it

curl -X POST https://theoretical-config-hobby-kruger.trycloudflare.com/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"language":"python","source_code":"import os; os.system(\"rm -rf /\")"}'

Returns 402 Payment Required with Solana payment details. Send payment and retry with X-PAYMENT header to get the scan result.

🚀 Quick Start

Using the Live API (mainnet)

# Health check
curl https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/health

# List available products
curl https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/products

# Scan code (requires payment)
curl -X POST https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"source_code":"eval(userInput)","language":"python"}'
# → 402 Payment Required (0.0007 SOL)

Self-Host

git clone https://github.com/Misterio070/scanpay.git
cd scanpay
pip install -r requirements.txt
python main.py
# → http://localhost:8484

💳 Payment Flow (x402 v2)

1. Client requests scan → receives 402 Payment Required

2. Client pays 0.0007 SOL (~$0.10) to merchant wallet via Solana

3. Client retries with X-PAYMENT header containing payment proof

4. Server verifies payment on-chain, runs scan, returns results

Merchant wallet: JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4

🤖 For AI Agents (MCP Server)

ScanPay includes an MCP server for AI agents to scan code before execution:

{
  "mcpServers": {
    "scanpay": {
      "command": "npx",
      "args": ["-y", "scanpay-cli", "scanpay-mcp"],
      "env": { "SCANPAY_URL": "https://repository-nil-camcorder-divx.trycloudflare.com" }
    }
  }
}

Agents call scan_code to check code for vulnerabilities before running it. Network: Solana mainnet (mainnet coming soon)

📋 Configuration

cp .env.example .env

🧪 Detected Vulnerabilities

Python

• eval() / exec() — code injection

• subprocess with shell=True — command injection

• pickle.loads() — deserialization attacks

• os.system() — command injection

• SQL injection patterns

• Path traversal (../)

• Hardcoded credentials

• And more...

JavaScript/TypeScript

• eval() — code injection

• innerHTML — XSS

• document.write() — XSS

• new Function() — code injection

• SQL injection patterns

• Prototype pollution

• And more...

📊 API Reference

GET /api/v1/health

Returns service status and configuration.

GET /api/v1/products

Returns available scan products and pricing.

POST /api/v1/scan

Scans source code for vulnerabilities. Requires payment in mainnet/mainnet mode.

Request:

{
  "source_code": "eval(userInput)",
  "language": "python"
}

Response (200):

{
  "status": "ok",
  "findings": [
    {
      "rule": "PY001",
      "severity": "critical",
      "message": "Use of eval() detected — code injection risk",
      "line": 1
    }
  ],
  "summary": {
    "total": 1,
    "critical": 1,
    "high": 0,
    "medium": 0,
    "low": 0
  }
}

🤝 Built For

• AI Agents — scan generated code before execution

• CI/CD Pipelines — pre-deployment security gate

• IDE Extensions — real-time vulnerability detection

• Code Review — automated security audit

📄 License

MIT

🔗 Links

• GitHub

• x402 Protocol

• Solana