{
  "markdown": "# ScanPay — Code Security Scanner with x402 v2 Micropayments\n\n\n## 🚀 Try ScanPay Live (Solana Mainnet)\n\nPay 0.0007 SOL (~$0.10) per scan. No account. No API key.\n\n- **Live API:** https://theoretical-config-hobby-kruger.trycloudflare.com\n- **Landing page:** https://misterio070.github.io/scanpay-landing/\n- **AgentBridge:** https://invest-ftp-cast-surround.trycloudflare.com\n- **MCP Server:** `npx scanpay-mcp-server`\n- **CLI:** `npx scanpay-cli scan --language python --file ./code.py`\n- **llms.txt:** https://github.com/Misterio070/scanpay/blob/main/llms.txt\n\n## 💰 Pricing\n\n- Python / JavaScript / TypeScript scan: **0.0007 SOL**\n- AgentBridge job escrow commission: **10%**\n- No subscriptions, no free trial abuse.\n\n![npm version](https://img.shields.io/npm/v/scanpay-cli.svg)\n![npm downloads](https://img.shields.io/npm/dm/scanpay-cli.svg)\n![GitHub](https://img.shields.io/github/stars/Misterio070/scanpay.svg)\n![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)\n\n> Deterministic AST-based security scanning for Python and JavaScript/TypeScript.\n> No code execution. No AI inference. Just fast, reliable vulnerability detection.\n> Pay per scan with Solana micropayments — $0.10/scan.\n\n## 🎯 What It Does\n\nScanPay analyzes source code for security vulnerabilities using deterministic AST parsing. No AI, no code execution — just fast, reliable pattern matching that catches 45+ vulnerability classes before code runs.\n\nBuilt for **AI agents** that generate code: scan before execution, block dangerous patterns, log audit trails.\n\n## ✨ Features\n\n- **45+ vulnerability patterns** across Python and JS/TS/TSX\n- **Deterministic analysis** — same input always produces same output\n- **x402 v2 payment protocol** — pay per scan with SOL on Solana\n- **Dual language support** — Python (`ast` module) and JS/TS (tree-sitter)\n- **No false AI hallucinations** — pure rule-based detection\n- **FastAPI-powered** — sub-100ms scan latency\n- **SARIF output** — industry-standard vulnerability report format\n- **Batch scanning** — scan multiple files in one request\n\n## 🌐 Live Demo\n\nScanPay is deployed and running:\n\n- **Public API:** `https://theoretical-config-hobby-kruger.trycloudflare.com`\n- **Products:** `https://theoretical-config-hobby-kruger.trycloudflare.com/api/v1/products`\n- **Payment:** x402 v2 on Solana mainnet (0.0007 SOL ≈ $0.10 per scan)\n- **Wallet:** `JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4`\n\n### Try it\n\n```bash\ncurl -X POST https://theoretical-config-hobby-kruger.trycloudflare.com/api/v1/scan \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"language\":\"python\",\"source_code\":\"import os; os.system(\\\"rm -rf /\\\")\"}'\n```\n\nReturns `402 Payment Required` with Solana payment details. Send payment and retry with `X-PAYMENT` header to get the scan result.\n\n## 🚀 Quick Start\n\n### Using the Live API (mainnet)\n\n```bash\n# Health check\ncurl https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/health\n\n# List available products\ncurl https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/products\n\n# Scan code (requires payment)\ncurl -X POST https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/scan \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"source_code\":\"eval(userInput)\",\"language\":\"python\"}'\n# → 402 Payment Required (0.0007 SOL)\n```\n\n### Self-Host\n\n```bash\ngit clone https://github.com/Misterio070/scanpay.git\ncd scanpay\npip install -r requirements.txt\npython main.py\n# → http://localhost:8484\n```\n\n## 💳 Payment Flow (x402 v2)\n\n1. Client requests scan → receives `402 Payment Required`\n2. Client pays **0.0007 SOL** (~$0.10) to merchant wallet via Solana\n3. Client retries with `X-PAYMENT` header containing payment proof\n4. Server verifies payment on-chain, runs scan, returns results\n\n**Merchant wallet:** `JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4`\n\n## 🤖 For AI Agents (MCP Server)\n\nScanPay includes an MCP server for AI agents to scan code before execution:\n\n```json\n{\n  \"mcpServers\": {\n    \"scanpay\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"scanpay-cli\", \"scanpay-mcp\"],\n      \"env\": { \"SCANPAY_URL\": \"https://repository-nil-camcorder-divx.trycloudflare.com\" }\n    }\n  }\n}\n```\n\nAgents call `scan_code` to check code for vulnerabilities before running it.\n**Network:** Solana mainnet (mainnet coming soon)\n\n## 📋 Configuration\n\n```bash\ncp .env.example .env\n```\n\n| Env Var | Default | Description |\n|---------|---------|-------------|\n| `SCANPAY_PAYMENT_MODE` | `disabled` | `disabled`, `mainnet`, or `mainnet` |\n| `SCANPAY_MERCHANT_WALLET` | — | Solana wallet address |\n| `SCANPAY_PRICE_LAMPORTS` | `700000` | Price in lamports (0.0007 SOL) |\n| `SCANPAY_RPC_URL` | `https://api.devnet.solana.com` | Solana RPC endpoint |\n| `SCANPAY_PORT` | `8484` | Server port |\n\n## 🧪 Detected Vulnerabilities\n\n### Python\n- `eval()` / `exec()` — code injection\n- `subprocess` with `shell=True` — command injection\n- `pickle.loads()` — deserialization attacks\n- `os.system()` — command injection\n- SQL injection patterns\n- Path traversal (`../`)\n- Hardcoded credentials\n- And more...\n\n### JavaScript/TypeScript\n- `eval()` — code injection\n- `innerHTML` — XSS\n- `document.write()` — XSS\n- `new Function()` — code injection\n- SQL injection patterns\n- Prototype pollution\n- And more...\n\n## 📊 API Reference\n\n### `GET /api/v1/health`\nReturns service status and configuration.\n\n### `GET /api/v1/products`\nReturns available scan products and pricing.\n\n### `POST /api/v1/scan`\nScans source code for vulnerabilities. Requires payment in mainnet/mainnet mode.\n\n**Request:**\n```json\n{\n  \"source_code\": \"eval(userInput)\",\n  \"language\": \"python\"\n}\n```\n\n**Response (200):**\n```json\n{\n  \"status\": \"ok\",\n  \"findings\": [\n    {\n      \"rule\": \"PY001\",\n      \"severity\": \"critical\",\n      \"message\": \"Use of eval() detected — code injection risk\",\n      \"line\": 1\n    }\n  ],\n  \"summary\": {\n    \"total\": 1,\n    \"critical\": 1,\n    \"high\": 0,\n    \"medium\": 0,\n    \"low\": 0\n  }\n}\n```\n\n## 🤝 Built For\n\n- **AI Agents** — scan generated code before execution\n- **CI/CD Pipelines** — pre-deployment security gate\n- **IDE Extensions** — real-time vulnerability detection\n- **Code Review** — automated security audit\n\n## 📄 License\n\nMIT\n\n## 🔗 Links\n\n- [GitHub](https://github.com/Misterio070/scanpay)\n- [x402 Protocol](https://x402.org)\n- [Solana](https://solana.com)",
  "bytes": 6309,
  "sha": "bfe8682b6f61adcb39eb0d8da56a59bd2f0136c7c621e35b5b679583a1238e91",
  "repo_slug": "misterio070/scanpay",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_misterio070_scanpay_7714c1bd/readme"
}