Pentest Agent

API & x402

Security assessments your agent can buy

No signup and no API keys. Agents pay per scan over x402, the HTTP 402 payment standard, and get a full JSON report, a live trace, and a shareable report page.

Premium scan
$0.10
per domain, always fresh
Bulk
$0.05
per domain, up to 25 per call
Free
$0
rate limited, may be cached

Payment rails

BaseUSDC
SolanaUSDC
Robinhood ChainUSDG

Payments settle directly to Pentest Agent's wallet through the payer's chosen facilitator. Settlement happens only when the request succeeds: invalid, private or opted-out targets are rejected before you're charged.

Endpoints

Base URL https://api.pentestagent.dev

POST/v1/scansFree

Rate limited per client. May return a cached report up to 6 hours old.

{ "target": "example.com" }
POST/v1/premium/scan$0.10

x402. Always fresh, reads up to 20 scripts and 15 contracts, stronger AI model.

{ "target": "example.com" }
POST/v1/premium/bulk$0.05 / domain

x402. Up to 25 domains. Charged only if every target is valid.

{ "targets": ["a.com", "b.com"] }
GET/v1/scans/{id}Free

Status, live agent trace, and the full JSON report when complete.

GET/v1/batches/{id}Free

Progress and summaries for a bulk request.

GET/v1Free

Machine-readable service description and accepted networks.

Pay with an agent (TypeScript)

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.AGENT_PRIVATE_KEY);
const pay = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(account) }], // USDC on Base
});

const res = await pay("https://api.pentestagent.dev/v1/premium/scan", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ target: "app.example.xyz" }),
});
const { scan, reportUrl, statusUrl } = await res.json();

// Poll until done, then read the report JSON
let s;
do {
  await new Promise((r) => setTimeout(r, 2000));
  s = (await (await fetch("https://api.pentestagent.dev" + statusUrl)).json()).scan;
} while (s.status === "queued" || s.status === "running");
console.log(s.report.grade, s.report.ai?.summary, reportUrl);

The raw flow

# 1. Ask for a premium scan: the API answers 402 with payment requirements
curl -i -X POST https://api.pentestagent.dev/v1/premium/scan \
  -H 'content-type: application/json' -d '{"target":"app.example.xyz"}'

# HTTP/1.1 402 Payment Required
# PAYMENT-REQUIRED: <base64 JSON: accepts[] with network, asset, amount, payTo>

# 2. Retry with a signed payment (any x402 client or wallet does this for you)
curl -X POST https://api.pentestagent.dev/v1/premium/scan -H 'PAYMENT-SIGNATURE: <base64 payload>' ...

Same rules for paid scans

Paying buys depth and freshness, not permission. Premium scans are still public and non-invasive, honour opt-outs, and are capped at 10 assessments per domain per hour across all customers. Reports are public, like free ones. See the methodology and Terms of Service.