Python Code Validator

python-code-validator

version 1.28.0 · API v1

Proves AI-generated Python does what you asked: syntax, lint, types, an AST security policy and a credential scan, then runs the code in a throwaway container against the examples you state and repairs it until they pass — returning a fix only when running it satisfies every one of them.

code-validationintent-checksecurity-scancode-repairsandboxed-executiona2a

What it does

Autonomous agents generate code faster than anyone can review it, and the code they get wrong usually parses, lints, type-checks and runs — it just computes the wrong answer. So this service asks the one question the checkers cannot: say what the code was supposed to do, as examples, and it runs the code against them in a throwaway container with no network and a read-only filesystem. A fix comes back only when running it satisfies every example.

{"code": "def bitcount(n): …", "mode": "execute",
 "options": {"examples": "assert bitcount(127) == 7"}}
# → valid: false, python:example-mismatch, and fixed_code once it holds

On the QuixBugs defect set — real bugs nobody here invented, correctness decided by hidden test inputs — that repairs 41% and refuses 77% as not doing what they say, with no false alarms on the corrected programs, whereruff and mypy flag the defect in none of them (the numbers). Everything else it reports is static: parsing, linting, types, an AST security policy that also catches calls hidden behind dynamic imports and runtime attribute lookups, and a credential scan. Nothing runs unless the caller asks forexecute.

Asking the same question twice is free: an identical call from the same key inside ten minutes is answered from the answer it already got (x-msvc-repeat: 1) and charged nothing, so an agent can check its work at every step without paying for verdicts that cannot have changed.

Languages accepted: python.

Modes

Mode	Behaviour
static	Never runs the code. Parsing, linting, types, security, credentials, a score.
repair	Static, plus the corrected source for what can be fixed without running it.
execute	Runs the code in a throwaway container and checks it against your examples.

Endpoints

Path	Purpose
POST	/v1/validate	Validate, repair or run a snippet. Needs an API key.
POST	/v1/keys	Mint a free-tier key. No account, no payment.
POST	/mcp	Model Context Protocol endpoint for coding agents. Needs an API key.
GET	/v1/info	Machine-readable description, including the JSON schemas.
GET	/v1/client	The CI client, ready to run with python3. No install.
POST	/a2a	Agent-to-agent JSON-RPC entry point. Needs an API key.
GET	/.well-known/agent.json	A2A agent card for discovery.
GET	/docs	Interactive OpenAPI documentation.
GET	/v1/stats	Uptime, workers, calls in progress and totals.
GET	/v1/changelog	What changed in the version that answers.
GET	/healthz	Liveness probe.
GET	/metrics	Prometheus metrics.

Get a key

The free tier is self-service and needs no account: one POST returns a key that is good for a daily allowance of static validations. Paid keys lift the limit and unlock repair and execute.

curl -s -X POST https://api.statemind.ai/v1/keys
# {"api_key": "msvc_free_...", "calls_per_day": 100, "modes": ["static"]}

Credits cost 2 cents each and can be bought with a card: this answers with a payment page, and the credits land on the key as soon as it clears — no invoice, no account, nobody to ask. An agent with a wallet can pay on-chain instead; see /v1/pricing.

curl -s -X POST https://api.statemind.ai/v1/keys/checkout \
  -H 'content-type: application/json' \
  -d '{"api_key": "<your key>", "credits": 500}'

Try it

curl -s https://api.statemind.ai/v1/validate \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"language": "python", "mode": "static", "code": "import os\nos.system(\"id\")\n"}'

Requests without a valid key are rejected with 401, a spent free key with 429, and a mode the free tier does not cover with402. Every answer carries x-quota-remaining.

Use it from a coding agent

The same validator is an MCP server, so Claude Code, Cursor, Windsurf, VS Code and anything else that speaks MCP over HTTP can call it as a tool. Drop this in the client's MCP configuration:

{
  "mcpServers": {
    "python-code-validator": {
      "url": "https://api.statemind.ai/mcp",
      "headers": { "Authorization": "Bearer msvc_free_..." }
    }
  }
}

Agent-to-agent callers instead read the agent card and post to /a2a.

Use it in CI

The same checks run over the changed files of a pull request. The client is standard library only and the service hands it out, so there is nothing to install and no secret to configure — it mints its own free key. Findings are printed as GitHub annotations, so they land on the diff.

curl -sf https://api.statemind.ai/v1/client -o validate.py
python3 validate.py --changed-against origin/main
# ::error file=service.py,line=88,title=SyntaxError::invalid syntax

Pay per call, on-chain

The same validator answers requests on the Olas Mech Marketplace, so an agent with a wallet needs no key and no account. Name this mech as the priority mech, or the marketplace routes the request to someone else:

pip install mech-client
mechx request \
  --prompts '{"code": "import os\nos.system(\"id\")\n"}' \
  --tools python_code_validator \
  --priority-mech 0x2D64FEE808Fba217aee1210e3574432C31EdcdAB \
  --chain-config gnosis

The verdict comes back through the marketplace and is pinned on IPFS, which makes both the submitted code and the verdict public — use the HTTP API for anything you would rather keep private.