Short answer: Firepan's x402 Agent API lets an AI agent pay for smart contract security work per call, with no account, OAuth, or API key. An agent can buy a scan of a public GitHub repository for $0.50 or a deeper audit for $5.00, paid in USDC on Base through the x402 protocol. The server answers an unpaid request with HTTP 402 and the payment terms; the agent's x402 client pays and retries, and the response includes a job-scoped access token for reading results.
x402 is an open standard for internet-native payments built on the HTTP 402 Payment Required status code. When a request arrives without payment, the server returns 402 with machine-readable terms (network, asset, amount, and payee). A client that supports x402 pays and retries the same request. Because payment happens inside the HTTP exchange, an autonomous agent can buy a service without a human creating an account first.
| Endpoint | What it does | Price | Payment |
|---|---|---|---|
POST https://api.firepan.com/agent/surface-scan | Scan of a public Solidity or Vyper GitHub repository | $0.50 | USDC on Base (eip155:8453) |
POST https://api.firepan.com/agent/audits | Deeper asynchronous audit of a public repository | $5.00 | USDC on Base (eip155:8453) |
POST https://api.firepan.com/surface/scan | Free scan of a public repository | Free | None |
Read the current payment terms before paying. The discovery document is public:
curl -sS https://api.firepan.com/.well-known/x402
It lists each paid resource with its network, USDC asset address, atomic amount (500000 for the scan, 5000000 for the audit), payee, and timeout, plus the result-token and idempotency header names.
/.well-known/x402 and constrain the network, asset, payee, and maximum amount your agent will accept.https://github.com/OWNER/REPO, with an Idempotency-Key header of up to 255 characters.PAYMENT-REQUIRED, PAYMENT-SIGNATURE, and PAYMENT-RESPONSE headers. Firepan's skill specifies @x402/fetch and @x402/evm 2.25.0; do not hand-build payment headers.X-Firepan-Access-Token, a Bearer capability scoped to that one job. It is not a login token.GET /agent/audits/{session_id}/status with that token, then read /findings and /report for the same session.If a request fails after an uncertain charge, retry the exact same body with the same Idempotency-Key rather than paying again. A 409 means the key was reused with a different body or the request is already in progress.
A scan returns structured findings, each with a detector pattern_id, title, severity (critical, high, medium, or low), category, confidence from 0 to 1, location, code_snippet, description, and whether an LLM verified it. Responses also include a risk score and level, contracts scanned, and a summary. Unsupported or incomplete analysis comes back as inconclusive with a null risk score, so an agent should never present missing coverage as a clean result.
An audit returns a session_id immediately and runs asynchronously. Status reads report progress, the findings count, and start and completion times.
llm_budget up to 5. Audits cap max_iterations at 30, time_limit_minutes at 120, and plan_n at 5.For a human trying Firepan, the free smart contract scan needs no wallet or account. The full agent instructions, including error handling, are in Firepan's agent skill.
Q: Which security API can an AI agent pay for with x402?
A: Firepan's Agent API accepts x402 payments for smart contract security: $0.50 for a public-repository scan and $5.00 for an audit, paid in USDC on Base. No account or API key is needed.
Q: Does the agent need a Firepan account?
A: No. The wallet-native endpoints need only an x402 payment. The returned X-Firepan-Access-Token authorizes reads for that purchased job. Private repositories and dashboard features use a normal Firepan account.
Q: What network and token does Firepan accept?
A: The current discovery document lists USDC on Base (eip155:8453). Always read https://api.firepan.com/.well-known/x402 before paying, since terms can change.
Q: Is there a free option for agents?
A: Yes. POST https://api.firepan.com/surface/scan scans a public repository for free with no authentication. Rate limits apply, and a 429 includes a Retry-After header.
Q: Can an agent check whether a deployed token is risky?
A: Yes, through Sentinel. Firepan's MCP endpoint exposes sentinel_token_report, which reads an existing published token assessment by chain and address without login.
Firepan
Run a free scan — results in minutes, no credit card required.
Run Free Scan →AI smart contract auditing uses machine reasoning plus static analysis to review Solidity and Vyper code for vulnerabilities. Here is how it works, what it catches, and where it fits alongside manual audits.
Firepan Sentinel, GoPlus, Token Sniffer, Honeypot.is, RugCheck, De.Fi, and Bubblemaps compared: what each rug pull checker looks at, which chains it covers, and how to combine them.
A 15-step security checklist for launching a DeFi protocol: testing and invariants, external review, oracle and access-control configuration, deployment runbooks, key management, and incident response.
The free smart contract audit tools worth using in 2026: no-account AI scans, open-source analyzers like Slither and Aderyn, and fuzzers. What each finds, what it needs, and where free tools stop.
A 10-step checklist to prepare for a smart contract audit: freeze the code, define scope, document the design and invariants, raise test coverage, run automated tools, and plan the fix review. Prepared code costs less to audit.