Facilitates micropayments in SOL via the x402 protocol to pay for per-scan security analysis.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@scanpay-mcp scan this Python code for vulnerabilities: eval(userInput)"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ScanPay is an autonomous security guardrail and oracle infrastructure suite designed specifically for the Agent-to-Agent (A2A) and Machine-to-Machine (M2M) economy with x402 v2 micropayments.
Production API: https://scanpay-ob3w.onrender.com
Remote Streamable MCP: https://scanpay-ob3w.onrender.com/mcp (HTTP) / https://scanpay-ob3w.onrender.com/sse (SSE)
Solana Merchant Wallet: JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4
Base (EVM) Merchant Wallet: 0xb295E606F38C363b476FC546c27226B5fBcAAEFA (USDC: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
Service | Endpoint | MCP Tool | Pricing (Base USDC / SOL) | Purpose |
1. Code Security Scanner |
|
| $0.10 USDC (0.0007 SOL) | AST vulnerability analysis, deterministic patches, and execution gating (PASS/WARN/BLOCK). |
2. Pre-Flight Tx Shield |
|
| $0.05 USDC (0.00035 SOL) | Simulates EVM/Solana transactions before broadcast, detecting honeypots, drainers, and MEV slippage traps. |
3. Anti-Bot Scraper Oracle |
|
| $0.02 USDC (0.00015 SOL) | Stealth browser scraping bypassing Cloudflare Turnstile/WAF, returning clean LLM Markdown. |
4. 10-Operation Session |
|
| $0.85 USDC (0.006 SOL) | Prepaid micro-voucher valid across all tools with sub-millisecond latency and 0ms RPC bypass. |
Related MCP server: bug-bounty-intelligence-mcp
Traditional developer tools output verbose human prose. ScanPay produces structured Machine Responses:
Execution Gate Verdicts: Unambiguous ALLOW or BLOCK booleans with 0-100 risk_score and cryptographic Ed25519 oracle attestations.
Deterministic Auto-Remediation: Generates instant remediated_code and unified_diff patches ready for git apply.
Tx Pre-Flight Simulation: Decodes ERC-20 approvals, detects unlimited allowances to untrusted spenders, honeypot functions (setTrading, blacklist), and Solana SetAuthority account takeovers.
Anti-Bot Scraper Oracle: Strips navigation, ads, cookies, and scripts, saving up to 90% of LLM context window tokens.
Autonomous agent frameworks discover ScanPay automatically via spec-compliant endpoints:
Endpoint | Standard / Protocol | Purpose |
| LLMs Discovery Standard | Machine documentation for LLMs, agents, and Cursor |
| AI Crawler Standard | Explicit index permissions for GPTBot, Claude-Web, PerplexityBot |
| x402 v2 Spec | Protocol discovery, CAIP-2 network, multi-chain pricing & endpoints |
| Coinbase CDP / Onyx Bazaar | Registry catalog with |
| Model Context Protocol | Remote MCP manifest with 5 registered tools |
| ERC-8004 / ERC-8183 | Agent identity card declaring Oracle capabilities |
| OpenAI Plugin Standard | OpenAPI integration manifest for autonomous function callers |
| Agent Skills | Native instructions for Claude Code, Hermes, and Codex |
| Multi-Chain Settlement | Settlement routes, recipient wallets, and spend caps |
| MCP Remote Transports | Stateless JSON-RPC tool invocation over HTTP & SSE |
ScanPay runs as a native remote streamable MCP server.
npx github:Misterio070/scanpay{
"mcpServers": {
"scanpay": {
"url": "https://scanpay-ob3w.onrender.com/sse"
}
}
}Coinbase AgentKit (Base USDC): packages/agentkit-action-scanpay (@scanpay/agentkit-action)
Solana Agent Kit v2: packages/plugin-solana-agent-kit (@scanpay/plugin-solana-agent-kit)
ElizaOS: packages/plugin-elizaos (@elizaos/plugin-scanpay)
Universal Guardrail Hook: packages/scanpay-guardrail/scanpay-hook.py (Claude Code PreToolUse hook, OpenCode, Codex, LangGraph)
ERC-8183 Commerce Evaluator: contracts/ScanPayEvaluatorV2.sol (Base ERC-8004 Validation Registry bridge)
# Run 125+ automated unit and integration tests
python3 -m pytestMIT © Alex Taghiashvili
This server cannot be deployed
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Security scanner for AI agents: prompt injection, leaked secrets, PII, and SSRF-risk URL detection.
Token rug-risk scans, Know Your Agent wallet checks and deployer reputation for AI agents.
