One HTTP endpoint to scan code, detect vulnerabilities, and generate AI-powered fixes. Drop into any CI/CD pipeline, AI agent, or developer tool in minutes.
# Scan a code snippet for vulnerabilities
curl -X POST https://api.sphior.com/v1/scan \
-H "Authorization: Bearer sk_live_..." \
-d '{"code":"SELECT * WHERE id='{req.id}'","language":"sql"}'
# Response
{
"findings": [{
"type": "sql_injection", "severity": "critical",
"cvss": 9.8, "fix": "Use parameterized queries"
}],
"ai_calls": 1, "latency_ms": 143
}200+
Security rules
<200ms
Median latency
7
Languages supported
99.9%
Enterprise SLA
Integrate SPHIOR AI wherever code lives and moves.
Scan every pull request and commit automatically. Block merges when critical vulnerabilities are detected before they reach production.
# .github/workflows/security.yml
- name: SPHIOR AI Scan
run: |
curl -sX POST https://api.sphior.com/v1/scan \
-H "Authorization: Bearer ${{ secrets.SPHIOR_KEY }}" \
-d '{"ref": "${{ github.sha }}", "repo": "${{ github.repository }}"}'Give your AI agents real-time security intelligence. Validate generated code before execution. Prevent prompt injection and insecure output.
// LangChain / any AI agent
import { SphiorSecurityTool } from "@sphior/sdk";
const securityTool = new SphiorSecurityTool({ apiKey: process.env.SPHIOR_KEY });
// Validate AI-generated code before running
const result = await securityTool.scan({ code: generatedCode, language: "python" });
if (result.critical_count > 0) throw new Error("Unsafe code detected");Embed security scanning into your internal developer platform, custom IDE plugins, or code review tools with a single HTTP endpoint.
// VS Code extension / internal dev platform
const findings = await fetch("https://api.sphior.com/v1/scan", {
method: "POST",
headers: { Authorization: `Bearer ${apiKey}` },
body: JSON.stringify({ code: editor.selection, language: "typescript" }),
}).then(r => r.json());
showInlineAnnotations(findings.findings);Multi-layered analysis combining deterministic rules with AI reasoning for near-zero false positives.
Rule-based pre-filter + AI only on flagged code. Median latency 180ms. P99 under 800ms.
SQLi, XSS, SSRF, path traversal, secret leakage, insecure deserialization, and 200+ custom rules.
JavaScript, TypeScript, Python, Go, Java, Ruby, PHP. More on request.
Your code is analyzed in memory and never used for AI training. We retain only findings — and, for fixes you request, the snippet needed to generate them. SOC 2 compliant architecture.
SPHIOR AI Pro generates context-aware patches with explanation, CVSS score, and remediation steps.
Real-time call counts, spend tracking, and per-key spend caps to prevent bill shock.
TypeScript, Python SDKs available. Or call the plain REST API from any language.
Low monthly platform fee + pay only for what you use.
No scan limits. No quota anxiety. Spend caps available.
Free
platform fee + usage
Developer
platform fee + usage
Business
platform fee + usage
Enterprise
platform fee + usage
| Operation | Free | Developer | Business | Enterprise |
|---|---|---|---|---|
| Rule scan | $0.0005 / call | $0.0005 / call | $0.0003 / call | $0.0001 / call |
| SPHIOR AI scan | $0.04 / call | $0.04 / call | $0.06 / call | $0.08 / call |
| SPHIOR AI fix | $0.04 / call | $0.04 / call | $0.06 / call | $0.35 (Pro) / call |
Volume discounts apply at 10K, 50K, and 200K calls/month. Spend caps available on all plans.
Free to start. No credit card required.