ScanPay — Code Security Oracle is answering right now. Last checked 9 min ago. It exposes 7 tools. Last commit 28 Oct 2026.
Deterministic code security scan + tx preflight, paid in USDC via x402.
What changed 2
Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 28 October 2026. No other catalogue keeps this.
What the code does
We read the source, 4 d ago · tools taken from the live server · rules 995398eba69f
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
if url_val and (url_val.startswith("http://") or "169.254.169.254" in url_val):
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch ScanPay — Code Security Oracle and you get told the day something new turns up.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.
claude mcp add scanpay --transport http https://scanpay-ob3w.onrender.com/mcphttps://scanpay-ob3w.onrender.com/mcp[mcp_servers.scanpay]
url = "https://scanpay-ob3w.onrender.com/mcp"{
"mcpServers": {
"scanpay": {
"url": "https://scanpay-ob3w.onrender.com/mcp"
}
}
}{
"servers": {
"scanpay": {
"type": "http",
"url": "https://scanpay-ob3w.onrender.com/mcp"
}
}
}This server publishes 1 more address. The block above uses the one we reach during checks; the full list is under Endpoints below, and the author may intend a particular one for your client.
Available tools 7
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
scan_code
scan_quick
audit_token
health_check
scrape_url
create_session_deposit
simulate_tx
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://scanpay-ob3w.onrender.com/mcp | streamable-http | answering | 222 ms | 9 min ago |
| https://scanpay-ob3w.onrender.com/sse | sse | answering | 618 ms | 10 min ago |
Alternatives to ScanPay — Code Security Oracle
same job, measured the same wayDeterministic AGENTS.md and repo analysis for coding agents, paid per call in USDC over x402.
Validates AI-generated Python: syntax, lint, security scan and deterministic repair.
Free x402 Lint and Seller Index top 3; paid Security Check, Quote Check and stablecoin tools.
Free deterministic security scan of public git repos: OSV.dev vulnerable deps, secrets, config lint.
Runs your code against a contract; HELD or BROKE at the exact input. Deterministic. 0.10 USDC/call.
AEO scan, 16-engine AI report and one-domain security + AEO report with fixes (x402 USDC).
AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs
Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.
ScanPay — Code Security Oracle — questions
Answers built from our own checks of this server.