ScanPay — Code Security Oracle

ScanPay — Security Oracle & Agent Infrastructure Suite

ScanPay is an autonomous security guardrail and oracle infrastructure suite designed specifically for the Agent-to-Agent (A2A) and Machine-to-Machine (M2M) economy with x402 v2 micropayments.

• Production API: https://scanpay-ob3w.onrender.com
• Remote Streamable MCP: https://scanpay-ob3w.onrender.com/mcp (HTTP) / https://scanpay-ob3w.onrender.com/sse (SSE)
• Solana Merchant Wallet: JDKXvegmW5j4sAJPB6YCA9ffJbN422WLMmCWCcpy1vm4
• Base (EVM) Merchant Wallet: 0xb295E606F38C363b476FC546c27226B5fBcAAEFA (USDC: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)

---

🛠️ The 3 Core Agent Services

Service	Endpoint	MCP Tool	Pricing (Base USDC / SOL)	Purpose
1. Code Security Scanner	POST /v2/scan	scan_code	$0.10 USDC (0.0007 SOL)	AST vulnerability analysis, deterministic patches, and execution gating (PASS/WARN/BLOCK).
2. Pre-Flight Tx Shield	POST /v2/preflight/simulate	simulate_tx	$0.05 USDC (0.00035 SOL)	Simulates EVM/Solana transactions before broadcast, detecting honeypots, drainers, and MEV slippage traps.
3. Anti-Bot Scraper Oracle	POST /v2/oracle/scrape	scrape_url	$0.02 USDC (0.00015 SOL)	Stealth browser scraping bypassing Cloudflare Turnstile/WAF, returning clean LLM Markdown.
4. 10-Operation Session	POST /v2/session/deposit	create_session_deposit	$0.85 USDC (0.006 SOL)	Prepaid micro-voucher valid across all tools with sub-millisecond latency and 0ms RPC bypass.

---

🎯 Machine Experience (MX) & A2A Capabilities

Traditional developer tools output verbose human prose. ScanPay produces structured Machine Responses:

1. Execution Gate Verdicts: Unambiguous ALLOW or BLOCK booleans with 0-100 risk_score and cryptographic Ed25519 oracle attestations.
2. Deterministic Auto-Remediation: Generates instant remediated_code and unified_diff patches ready for git apply.
3. Tx Pre-Flight Simulation: Decodes ERC-20 approvals, detects unlimited allowances to untrusted spenders, honeypot functions (setTrading, blacklist), and Solana SetAuthority account takeovers.
4. Anti-Bot Scraper Oracle: Strips navigation, ads, cookies, and scripts, saving up to 90% of LLM context window tokens.

---

🌐 Live Discovery Endpoints

Autonomous agent frameworks discover ScanPay automatically via spec-compliant endpoints:

Endpoint	Standard / Protocol	Purpose
GET /llms.txt	LLMs Discovery Standard	Machine documentation for LLMs, agents, and Cursor
GET /robots.txt	AI Crawler Standard	Explicit index permissions for GPTBot, Claude-Web, PerplexityBot
GET /.well-known/x402	x402 v2 Spec	Protocol discovery, CAIP-2 network, multi-chain pricing & endpoints
GET /bazaar.json	Coinbase CDP / Onyx Bazaar	Registry catalog with extensions.bazaar.discoverable: true
GET /.well-known/mcp.json	Model Context Protocol	Remote MCP manifest with 5 registered tools
GET /.well-known/agent-card.json	ERC-8004 / ERC-8183	Agent identity card declaring Oracle capabilities
GET /.well-known/ai-plugin.json	OpenAI Plugin Standard	OpenAPI integration manifest for autonomous function callers
GET /SKILL.md	Agent Skills	Native instructions for Claude Code, Hermes, and Codex
GET /PAY.md	Multi-Chain Settlement	Settlement routes, recipient wallets, and spend caps
POST /mcp & GET /sse	MCP Remote Transports	Stateless JSON-RPC tool invocation over HTTP & SSE

---

🤖 Remote Model Context Protocol (MCP)

ScanPay runs as a native remote streamable MCP server.

Zero-Install stdio (CLI)

npx github:Misterio070/scanpay

Add to Claude Desktop / Cursor / Windsurf

{
  "mcpServers": {
    "scanpay": {
      "url": "https://scanpay-ob3w.onrender.com/sse"
    }
  }
}

---

📦 Agent Framework Integrations

• Coinbase AgentKit (Base USDC): packages/agentkit-action-scanpay (@scanpay/agentkit-action)
• Solana Agent Kit v2: packages/plugin-solana-agent-kit (@scanpay/plugin-solana-agent-kit)
• ElizaOS: packages/plugin-elizaos (@elizaos/plugin-scanpay)
• Universal Guardrail Hook: packages/scanpay-guardrail/scanpay-hook.py (Claude Code PreToolUse hook, OpenCode, Codex, LangGraph)
• ERC-8183 Commerce Evaluator: contracts/ScanPayEvaluatorV2.sol (Base ERC-8004 Validation Registry bridge)

---

🧪 Testing & Verification

# Run 125+ automated unit and integration tests
python3 -m pytest

---

📄 License

MIT © Alex Taghiashvili