Python Code Validator

python-code-validator

version 1.0.0 · API v1

Validates, repairs and hardens AI-generated Python: syntax and lint diagnostics, security scanning (bandit, AST policy, credential scan), deterministic auto-fixes and optimisation via SMIRE, optional sandboxed execution and Python-to-JavaScript transpilation.

code-validationpython-syntaxsecurity-scancode-repaira2a

What it does

Autonomous agents generate code faster than anyone can review it. This service is the reviewer: it parses the submitted code, scans it against a security policy that also catches calls hidden behind dynamic imports and runtime attribute lookups, repairs what can be repaired deterministically, and only then reports a verdict with a score. Nothing is executed unless the caller explicitly asks forexecute mode, and then only inside a sandbox.

Languages accepted: python.

Status

• **…**service
• **…**workers
• **…**in progress
• **…**validations
• **…**free tier
• **…**paid
• **…**last job

Loading…

Modes

Mode	Behaviour
static	Never runs the code. Parsing, linting, security scanning and a score.
repair	Static, plus deterministic auto-fixes; a local model handles what is left.
execute	Repair, plus running the code in a locked-down container to prove it works.

Endpoints

Path	Purpose
POST	/v1/validate	Validate, repair or run a snippet. Needs an API key.
POST	/v1/keys	Mint a free-tier key. No account, no payment.
POST	/mcp	Model Context Protocol endpoint for coding agents. Needs an API key.
GET	/v1/info	Machine-readable description, including the JSON schemas.
GET	/v1/client	The CI client, ready to run with python3. No install.
POST	/a2a	Agent-to-agent JSON-RPC entry point. Needs an API key.
GET	/.well-known/agent.json	A2A agent card for discovery.
GET	/docs	Interactive OpenAPI documentation.
GET	/v1/stats	Uptime, workers, calls in progress and totals.
GET	/healthz	Liveness probe.
GET	/metrics	Prometheus metrics.

Get a key

The free tier is self-service and needs no account: one POST returns a key that is good for a daily allowance of static validations. Paid keys lift the limit and unlock repair and execute.

curl -s -X POST https://api.statemind.ai/v1/keys
# {"api_key": "msvc_free_...", "calls_per_day": 100, "modes": ["static"]}

Try it

curl -s https://api.statemind.ai/v1/validate \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"language": "python", "mode": "static", "code": "import os\nos.system(\"id\")\n"}'

Requests without a valid key are rejected with 401, a spent free key with 429, and a mode the free tier does not cover with402. Every answer carries x-quota-remaining.

Use it from a coding agent

The same validator is an MCP server, so Claude Code, Cursor, Windsurf, VS Code and anything else that speaks MCP over HTTP can call it as a tool. Drop this in the client's MCP configuration:

{
  "mcpServers": {
    "python-code-validator": {
      "url": "https://api.statemind.ai/mcp",
      "headers": { "Authorization": "Bearer msvc_free_..." }
    }
  }
}

Agent-to-agent callers instead read the agent card and post to /a2a.

Use it in CI

The same checks run over the changed files of a pull request. The client is standard library only and the service hands it out, so there is nothing to install and no secret to configure — it mints its own free key. Findings are printed as GitHub annotations, so they land on the diff.

curl -sf https://api.statemind.ai/v1/client -o validate.py
python3 validate.py --changed-against origin/main
# ::error file=service.py,line=88,title=SyntaxError::invalid syntax