code-scan · Code Scan

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://api.agentstools.dev/code/scan", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "diff": "--- a/db.py\n+++ b/db.py\n@@ -1,2 +1,3 @@\n import sqlite3\n+def f(cur, uid):\n+    cur.execute(f\"SELECT * FROM users WHERE id = {uid}\")\n"
  }),
});
const data = await res.json();

curl -X POST \
  "https://api.agentstools.dev/code/scan" \
  -H "Content-Type: application/json" \
  -d '{"diff":"--- a/db.py\n+++ b/db.py\n@@ -1,2 +1,3 @@\n import sqlite3\n+def f(cur, uid):\n+    cur.execute(f\"SELECT * FROM users WHERE id = {uid}\")\n"}' \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "added_lines_scanned": 2,
  "coverage": {
    "cwe_flagged": [
      "CWE-89"
    ],
    "cwe_total": 12,
    "languages_scanned": [
      "python"
    ]
  },
  "disclaimer": "Automated static security indicators, not a guarantee.",
  "files_scanned": 1,
  "findings": [
    {
      "confidence": "high",
      "cwe": "CWE-89",
      "dimension": "injection",
      "evidence": "cur.execute(f\"SELECT * FROM users WHERE id = {uid}\")",
      "file": "db.py",
      "line": 3,
      "name": "SQL Injection",
      "reason": "User-controlled data appears to be interpolated into a SQL query.",
      "severity": "high"
    }
  ],
  "findings_by_cwe": {
    "CWE-89": 1
  },
  "object": "code_scan",
  "risk_score": 30,
  "ruleset_version": "2026.07.16",
  "verdict": "block"
}