ScanPay — Code Security Oracle

io.github.Misterio070由 GitHub 账号 Misterio070 发布v1.2.0更新于 Oct 29, 2026

Deterministic code security scan + tx preflight, paid in USDC via x402.

发布方自己的服务：scan.mx Email Diagnostics

已验证Streamable HTTP可网页运行网页搜索与抓取金融安全与监控

服务详情

标识符: io.github.Misterio070/scanpay
传输: Streamable HTTP
运行时: Web executable
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 Misterio070。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Misterio070%2Fscanpay.svg)](https://sourceweft.com/mcp/io.github.Misterio070%2Fscanpay?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

远程 MCP 服务器，可对 Python、JavaScript 和 TypeScript 代码做安全扫描、预演加密交易并审计代币，按次以 USDC 或 SOL 付费。

可以做什么: 扫描代码：对 Python、JS 或 TS 片段做确定性 AST 检查，返回按严重程度排序的问题和 PASS/WARN/BLOCK 结论，也可只取快速结论。
预演交易：在签名前模拟 EVM（Base、Ethereum）和 Solana 交易，识别无限授权、盗币合约、蜜罐和 MEV 风险。
审计代币：检查链上 EVM 字节码和 Solana 铸币账户，发现跑路与蜜罐迹象。
抓取网页：以隐蔽请求头获取页面并返回清理后的 Markdown。
计费与状态：激活预付会话凭证，查询引擎健康状态和支付配置。
适用场景: 适合在智能体生成或准备执行并非自己编写的代码时，先做一次快速、确定性的漏洞检查。也适合处理加密货币的智能体，在签名或交易前检查交易与代币。
运行要求: 远程 streamable HTTP 端点，未声明账号或 API 密钥。调用通过 x402 以 Base USDC 或 SOL 按次付费，需要能进行 x402 支付且有余额的钱包。README 另提供 npm CLI 包，通过 SCANPAY_URL 环境变量配置。

安装前请注意

每次扫描、模拟、审计、抓取或购买会话凭证都会从加密钱包扣费，会话凭证属于预付购买。代码片段、网址和交易数据会发送到第三方服务器。抓取功能会刻意绕过反爬保护，可能与网站条款冲突。检测结果为启发式，不能替代完整审计。

安装

在 SourceWeft 中

打开控制台中的 ScanPay — Code Security Oracle，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.Misterio070%2Fscanpay/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "scanpay-code-security-oracle": {
      "type": "http",
      "url": "https://scanpay-ob3w.onrender.com/mcp"
    }
  }
}

README

scanpay-mcp-server

MCP (Model Context Protocol) server for AI agents to scan code for security vulnerabilities before execution.

Install

Use with Claude Desktop

Add to claude_desktop_config.json:

json

{  "mcpServers": {    "scanpay": {      "command": "scanpay-mcp",      "env": {        "SCANPAY_URL": "https://scanpay-ob3w.onrender.com"      }    }  }}

{  "mcpServers": {    "scanpay": {      "command": "scanpay-mcp",      "env": {        "SCANPAY_URL": "https://scanpay-ob3w.onrender.com"      }    }  }}

How It Works

AI agent generates code
Agent calls scan_code tool via MCP
ScanPay scans for 65 vulnerability patterns (Python + JS/TS)
Agent receives results before executing code
Payment via x402 v2 micropayments (0.0007 SOL ~$0.10/scan)

Supported Languages

Python (ast module) — 30+ vulnerability patterns
JavaScript/TypeScript (tree-sitter) — 23+ vulnerability patterns

Links

来源：npm/scanpay-mcp/README.md，提交 419b82c

工具

scan_code

Use before shipping or executing agent-generated code. Deterministic AST scan for Python, JavaScript and TypeScript with 65 rules (36 Python, 29 JS/TS) covering injection, hardcoded secrets, wallet key exfiltration, SSRF, infinite x402 payment loops and unsimulated Solana transactions. Returns findings with severity, deterministic patches, unified diffs and an execution verdict (PASS, WARN, BLOCK). Pay per call: 0.10 Base USDC or 0.0007 SOL over x402, no signup or API key.

输入参数languagepayment_txsource_code必填session_tokenauto_remediate

scan_quick

Cheapest way to check a snippet before running it: one deterministic AST pass over Python, JavaScript or TypeScript, returning severity-ranked findings and a PASS/WARN/BLOCK verdict without patches or diffs. 65 rules, about 0.2 ms. Pay per call: 0.02 Base USDC or 0.00015 SOL over x402, no signup. Upgrade to scan_code for deterministic patches.

输入参数languagepayment_txsource_code必填session_token

simulate_tx

Pre-flight transaction & drainer shield for AI agents. Simulates and inspects EVM (Base/Ethereum) and Solana transactions before signing or broadcasting. Detects unlimited approvals, known drainers, honeypots, MEV sandwich exposure (min_output=0), and unauthorized Solana authority takeovers. Returns execution verdict (ALLOW, WARN, BLOCK) and cryptographic oracle attestation. Price: $0.05 Base USDC or 0.00035 SOL.

输入参数tx必填chain必填payment_txsession_token

audit_token

Live on-chain token & smart contract rug-pull / honeypot shield for Base, Ethereum, and Solana. Inspects live EVM bytecode (blacklist selectors, mutable tax fees, pause toggles, unverified proxies) and Solana SPL / Token-2022 mint accounts (active mint authority, freeze authority, Permanent Delegate wallet seizure, Transfer Hook honeypots) plus live DexScreener liquidity and 24h buy/sell ratios. Price: $0.05 Base USDC or 0.00035 SOL.

输入参数chain必填payment_txsession_tokentoken_address必填

scrape_url

Anti-bot web access & scraper oracle for AI agents. Fetches web pages with stealth headers to bypass Cloudflare Turnstile, WAFs, and anti-bot challenges. Purifies HTML by removing scripts, stylesheets, tracking pixels, ads, and navigation boilerplate, returning clean, token-efficient Markdown ready for LLM consumption with cryptographic oracle attestation. Price: $0.02 Base USDC or 0.00015 SOL.

输入参数url必填payment_txstrip_mediaextract_modesession_token

create_session_deposit

Activate a prepaid session voucher (0.006 SOL or 0.85 Base USDC for 10 operations). Eliminates per-request payment prompts and RPC latency in autonomous agent loops.

输入参数deposit_tx必填payer_wallet