ContractScan API documentation (plain text)
============================================
Base URL: https://contract-scan.dev
ContractScan is automated static analysis (Slither + Aderyn + rug-pattern heuristics) with AI explanations. NOT AN AUDIT.

Limits
------
- Single-file Solidity (flattened files are fine), max 2,000 lines / 250 KB.
- Imports: only @openzeppelin/contracts/... (v4.9.6 or v5.7.0, pinned vendored copies; `@openzeppelin/contracts@4.9.3/` style pins select the major). Other imports: flatten first.
- Supported compilers: 0.8.0 - 0.8.30 (chosen from your pragma), all pre-installed.
- Findings in OpenZeppelin library code are not reported; only your file is.
- Code is compiled and statically analysed in a network-less sandbox. It is never executed.
- Free tier: 3 scans per day per IP (verdict + top 3 findings, no patch).

POST /api/scan
--------------
Request:  Content-Type: application/json
          {"source": "<solidity source>"}
Optional header: X-CS-Code: CS-XXXX-XXXX-XXXX-XXXX   (redeem code -> full report + patch, uses 1 credit)
Response 200 (JSON), main fields:
  verdict          "deployable" | "fix_first" | "do_not_deploy"   (computed from tool findings, never by the AI)
  verdict_label    {"en": "...", "zh": "..."}
  counts           {"high": n, "medium": n, "low": n, "info": n}
  findings[]       tool, id, severity, title, detail, lines[], explain_en, explain_zh
  findings_hidden  number of findings not shown on the free tier
  summary          {"en": "...", "zh": "..."} AI summary (may be null)
  patch            patched source (full tier only, shown only if it passes a re-scan with no high/medium findings)
  disclaimer       {"en": "...", "zh": "..."}
  scan_id          id you can reference in feedback
Errors: 400 invalid input / compile error (not charged), 402 free limit reached (body contains payment info).

Example:
  curl -s -X POST https://contract-scan.dev/api/scan -H 'content-type: application/json' \
       -d '{"source":"// SPDX-License-Identifier: MIT\npragma solidity 0.8.24;\ncontract A {}"}'

Payments (USDC on Base, no signatures)
--------------------------------------
GET  /api/pricing                    -> prices, recipient address, USDC contract, network
1. Send a USDC transfer on Base (chain id 8453) to the recipient from /api/pricing. $3 = 1 full scan, $10 = 5.
   Amounts below $3 grant no credits (flagged for manual refund review).
2. POST /api/pay/claim {"tx_hash": "0x..."}  -> {"code": "CS-....", "credits": n}
   Needs 3 confirmations; "retryable": true errors mean try again shortly. The same tx returns the same code
   for 1 hour after the first claim; after that contact support.
3. POST /api/code {"code": "CS-..."}      -> remaining credits
x402 endpoints (POST /api/x402/scan $0.25, /api/x402/scan-full $1.50) are not enabled on mainnet yet.

Feedback
--------
POST /api/feedback {"scan_id": "...", "useful": true|false, "comment": "optional, max 1000 chars"}

MCP server (stdio)
------------------
Tool: scan_contract(source: string) -> JSON string with the same report as /api/scan (free tier, rate-limited per caller).
Run locally from the source distribution: python mcp_server.py

Source code (MIT): https://github.com/contractscan-dev/contractscan
Support: support@contract-scan.dev · X: https://x.com/ContractScanDev