# ScanPay

Deterministic pre-execution security scan for AI-agent-generated code.
45+ vulnerability classes for Python and JavaScript/TypeScript. No code execution, no LLM inference.

## Products
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/scan — $0.05 per scan (x402 or direct on-chain)
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/deep-scan — $10 deep report (risk score, severity counts, remediation)
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/quick — $0.01 quick PASS/WARN/BLOCK verdict
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/agent-deep — $0.10 deep report sized for agent budgets (input <= 20 KB)
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/credits — $5 prepaid pack (200 scans, returns X-API-Key)
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/credits-micro — $0.10 micro pack (5 scans, returns X-API-Key)
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/key/scan — use X-API-Key credits (no per-call x402)
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/scan/manual — pay directly on-chain, pass tx_hash (Base) or tx_signature (Solana)

## Payment
x402 v2, USDC on Base (eip155:8453) or Solana (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp); 'exact' scheme.
Buyer selects one of the `accepts` entries from the 402 response.
Direct on-chain: USDC on Base to 0x1E04f5046500e5369E17AF993Dc60aC29D83efc9, or SPL-USDC / SOL on Solana to N6ZJxx4DAGbDYv3HbVYXso3yFyqprrxPPzdKsZpHHX9.

## Input
{"source_code": "<utf-8>", "language": "python" | "javascript" | "typescript" | "tsx"}

## A2A (Agent2Agent)
POST https://scanpay-edge.alextaghiashvili.workers.dev/a2a — JSON-RPC 2.0 `message/send`: send a data part {source_code, language} or a text part containing code; returns a completed task whose artifact is the findings JSON. Agent card: https://scanpay-edge.alextaghiashvili.workers.dev/.well-known/agent-card.json.

## MCP (streamable HTTP)
GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/mcp — MCP 2.x streamable-HTTP endpoint with tools: scan_code (returns live x402 payment requirements; no free tier) and pricing. Discovery file: https://scanpay-edge.alextaghiashvili.workers.dev/.well-known/mcp.json. Listed on mcpub.dev.

## x402 endpoint audit
POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/x402-check ($0.01) — audits a public x402 endpoint's unpaid 402 challenge (version, accepts fields, resource match, discovery extension, CORS exposure, latency) and returns a scored checklist. Useful before listing a service in a registry.

## Batch tools
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/page-extract-batch ($0.005) — clean page text for up to 10 URLs in one call (urls=...).
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/urlwatch-batch ($0.01) — URL change detection for up to 10 URLs in one call (urls=...).
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/token-balance-batch ($0.005) — ERC-20 token balances for up to 10 items in one call.

## Task-language aliases
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/page-extract ($0.002) — clean readable page text; accepts url|target|uri.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/change-detect ($0.005) — URL change detection; accepts url|target|uri.

## Market-priced clones (same tasks as the top-selling agent402 tools)
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/crypto-price ($0.001) — spot USD price, up to 20 symbols.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/gas-estimate ($0.001) — gas price + slow/normal/fast for Base/Ethereum.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/fx-rate ($0.002) — ECB reference FX rate.

## Demand-driven tools
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/token-balance ($0.002) — ERC-20 balance for any EVM wallet via eth_call (Base or Ethereum).

## Demand-driven tools
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/readclean ($0.001) — clean readable markdown/text from a public URL (deterministic, no LLM).
- POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/urlwatch ($0.005) — page change detection / website change monitoring: detect whether a URL's readable content changed since the last check.

## Start here
GET https://scanpay-edge.alextaghiashvili.workers.dev/start — MCP config, x402 HTTP flow, A2A card and framework snippets in one page.

## Pricing
GET https://scanpay-edge.alextaghiashvili.workers.dev/pricing — every paid endpoint, price, and how to call it.

## x402 compliance observations
GET https://scanpay-edge.alextaghiashvili.workers.dev/x402-compliance-index — a dated, reproducible table of real public x402 endpoints audited with /api/v1/x402-check (10 compliant, 2 partial as of 2026-10-31).

## On-chain RPC utilities
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/block-height ($0.001) — latest block number/hash/timestamp (network=base|ethereum).
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/tx ($0.005) — transaction by hash: from/to/value/nonce/gas.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/tx-receipt ($0.005) — receipt: success, gas used, logs, contract address.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/nonce ($0.002) — next nonce for an EVM address.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/contract-info ($0.003) — bytecode size, proxy implementation, ERC-20 metadata.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/token-supply ($0.002) — total supply and decimals.

## Token preflight
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/token-preflight ($0.005) — contract shape, proxy, owner/renounce, ERC-20 metadata, supply, mint/blacklist selector heuristics, Uniswap V2 liquidity and a deterministic risk score (observations only, not an audit).

## ENS + wallet balance
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/ens ($0.005) — resolve a .eth name to an address, or an address to its primary ENS name.
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/wallet-balance ($0.003) — native balance plus up to 20 ERC-20 balances.

## Event logs
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/tx-logs ($0.005) — eth_getLogs for a contract: count + block/tx/topics/data preview.

## NFT metadata
- GET/POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/nft-metadata ($0.008) — ERC-721/1155 tokenURI, collection name/symbol.

## Case study
GET https://scanpay-edge.alextaghiashvili.workers.dev/case-study/x402-audit — a real $0.01 audit of a public x402 endpoint (score 88 / compliant), and what each check means.

## Integrations
- GET https://scanpay-edge.alextaghiashvili.workers.dev/integrations — ElizaOS action (elizaos-guard.ts) and LangChain tool (langchain-tool.py) snippets using prepaid credits (X-API-Key) or x402.

## Rule catalog
GET https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/patterns (JSON) or GET https://scanpay-edge.alextaghiashvili.workers.dev/patterns (HTML) — every engine rule with severity, category, message and remediation.

## Output
findings[] with rule_id, severity, category, line range, message; plus source_sha256 and engine version.
The source is hashed and discarded; it is never stored.