{"api":"v1","generated_at":"2026-09-15T22:43:41.291Z","licence":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"TOLL, with a link to the page cited"},"page":"https://tollindex.com/e/api-agentstools-dev-ci-scan-2fb6b9","pinned_page":"https://tollindex.com/e/api-agentstools-dev-ci-scan-2fb6b9/at/2026-09-15T21-20Z","pinned":false,"method":"https://tollindex.com/ledger/method","snapshot_at":"2026-09-15T21:20:12.737Z","snapshot_stamp":"2026-09-15T21-20Z","endpoint":{"slug":"api-agentstools-dev-ci-scan-2fb6b9","canonical_url":"https://api.agentstools.dev/ci/scan","resource":"https://api.agentstools.dev/ci/scan","http_method":"POST","type":"http","x402_version":2,"registries":["cdp"],"primary_registry":"cdp","curated_by_coinbase":false,"description":"Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.","service_name":"cicd-scan","declared_category":null,"declared_tags":["cicd","github-actions","gitlab","circleci","security"],"route_template":null,"registry_updated":"2026-09-08T23:29:38.300Z"},"derived":{"note":"fields no registry supplies; TOLL derives them and marks them derived on the page","title":"ci scan","category":"media","first_observed_by_toll":"2026-09-10T19:08:24.178Z","last_observed_by_toll":"2026-09-15T21:20:12.737Z","observation_began":"2026-09-10"},"presence":{"listed_now":true,"first_absent_at":null,"delisting_confirmed_at":null,"events":[{"registry":"cdp","at":"2026-09-10T19:08:24.178Z","event":"listed"}]},"accepts":[{"registry":"cdp","ordinal":0,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.02 USDC","amount_units":0.02,"decimals_known":true,"pay_to":"0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493","scheme":"exact"}],"counters":{"observed_at":"2026-09-15T21:20:12.737Z","calls_30d":5,"unique_payers_30d":3,"last_called_at":"2026-09-08T23:29:37.710Z"},"validation":{"latest":{"observed_at":"2026-09-15T04:21:05.321Z","state":"pass","failed_checks":[],"endpoint_http_status":402,"run_id":"daily-2026-09-15"},"uptime":[{"days":7,"observed":5,"passed":5,"ratio":1},{"days":30,"observed":5,"passed":5,"ratio":1},{"days":90,"observed":5,"passed":5,"ratio":1}],"history_90d":[{"observed_at":"2026-09-15T04:21:05.321Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-15","state_changed":false},{"observed_at":"2026-09-14T04:18:21.802Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-14","state_changed":false},{"observed_at":"2026-09-13T04:17:25.532Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-13","state_changed":false},{"observed_at":"2026-09-12T06:32:55.051Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-12","state_changed":false},{"observed_at":"2026-09-11T10:02:28.684Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-11","state_changed":true}]},"seller":{"wallet":"0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493","page":"https://tollindex.com/seller/0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493","endpoints":344,"hosts":2},"reports":0,"registry_record":{"cdp":[{"tags":["cicd","github-actions","gitlab","circleci","security"],"type":"http","accepts":[{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493","amount":"20000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300}],"quality":{"lastCalledAt":"2026-09-08T23:29:37.71Z","l30DaysTotalCalls":5,"l30DaysUniquePayers":3},"resource":"https://api.agentstools.dev/ci/scan","extensions":{"bazaar":{"info":{"input":{"body":{"format":"github-actions","content":"name: ci\non: pull_request_target\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@v4\n      with:\n        ref: ${{ github.event.pull_request.head.ref }}\n    - run: echo \"${{ github.event.issue.title }}\"\n"},"type":"http","method":"POST","bodyType":"json"},"output":{"type":"json","example":{"format":"github-actions","object":"ci_config","verdict":"block","coverage":{"rules_total":27,"objects_by_kind":{"job":1,"step":2,"workflow":1},"objects_scanned":4,"dimensions_flagged":["injection","triggers"]},"findings":[{"path":"jobs.build.steps[1]","reason":"An attacker-controllable expression is expanded inside a run: script — arbitrary code execution on the runner.","rule_id":"gha.template_injection","evidence":"${{ github.event.issue.title }}","fix_hint":"Bind it to an env var and quote the shell reference.","provider":"github-actions","resource":"build.step1","severity":"critical","dimension":"injection"}],"disclaimer":"Automated security indicators, not a guarantee.","risk_score":100,"config_hash":"sha256:…","object_count":4,"ruleset_version":"2026.07.24","counts_by_severity":{"high":1,"critical":2}}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"required":["content"],"properties":{"format":{"enum":["auto","github-actions","gitlab-ci","circleci"],"type":"string","description":"CI system, or auto to detect from the content"},"content":{"type":"string","description":"The CI/CD config text to scan (workflow file)"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}}}},"description":"Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.","lastUpdated":"2026-09-08T23:29:38.3Z","serviceName":"cicd-scan","x402Version":2}]}}