ToolVet
70trust / 100

Code Scan

by Code security scan in Security & trust

x402 APIPassing, checked 11 min ago

Static security scan of a code snippet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. Returns one entry per finding with rule, severity, exact line number, the offending line and a suggested fix. Rule-based and deterministic: no LLM, so the same snippet always returns the same findings. Send Python or JavaScript as plain text. Not a

POST https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan

This listing's own text contains instructions aimed at AI agents (see the security scan below). We withhold that text from agents and never recommend this service.

Last 30 days

All checks passedSome failedAll failedNot checked
Uptime
100%
Response time
604 ms typical, 715 ms slowest 5%
Last check
11 min ago
Next check
in 21 min

How to call it

# See the payment challenge (nothing is charged)
curl -i -X POST "https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan" \
  -H "content-type: application/json" \
  -d '{"code":"import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n","language":"python"}'
import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ffachada.chelsea-hermes.workers.dev%2Fscan%2Fv1%2Fcode%2Fscan
const res = await pay("https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"code":"import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n","language":"python"}),
});
console.log(await res.json());

Example input

{
  "code": "import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n",
  "language": "python"
}

Example output

{
  "counts": {
    "high": 1,
    "medium": 1
  },
  "engine": "rule-based-static (no LLM)",
  "findings": [
    {
      "evidence": "API_KEY = 'sk-liv...b3c2'",
      "fix": "move the value into an environment variable and rotate the credential",
      "issue": "hardcoded credential",
      "line": 2,
      "rule": "hardcoded-secret",
      "severity": "high"
    },
    {
      "evidence": "",
      "fix": "use sha256 or stronger (and a salt for passwords)",
      "issue": "cryptographically weak hash",
      "line": 4,
      "rule": "weak-hash",
      "severity": "medium"
    }
  ],
  "language": "python",
  "lines_scanned": 4,
  "risk": "high",
  "scope_note": "Static rule-based analysis. Not a formal audit and not a penetration test.",
  "total": 2
}

Security scan

  • Mentions credentials or secret files in description
    pet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP ca

Recent checks

WhenResultHTTPTimePrice
11 min agoPassed402604 ms$1.00
4 h agoPassed402560 ms$1.00
8 h agoPassed402682 ms$1.00
11 h agoPassed402596 ms$1.00
15 h agoPassed402612 ms$1.00
19 h agoPassed402524 ms$1.00
22 h agoPassed402715 ms$1.00
26 h agoPassed402741 ms$1.00
29 h agoPassed402550 ms$1.00
33 h agoPassed402549 ms$1.00
37 h agoPassed402676 ms$1.00
40 h agoPassed402515 ms$1.00
44 h agoPassed402614 ms$1.00
47 h agoPassed402515 ms$1.00
2 days agoPassed402631 ms$1.00