ScanPay — Code Security Scanner with x402 v2 Micropayments

npm version npm downloads GitHub

Deterministic AST-based security scanning for Python and JavaScript/TypeScript. No code execution. No AI inference. Just fast, reliable vulnerability detection. Pay per scan with Solana micropayments — $0.10/scan.

🎯 What It Does

ScanPay analyzes source code for security vulnerabilities using deterministic AST parsing. No AI, no code execution — just fast, reliable pattern matching that catches 45+ vulnerability classes before code runs.

Built for AI agents that generate code: scan before execution, block dangerous patterns, log audit trails.

✨ Features

45+ vulnerability patterns across Python and JS/TS/TSX
Deterministic analysis — same input always produces same output
x402 v2 payment protocol — pay per scan with SOL on Solana
Dual language support — Python (ast module) and JS/TS (tree-sitter)
No false AI hallucinations — pure rule-based detection
FastAPI-powered — sub-100ms scan latency
SARIF output — industry-standard vulnerability report format
Batch scanning — scan multiple files in one request

🚀 Quick Start

Using the Live API (testnet)

# Health check
curl https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/health

# List available products
curl https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/products

# Scan code (requires payment)
curl -X POST https://repository-nil-camcorder-divx.trycloudflare.com/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"source_code":"eval(userInput)","language":"python"}'
# → 402 Payment Required (0.0007 SOL)

Self-Host

git clone https://github.com/Misterio070/scanpay.git
cd scanpay
pip install -r requirements.txt
python main.py
# → http://localhost:8484

💳 Payment Flow (x402 v2)

Client requests scan → receives 402 Payment Required
Client pays 0.0007 SOL (~$0.10) to merchant wallet via Solana
Client retries with X-PAYMENT header containing payment proof
Server verifies payment on-chain, runs scan, returns results

Merchant wallet: JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4

🤖 For AI Agents (MCP Server)

ScanPay includes an MCP server for AI agents to scan code before execution:

{
  "mcpServers": {
    "scanpay": {
      "command": "npx",
      "args": ["-y", "scanpay-cli", "scanpay-mcp"],
      "env": { "SCANPAY_URL": "https://repository-nil-camcorder-divx.trycloudflare.com" }
    }
  }
}

Agents call scan_code to check code for vulnerabilities before running it. Network: Solana testnet (mainnet coming soon)

📋 Configuration

cp .env.example .env

Env Var	Default	Description
`SCANPAY_PAYMENT_MODE`	`disabled`	`disabled`, `testnet`, or `mainnet`
`SCANPAY_MERCHANT_WALLET`	—	Solana wallet address
`SCANPAY_PRICE_LAMPORTS`	`700000`	Price in lamports (0.0007 SOL)
`SCANPAY_RPC_URL`	`https://api.devnet.solana.com`	Solana RPC endpoint
`SCANPAY_PORT`	`8484`	Server port

🧪 Detected Vulnerabilities

Python

eval() / exec() — code injection
subprocess with shell=True — command injection
pickle.loads() — deserialization attacks
os.system() — command injection
SQL injection patterns
Path traversal (../)
Hardcoded credentials
And more...

JavaScript/TypeScript

eval() — code injection
innerHTML — XSS
document.write() — XSS
new Function() — code injection
SQL injection patterns
Prototype pollution
And more...

📊 API Reference

`GET /api/v1/health`

Returns service status and configuration.

`GET /api/v1/products`

Returns available scan products and pricing.

`POST /api/v1/scan`

Scans source code for vulnerabilities. Requires payment in testnet/mainnet mode.

Request:

{
  "source_code": "eval(userInput)",
  "language": "python"
}

Response (200):

{
  "status": "ok",
  "findings": [
    {
      "rule": "PY001",
      "severity": "critical",
      "message": "Use of eval() detected — code injection risk",
      "line": 1
    }
  ],
  "summary": {
    "total": 1,
    "critical": 1,
    "high": 0,
    "medium": 0,
    "low": 0
  }
}

scanpay

Install to Claude Code

README