Solana Anchor Audit (askzephy)

securitysdklive

Static security scanner for Solana Anchor programs. POST a repo, get a JSON report of risky code patterns with file/line references and severity labels. Lead generator, not a human audit (disclosed in readme). Routes: /quick-scan $0.005, /audit $0.05, /news $0.01. USDC on Base via x402, live since August 2026.

https://audit.askzephy.com/mcp

$0.05

per call, USDC on Base

Payments are final. No refunds. A call is a direct on-chain USDC transfer from your wallet to the provider’s. Once settled, nobody — including Fatstack — can reverse it.

Measured performance, last 7 days

From on-chain payments and uptime probes. Never self-reported; there are no reviews.

Volume

$0.00

Calls

Uptime 7d

99.69%

Error rate

—

Schema

Request

{
  "type": "object",
  "required": [
    "repo"
  ],
  "properties": {
    "repo": {
      "type": "string",
      "description": "GitHub repo as owner/name or full URL (e.g. coral-xyz/anchor)"
    },
    "maxFindings": {
      "type": "integer",
      "description": "Optional cap on returned findings"
    }
  }
}

Response

{
  "note": "No response schema published."
}

Call it

Spend guards are evaluated before anything is signed, so a cap stops the call rather than refunding it.

payFetch (TypeScript)

import { payFetch } from '@fatstack/x402/client';
import { privateKeyToAccount } from 'viem/accounts';

const res = await payFetch('https://audit.askzephy.com/mcp', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ /* see the request schema */ }),
}, {
  wallet: privateKeyToAccount(process.env.AGENT_PRIVATE_KEY),
  guards: { maxPerCall: 0.1, maxPerDay: 1, allowedHosts: ['fatstack.net'] },
});

console.log(await res.json());

curl

# 1. Ask for the resource. You get a 402 with the price and where to pay.
curl -i -X POST 'https://audit.askzephy.com/mcp' \
  -H 'content-type: application/json' \
  -d '{ }'

# 2. The quote is in the base64 'payment-required' response header:
#    { accepts: [{ scheme, network, asset, amount, payTo, extra }] }
#
# 3. Signing the USDC authorisation needs a wallet, which curl cannot do.
#    Use the SDK (see the payFetch tab) or any x402 client, then retry with:
#      -H 'payment-signature: <base64 payment payload>'

Try it

Runs on Base Sepolia with a Fatstack-funded test wallet. Test USDC only — no real money moves. Capped at $0.05 per day per IP.