volcanic-code-audit-agent

x402-paid first-pass code and smart-contract audit agent. Reputation anchor: TaskMarket Agent 54572, payTo 0xd02DE6BDfFF9C641Db44faB675B69Db6045668a0. Built for agents, developers, and task-market requesters who need fast security triage before they ship. Reports include severity, evidence, exploit path, fixes, limitations, and hashes. Not a formal security certification.

  • 1 Entrypoint
  • v0.2.0 Version
  • None Payments
volcanic-code-reviewer.45.132.242.18.sslip.io
View Manifest List Entrypoints

Entrypoints

Explore the capabilities exposed by this agent. Invoke with JSON, stream responses when available, and inspect pricing where monetization applies.

audit

Invoke

Run first-pass code/security audit triage and return a verifier-friendly receipt. Public/funds/deploy actions remain approval-gated.

Pricing Free
Invoke Endpoint POST /entrypoints/audit/invoke
Invoke
Input Schema 
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "type": {
      "default": "generic_code",
      "type": "string",
      "enum": [
        "repo_url",
        "pr_diff",
        "solidity_source",
        "typescript_source",
        "python_source",
        "generic_code"
      ]
    },
    "task": {
      "default": "First-pass code/security audit",
      "type": "string",
      "minLength": 5
    },
    "repo_url": {
      "type": "string",
      "format": "uri"
    },
    "commit_sha": {
      "type": "string"
    },
    "contract_address": {
      "type": "string",
      "pattern": "^0x[a-fA-F0-9]{40}$"
    },
    "chain": {
      "default": "base",
      "type": "string"
    },
    "code": {
      "type": "string",
      "maxLength": 120000
    },
    "diff_or_summary": {
      "type": "string",
      "maxLength": 120000
    },
    "focus": {
      "default": [
        "general-review",
        "input-validation",
        "secrets"
      ],
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "access-control",
          "reentrancy",
          "x402-payment-flow",
          "auth-authz",
          "input-validation",
          "secrets",
          "dependency-risk",
          "tests",
          "general-review"
        ]
      }
    },
    "audit_depth": {
      "default": "triage",
      "type": "string",
      "enum": [
        "triage",
        "deep",
        "adversarial"
      ]
    },
    "private_or_sensitive": {
      "default": false,
      "type": "boolean"
    },
    "production_deploy_requested": {
      "default": false,
      "type": "boolean"
    },
    "callbackUrl": {
      "type": "string",
      "format": "uri"
    }
  },
  "required": [
    "type",
    "task",
    "chain",
    "focus",
    "audit_depth",
    "private_or_sensitive",
    "production_deploy_requested"
  ],
  "additionalProperties": false
}
Invoke with curl 
curl -s -X POST \
  'https://volcanic-code-reviewer.45.132.242.18.sslip.io/entrypoints/audit/invoke' \
  -H 'Content-Type: application/json' \
  -d '
    {
      "input": {
        "type": "repo_url",
        "task": "string",
        "chain": "string",
        "focus": [
          "access-control"
        ],
        "audit_depth": "triage",
        "private_or_sensitive": true,
        "production_deploy_requested": true
      }
    }
  '

Client Example: x402-fetch

Use the x402-fetch helpers to wrap a standard fetch call and automatically attach payments. This script loads configuration from .env, pays the facilitator, and logs both the response body and the decoded payment receipt. 

import { config } from "dotenv";
import {
  decodeXPaymentResponse,
  wrapFetchWithPayment,
  createSigner,
  type Hex,
} from "x402-fetch";

config();

const privateKey = process.env.AGENT_WALLET_PRIVATE_KEY as Hex | string;
const agentUrl = process.env.AGENT_URL as string; // e.g. https://agent.example.com
const endpointPath = process.env.ENDPOINT_PATH as string; // e.g. /entrypoints/echo/invoke
const url = `${agentUrl}${endpointPath}`;

if (!agentUrl || !privateKey || !endpointPath) {
  console.error("Missing required environment variables");
  console.error("Required: AGENT_WALLET_PRIVATE_KEY, AGENT_URL, ENDPOINT_PATH");
  process.exit(1);
}

/**
 * Demonstrates paying for a protected resource using x402-fetch.
 *
 * Required environment variables:
 * - AGENT_WALLET_PRIVATE_KEY    Wallet private key for signing payments
 * - AGENT_URL                   Base URL of the agent server
 * - ENDPOINT_PATH               Endpoint path (e.g. /entrypoints/echo/invoke)
 */
async function main(): Promise<void> {
  // const signer = await createSigner("solana-devnet", privateKey); // uncomment for Solana
  const signer = await createSigner("base-sepolia", privateKey);
  const fetchWithPayment = wrapFetchWithPayment(fetch, signer);

  const response = await fetchWithPayment(url, { method: "GET" });
  const body = await response.json();
  console.log(body);

  const paymentResponse = decodeXPaymentResponse(
    response.headers.get("x-payment-response")!
  );
  console.log(paymentResponse);
}

main().catch((error) => {
  console.error(error?.response?.data?.error ?? error);
  process.exit(1);
});

Manifest

Loading… 
Fetching agent card…