ScanPay — Code Security Oracle

io.github.Misterio070Published by GitHub account Misterio070v1.2.0Updated Oct 29, 2026

Deterministic code security scan + tx preflight, paid in USDC via x402.

The publisher's own server: scan.mx Email Diagnostics

VerifiedStreamable HTTPWeb executableWeb Search & Scraping Finance Security & Monitoring

Server details

Identifier: io.github.Misterio070/scanpay
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account Misterio070 for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Misterio070%2Fscanpay.svg)](https://sourceweft.com/mcp/io.github.Misterio070%2Fscanpay?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Remote MCP server that scans Python, JavaScript and TypeScript code for security flaws, preflights crypto transactions and audits tokens, paid per call in…

What you can do: Scan code: run deterministic AST checks on Python, JS or TS snippets and get severity-ranked findings with a PASS/WARN/BLOCK verdict, or a quick verdict-only pass.
Preflight transactions: simulate EVM (Base, Ethereum) and Solana transactions before signing to flag unlimited approvals, drainers, honeypots and MEV exposure.
Audit tokens: inspect live EVM bytecode and Solana mint accounts for rug-pull and honeypot signals.
Fetch web pages: retrieve pages through stealth headers and return cleaned Markdown.
Manage billing and status: activate a prepaid session voucher and check engine health and payment configuration.
When to use it: Useful when an agent writes or runs code it did not author and you want a fast, deterministic vulnerability check before execution. Also relevant for agents handling crypto, where transactions and tokens should be inspected before signing or trading.
Requirements: Remote streamable HTTP endpoint; no account or API key declared. Calls are paid per use over x402 in Base USDC or SOL, so a funded wallet capable of x402 payments is needed. The README also documents an npm CLI package configured with a SCANPAY_URL environment variable.

Before you install

Every scan, simulation, audit, scrape or session deposit costs money from a crypto wallet; the session voucher is a prepaid purchase. Code snippets, URLs and transaction data are sent to a third-party server. The scraper deliberately bypasses anti-bot protections, which may conflict with site terms. Findings are heuristic and do not replace a full audit.

Installation

In SourceWeft

Open ScanPay — Code Security Oracle in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Misterio070%2Fscanpay/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "scanpay-code-security-oracle": {
      "type": "http",
      "url": "https://scanpay-ob3w.onrender.com/mcp"
    }
  }
}

README

scanpay-mcp-server

MCP (Model Context Protocol) server for AI agents to scan code for security vulnerabilities before execution.

Install

Use with Claude Desktop

Add to claude_desktop_config.json:

json

{  "mcpServers": {    "scanpay": {      "command": "scanpay-mcp",      "env": {        "SCANPAY_URL": "https://scanpay-ob3w.onrender.com"      }    }  }}

{  "mcpServers": {    "scanpay": {      "command": "scanpay-mcp",      "env": {        "SCANPAY_URL": "https://scanpay-ob3w.onrender.com"      }    }  }}

How It Works

AI agent generates code
Agent calls scan_code tool via MCP
ScanPay scans for 65 vulnerability patterns (Python + JS/TS)
Agent receives results before executing code
Payment via x402 v2 micropayments (0.0007 SOL ~$0.10/scan)

Supported Languages

Python (ast module) — 30+ vulnerability patterns
JavaScript/TypeScript (tree-sitter) — 23+ vulnerability patterns

Links

Source: npm/scanpay-mcp/README.md at commit 419b82c

Tools

scan_code

Use before shipping or executing agent-generated code. Deterministic AST scan for Python, JavaScript and TypeScript with 65 rules (36 Python, 29 JS/TS) covering injection, hardcoded secrets, wallet key exfiltration, SSRF, infinite x402 payment loops and unsimulated Solana transactions. Returns findings with severity, deterministic patches, unified diffs and an execution verdict (PASS, WARN, BLOCK). Pay per call: 0.10 Base USDC or 0.0007 SOL over x402, no signup or API key.

Parameterslanguagepayment_txsource_coderequiredsession_tokenauto_remediate

scan_quick

Cheapest way to check a snippet before running it: one deterministic AST pass over Python, JavaScript or TypeScript, returning severity-ranked findings and a PASS/WARN/BLOCK verdict without patches or diffs. 65 rules, about 0.2 ms. Pay per call: 0.02 Base USDC or 0.00015 SOL over x402, no signup. Upgrade to scan_code for deterministic patches.

Parameterslanguagepayment_txsource_coderequiredsession_token

simulate_tx

Pre-flight transaction & drainer shield for AI agents. Simulates and inspects EVM (Base/Ethereum) and Solana transactions before signing or broadcasting. Detects unlimited approvals, known drainers, honeypots, MEV sandwich exposure (min_output=0), and unauthorized Solana authority takeovers. Returns execution verdict (ALLOW, WARN, BLOCK) and cryptographic oracle attestation. Price: $0.05 Base USDC or 0.00035 SOL.

Parameterstxrequiredchainrequiredpayment_txsession_token

audit_token

Live on-chain token & smart contract rug-pull / honeypot shield for Base, Ethereum, and Solana. Inspects live EVM bytecode (blacklist selectors, mutable tax fees, pause toggles, unverified proxies) and Solana SPL / Token-2022 mint accounts (active mint authority, freeze authority, Permanent Delegate wallet seizure, Transfer Hook honeypots) plus live DexScreener liquidity and 24h buy/sell ratios. Price: $0.05 Base USDC or 0.00035 SOL.

Parameterschainrequiredpayment_txsession_tokentoken_addressrequired

scrape_url

Anti-bot web access & scraper oracle for AI agents. Fetches web pages with stealth headers to bypass Cloudflare Turnstile, WAFs, and anti-bot challenges. Purifies HTML by removing scripts, stylesheets, tracking pixels, ads, and navigation boilerplate, returning clean, token-efficient Markdown ready for LLM consumption with cryptographic oracle attestation. Price: $0.02 Base USDC or 0.00015 SOL.

Parametersurlrequiredpayment_txstrip_mediaextract_modesession_token

create_session_deposit

Activate a prepaid session voucher (0.006 SOL or 0.85 Base USDC for 10 operations). Eliminates per-request payment prompts and RPC latency in autonomous agent loops.

Parametersdeposit_txrequiredpayer_wallet

health_check

Check ScanPay engine health, available AST rules, and x402 payment configurations.

Takes no parameters.

Version history

v1.2.0LatestOct 29, 2026
v0.2.0Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.

Other Scan integrations

scan.mx Email Diagnostics

mx.scanOfficial publisher

Remote MCP server that lets an assistant run graded email deliverability and DNS checks on a domain, covering MX, SPF, DKIM, DMARC, blacklists and more.

Streamable HTTPWeb executable

Developer Tools9 toolsOct 25, 2026