python-code-validator

version 1.19.0 · API v1

Validates, repairs and hardens AI-generated Python: syntax and lint diagnostics, security scanning (bandit, AST policy, credential scan), deterministic auto-fixes and optimisation via SMIRE, optional sandboxed execution and Python-to-JavaScript transpilation.

code-validationpython-syntaxsecurity-scancode-repaira2a

What it does

Autonomous agents generate code faster than anyone can review it. This service is the reviewer: it parses the submitted code, scans it against a security policy that also catches calls hidden behind dynamic imports and runtime attribute lookups, repairs what can be repaired deterministically, and only then reports a verdict with a score. Nothing is executed unless the caller explicitly asks for execute mode, and then only inside a sandbox.

Languages accepted: python.

Modes

Mode	Behaviour
`static`	Never runs the code. Parsing, linting, security scanning and a score.
`repair`	Static, plus deterministic auto-fixes; a local model handles what is left.
`execute`	Repair, plus running the code in a locked-down container to prove it works.

Endpoints

	Path	Purpose
`POST`	`/v1/validate`	Validate, repair or run a snippet. Needs an API key.
`POST`	`/v1/keys`	Mint a free-tier key. No account, no payment.
`POST`	`/mcp`	Model Context Protocol endpoint for coding agents. Needs an API key.
`GET`	`/v1/info`	Machine-readable description, including the JSON schemas.
`GET`	`/v1/client`	The CI client, ready to run with python3. No install.
`POST`	`/a2a`	Agent-to-agent JSON-RPC entry point. Needs an API key.
`GET`	`/.well-known/agent.json`	A2A agent card for discovery.
`GET`	`/docs`	Interactive OpenAPI documentation.
`GET`	`/v1/stats`	Uptime, workers, calls in progress and totals.
`GET`	`/v1/changelog`	What changed in the version that answers.
`GET`	`/healthz`	Liveness probe.
`GET`	`/metrics`	Prometheus metrics.

Get a key

The free tier is self-service and needs no account: one POST returns a key that is good for a daily allowance of static validations. Paid keys lift the limit and unlock repair and execute.

curl -s -X POST https://api.statemind.ai/v1/keys
# {"api_key": "msvc_free_...", "calls_per_day": 100, "modes": ["static"]}

Try it

curl -s https://api.statemind.ai/v1/validate \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"language": "python", "mode": "static", "code": "import os\nos.system(\"id\")\n"}'

Requests without a valid key are rejected with 401, a spent free key with 429, and a mode the free tier does not cover with 402. Every answer carries x-quota-remaining.

Use it from a coding agent

The same validator is an MCP server, so Claude Code, Cursor, Windsurf, VS Code and anything else that speaks MCP over HTTP can call it as a tool. Drop this in the client's MCP configuration:

{
  "mcpServers": {
    "python-code-validator": {
      "url": "https://api.statemind.ai/mcp",
      "headers": { "Authorization": "Bearer msvc_free_..." }
    }
  }
}

Agent-to-agent callers instead read the agent card and post to /a2a.

Use it in CI

The same checks run over the changed files of a pull request. The client is standard library only and the service hands it out, so there is nothing to install and no secret to configure — it mints its own free key. Findings are printed as GitHub annotations, so they land on the diff.

curl -sf https://api.statemind.ai/v1/client -o validate.py
python3 validate.py --changed-against origin/main
# ::error file=service.py,line=88,title=SyntaxError::invalid syntax

Pay per call, on-chain

The same validator answers requests on the Olas Mech Marketplace, so an agent with a wallet needs no key and no account. Name this mech as the priority mech, or the marketplace routes the request to someone else:

pip install mech-client
mechx request \
  --prompts '{"code": "import os\nos.system(\"id\")\n"}' \
  --tools python_code_validator \
  --priority-mech 0x2D64FEE808Fba217aee1210e3574432C31EdcdAB \
  --chain-config gnosis

The verdict comes back through the marketplace and is pinned on IPFS, which makes both the submitted code and the verdict public — use the HTTP API for anything you would rather keep private.