{"schema_version":"2.0","protocol":"erc-8004 + a2a + x402 + mcp","name":"HexRail Scanner","short_name":"HexRail","description":"AI security agent for smart contracts and code. Runs 180 detectors (incl. 12 famous-hack replay templates) plus optional AI deep review and working Foundry PoC generation. Attests every paid scan onchain via EAS on Robinhood. Pay-per-call in USDC on Robinhood, no signup required.","icon":"https://hexrailsec.io/icon-mark.png","url":"https://hexrailsec.io","provider":{"name":"HexRail","url":"https://hexrailsec.io","contact":"https://hexrailsec.io"},"identity":{"erc8004":{"chain":"robinhood","chainId":null,"identityRegistry":null,"reputationRegistry":null,"agentId":"","tokenURI":null,"reputationAverage":0,"reputationCount":0,"registryExplorer":null},"wallet":"0x557c8a0b085BF18620eb01E1315Bdcd4d0d4bDC1","attestation":{"service":"EAS on Robinhood mainnet","schemaUid":"0x697123c2234c5a6ca0b8afd94e1ad699b30b955dfea7d9edbfaab28c775a8d40","explorer":null}},"capabilities":[{"id":"scan","name":"Source code security scan","description":"Submit raw source code, get findings (severity, location, fix), plus a 0-100 score and grade A-F. Supports Solidity, Vyper, JS/TS, Python, Go, Java, Ruby, PHP, Rust, plus IaC (Terraform, Kubernetes, Dockerfile, GitHub Actions).","endpoint":"https://hexrailsec.io/api/v1/scan","method":"POST","input":{"source":{"type":"string","required":true,"description":"Raw source code"},"filename":{"type":"string","required":false,"description":"Filename hint, e.g. Vault.sol"},"aiAnalysis":{"type":"boolean","required":false,"description":"Enable AI-powered deep review (costs more)"},"rpcUrl":{"type":"string","required":false,"description":"Fork RPC URL for PoC execution (Solidity only)"}},"output":{"findings":"Array of security findings with severity, location, description, suggestion, fixDiff","summary":"Human-readable summary","score":"Integer 0–100","grade":"A | B | C | D | F","breakdown":"Per-severity finding counts and score impact","pocs":"(optional) Working Foundry exploit transcripts when AI analysis succeeds"},"pricing":[{"chain":"robinhood","network":"<robinhood CAIP-2 network — set at launch>","asset":"<robinhood USDC address — set at launch>","amount":"10000","decimals":6,"human":"$0.01 USDC","facilitator":"https://x402.org/facilitator","available":true},{"chain":"solana","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpFuMz4j8","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","amount":"10000","decimals":6,"human":"$0.01 USDC","facilitator":"https://facilitator.payai.network","available":false}]},{"id":"review","name":"AI-powered diff review","description":"Submit a unified git diff, get AI-powered findings with CWE/OWASP mappings, fix diffs, and an EAS attestation on Robinhood. Optimal for PR review and CI integration.","endpoint":"https://hexrailsec.io/api/v1/review","method":"POST","input":{"diff":{"type":"string","required":true,"description":"Unified diff string (git format)"},"rulesets":{"type":"array","required":false,"description":"Rule categories to enable"},"targetChains":{"type":"array","required":false,"description":"Blockchain targets, e.g. ['ethereum','robinhood','solana']"},"staticOnly":{"type":"boolean","required":false,"description":"Skip AI analysis"},"repo":{"type":"string","required":false,"description":"owner/name — enables EAS commit attestation"},"commitSha":{"type":"string","required":false,"description":"Commit hash for the attestation target"}},"output":{"findings":"Array of findings with fixDiff and CWE IDs","summary":"Human-readable summary","score":"SecurityScore object"},"pricing":[{"chain":"robinhood","network":"<robinhood CAIP-2 network — set at launch>","asset":"<robinhood USDC address — set at launch>","amount":"20000","decimals":6,"human":"$0.02 USDC","facilitator":"https://x402.org/facilitator","available":true},{"chain":"solana","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpFuMz4j8","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","amount":"20000","decimals":6,"human":"$0.02 USDC","facilitator":"https://facilitator.payai.network","available":false}]},{"id":"scan-address","name":"Scan a deployed contract by address","description":"Provide a 0x address and chain (Ethereum, Robinhood, Arbitrum, Optimism, Polygon). We fetch the verified source from the chain's block explorer and scan every source file. Paid path returns an EAS attestation on Robinhood; the free playground variant is rate-limited and unattested.","endpoint":"https://hexrailsec.io/api/v1/scan-address","method":"POST","input":{"address":{"type":"string","required":true,"description":"0x... contract address (40 hex chars)"},"chain":{"type":"string","required":false,"description":"ethereum | robinhood | arbitrum | optimism | polygon (default: ethereum)"}},"output":{"scanId":"Public receipt short ID","receiptUrl":"https://hexrailsec.io/r/<scanId>","score":"0-100","grade":"A-F","severityCounts":"{ critical, high, medium, low, info, total }","easUid":"EAS attestation UID on Robinhood mainnet (paid path)","attestationUrl":"<robinhood EAS explorer>/attestation/view/<uid>","contract":"Metadata (name, compiler, file count, proxy info, explorer URL)","findings":"Per-file findings"},"pricing":[{"chain":"robinhood","network":"<robinhood CAIP-2 network — set at launch>","asset":"<robinhood USDC address — set at launch>","amount":"10000","decimals":6,"human":"$0.01 USDC","facilitator":"https://x402.org/facilitator","available":true},{"chain":"solana","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpFuMz4j8","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","amount":"10000","decimals":6,"human":"$0.01 USDC","facilitator":"https://facilitator.payai.network","available":false}]},{"id":"scan-address-free","name":"Scan a deployed contract — free playground","description":"Same address-scan engine as the paid endpoint, IP-rate-limited and unattested. Use when you don't have x402/Bearer auth set up.","endpoint":"https://hexrailsec.io/api/playground/scan-address","method":"POST","input":{"address":{"type":"string","required":true,"description":"0x... contract address (40 hex chars)"},"chain":{"type":"string","required":false,"description":"ethereum | robinhood | arbitrum | optimism | polygon (default: ethereum)"}},"output":{"receiptId":"Public receipt short ID","receiptUrl":"/r/<receiptId>","contract":"Metadata","findings":"Per-file findings","score":"0-100","grade":"A-F"},"pricing":[]},{"id":"oracle-onchain-read","name":"HexRail Oracle — onchain score read","description":"Read the latest HexRail score for any address in a single staticcall on Robinhood mainnet. Returns { score, easUid, timestamp, chainId }. Designed for Uniswap v4 hooks, vault factories, and any Robinhood contract that wants to consult a HexRail signal without leaving the chain. Reader convention: timestamp == 0 means 'never scored.' Updated on every paid scan; canonical Robinhood contracts re-seeded weekly by a HexRail keeper.","endpoint":"https://hexrailsec.io/oracle","method":"GET","input":{"target":{"type":"address","required":true,"description":"0x... address to look up"}},"output":{"score":"0-100 heuristic — NOT a safety guarantee","easUid":"Backing EAS attestation UID on Robinhood mainnet","timestamp":"Unix seconds at scan time (uint64); 0 = never scored","chainId":"Native chain ID of the scanned contract (uint32)"},"pricing":[]},{"id":"guard-preflight","name":"Agent Guard — preflight signal for a Robinhood address","description":"Agent-readable preflight signal for a Robinhood contract address. Returns decision (low_risk_signal | review | block_for_review | needs_scan), score, riskSurface, proofStatus, easAttested + attestationUrl when present, top findings, and a recommendedAction. Reads the latest public ScanReceipt — does not auto-scan on cache miss. For a fresh paid + EAS-attested receipt, call /api/v1/scan-address. Not an audit. Not a safety guarantee.","endpoint":"https://hexrailsec.io/api/guard/robinhood/<address>","method":"GET","input":{"address":{"type":"string","required":true,"description":"0x... Robinhood contract address (path parameter)"}},"output":{"decision":"low_risk_signal | review | block_for_review | needs_scan","score":"0-100","grade":"A-F","receiptUrl":"Public receipt URL","guardUrl":"Human Guard Link URL","easAttested":"Boolean — whether a backing EAS attestation exists","attestationUrl":"<robinhood EAS explorer>/attestation/view/<uid> when present","proofStatus":"static_only | needs_context | ai_reviewed | test_generated | test_passed | exploit_confirmed | not_exploitable","riskSurface":"{ admin_power, user_fund_risk, trading_restriction, upgradeability } each with { level, count }","reasons":"Array of human-readable strings explaining the decision","recommendedAction":"One-line plain-English next step","topFindings":"Up to 3 findings sorted by severity","stale":"Boolean — true when the cached receipt is older than 24h","source":"cached_receipt | no_data"},"pricing":[]},{"id":"watcher-feed","name":"Watcher feed — new Robinhood contracts as HexRail sees them","description":"HexRail watches new Robinhood contract deployments and scans contracts when verified source is available. Watcher scans are static-only, best-effort, not EAS-attested, and not oracle-published. For an attested score that other Robinhood contracts can read onchain, call /api/v1/scan-address. Not an audit. Not a safety guarantee.","endpoint":"https://hexrailsec.io/api/watcher/feed","method":"GET","input":{"limit":{"type":"number","required":false,"description":"Max events, 1–100 (default 50)"},"status":{"type":"string","required":false,"description":"scanned (default) | unverified | skipped | failed | all"},"since":{"type":"string","required":false,"description":"ISO timestamp; only events discovered after this"}},"output":{"count":"Number of events returned","status":"Filter applied","events":"Array of { address, chainId, blockNumber, deployedAt, discoveredAt, status, reason, receipt }"},"pricing":[]},{"id":"replay-hacks","name":"Replay famous exploits against your code","description":"Encoded patterns from 8 real-world exploits totaling $3B+ in losses: Bybit, Radiant, Euler, zkSync, Curve, Beanstalk, Multichain, Ronin. Returns the subset that match against submitted source code.","endpoint":"https://hexrailsec.io/api/v1/scan","method":"POST","input":{"source":{"type":"string","required":true,"description":"Source code"},"filename":{"type":"string","required":false,"description":"Filename hint"},"aiAnalysis":{"type":"boolean","required":false,"description":"Confirm matches with Foundry PoC (Solidity only)"}},"output":{"findings":"Hack-replay findings only (filter ruleId.startsWith('cp-hack-'))"},"pricing":[{"chain":"robinhood","network":"<robinhood CAIP-2 network — set at launch>","asset":"<robinhood USDC address — set at launch>","amount":"10000","decimals":6,"human":"$0.01 USDC","facilitator":"https://x402.org/facilitator","available":true},{"chain":"solana","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpFuMz4j8","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","amount":"10000","decimals":6,"human":"$0.01 USDC","facilitator":"https://facilitator.payai.network","available":false}]}],"auth":{"x402":{"enabled":false,"chains":["robinhood","solana"],"note":"Send signed USDC transfer in X-PAYMENT header. On missing/insufficient payment, endpoints return 402 with X-PAYMENT-REQUIRED.","payTo":"0x557c8a0b085BF18620eb01E1315Bdcd4d0d4bDC1"},"bearer":{"header":"Authorization: Bearer <key>","note":"See https://hexrailsec.io/agents for a Bearer key — bypasses x402 micropayment."}},"discovery":{"mcp":"https://hexrailsec.io/agents#mcp","mcp_npm":"@hexrailsec/mcp","api_docs":"https://hexrailsec.io/agents","agent_card":"https://hexrailsec.io/.well-known/agent-card.json","identity":"https://hexrailsec.io/api/agent/identity","live_feed":"https://hexrailsec.io/live","playground":"https://hexrailsec.io/playground","guard":"https://hexrailsec.io/guard/robinhood","guard_api":"https://hexrailsec.io/api/guard/robinhood/<address>","oracle_docs":"https://hexrailsec.io/oracle","oracle_address":"0x3afB3d63106eeB3575773C5fA13971d396cdB36e","watcher":"https://hexrailsec.io/watcher","watcher_feed":"https://hexrailsec.io/api/watcher/feed","watcher_health":"https://hexrailsec.io/api/watcher/health"},"integrations":{"mcp":{"available":true,"install":"Add `{\"command\":\"npx\",\"args\":[\"-y\",\"@hexrailsec/mcp@latest\"]}` to your Claude Desktop / Cursor / Cline config"},"github_app":{"available":true,"install":"https://hexrailsec.io/login"},"cli":{"available":true,"install":"npx -y @hexrailsec/cli@latest scan ."},"github_action":{"available":true,"install":"uses: hexrailsec/hexrail@v1"},"vscode":{"available":false,"install":"Coming soon — VS Code marketplace publish pending"}},"attestation_count":0,"public_receipt_attestation_count":0,"onchain_attestation_count":0,"links":{"health":"https://hexrailsec.io/api/health","badge":"https://hexrailsec.io/api/badge/{owner}/{repo}","docs":"https://hexrailsec.io/agents"},"usage_example":{"language":"bash","code":"# 1. Hit any endpoint without payment → get the 402 challenge\ncurl -sS -X POST https://hexrailsec.io/api/v1/scan \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\"source\":\"pragma solidity ^0.8.20; contract C {}\", \"filename\":\"C.sol\"}'\n\n# Returns: HTTP 402  +  X-PAYMENT-REQUIRED: <base64 PaymentRequirements>\n\n# 2. Sign x402 payment (Robinhood USDC or Solana USDC), retry:\ncurl -sS -X POST https://hexrailsec.io/api/v1/scan \\\n     -H \"Content-Type: application/json\" \\\n     -H \"X-PAYMENT: <base64 PaymentPayload>\" \\\n     -d '{\"source\":\"...\", \"filename\":\"C.sol\"}'\n\n# Returns: scan result + X-PAYMENT-RECEIPT (settlement proof) + EAS attestation UID"}}