# Nyxor

> AI-assisted smart contract scanner. EVM wallet auth. Scan network and payment rail are separate. Payment uses one invoice address per checkout plus on-demand checks. No Stripe.

## API

- Developer docs: https://api.nyxor.org/docs
- Process docs: https://api.nyxor.org/docs/wallet-auth, https://api.nyxor.org/docs/draft-estimate, https://api.nyxor.org/docs/source-upload-git, https://api.nyxor.org/docs/payment-intent-check, https://api.nyxor.org/docs/job-progress
- Swagger UI: https://api.nyxor.org/docs/swagger
- OpenAPI JSON: https://api.nyxor.org/docs/openapi.json
- REST API: https://api.nyxor.org/api
- MCP endpoint: https://api.nyxor.org/mcp
- Receipt schema: /docs/receipt-schema.md
- Static AI review pipeline: /docs/static-ai-review-pipeline.md

## Endpoints

- GET /health
- GET /api/fixtures
- GET /api/networks
- GET /api/payments/config
- GET /api/payments/assets
- POST /api/auth/api-signature/challenge
- GET /api/repository-connections
- GET /api/repository-connections/github/start
- GET /api/repository-connections/gitlab/start
- GET /api/repositories
- POST /api/jobs
- PATCH /api/scans/:jobId/settings
- POST /api/jobs/:jobId/sources/upload
- POST /api/jobs/:jobId/sources/git
- PATCH /api/jobs/:jobId/sources/:sourceId/files
- POST /api/jobs/:jobId/deployments
- GET /api/jobs/:jobId/estimate
- POST /api/jobs/:jobId/payment-intents
- GET /api/payment-intents/:paymentId
- POST /api/payment-intents/:paymentId/check
- POST /api/jobs/:jobId/start
- POST /api/scans/estimate
- POST /api/scans/fixed
- GET /api/scans/:jobId
- GET /api/scans/:jobId/report
- GET /api/scans/:jobId/report.pdf
- GET /api/scans/:jobId/report.llm.zip
- GET /api/scans/:jobId/callgraph.json
- GET /api/scans/:jobId/callgraph.dot
- GET /api/scans/:jobId/callgraph.svg
- GET /api/scans/:jobId/tool-artifacts/:stepId
- GET /api/scans/:jobId/receipt
- GET /api/account/:address/balance
- GET /api/account/:address/identity
- POST /api/account/deposit-tx
- POST /api/account/withdraw-tx
- POST /api/account/:address/sync

## Payment

- Scan network is `networkId`; payment rail is `paymentRailId`.
- Rails: erc20-deposit, vechain-vtho-deposit, usdc-ethereum, usdc-base, usdm-megaeth, vtho-vechain-testnet, vtho-vechain-mainnet, btc-mainnet.
- Local/dev rail: erc20-deposit.
- Draft settings hold pipeline, retention, payment rail, and voucher before payment.
- GET /api/jobs/:jobId/estimate returns pipeline x rail estimates without changing draft status.
- Payment intents create or reuse one invoice receive address from saved draft facts.
- Payment checks verify one stored invoice only and obey Retry-After.
- Delayed fallback checks after 1h for EVM/VTHO and 4h for BTC.
- Account balance change: local stablecoin vault deposit/withdraw.
- Job naming is saved with PATCH /api/scans/:jobId/settings before checkout.
- Local network: megaeth-local on Anvil 31337. Prototype mode must not use public test xpubs for real mainnet funds.

## Rules

- No AI review means no source sent to AI.
- Uploaded ZIP and SOL sources support selectedPaths plus autoIncludeDependencies. Estimate and start use scanFilePaths.
- Public GitHub sources are manifest-inspected before estimate so file count, size, and AI pricing reflect repo files.
- The deterministic scanner is the scan engine. The static TypeScript AI pipeline reviews, validates, dedupes, and explains scanner artifacts.
- Scanner containers do not receive provider or Cloudflare AI Gateway secrets.
- Public Git only; no Git credentials.
- No card payments.
- Agents must not hold private keys.
- Developer API auth uses short-lived wallet signature header, not browser cookies.
- API CORS accepts all origins for header-auth clients.
- API returns unsigned transaction data for account balance actions.
- External payment starts happen from confirmed invoices; API users call `/api/payment-intents/:paymentId/check`.
- Report and receipt reads require the signed owner wallet.
- LLM report ZIP downloads require owner or collaborator wallet access and include prompt, manifest, and severity-numbered issue files.
- Tool artifact downloads require the signed owner wallet and return per-step verification JSON.
- OpenAPI docs are generated from shared TypeScript/Zod request schemas and route metadata.
- MCP private tools require the same NyxorWallet Authorization header and wallet scopes as REST.
- MCP exposes authenticated report and receipt summaries. Binary report.llm.zip stays REST download.