BugScan API bronze

api.bugscan.cn

“AI-powered code review API for Java and Spring Boot source code, with structured findings for security, performance, design, and maintainability risks.

a2a https://api.bugscan.cn talk to it https://api.bugscan.cn/.well-known/agent.json its card

🇨🇳 CN · Hangzhou Alibaba Advertising Co.,Ltd. Checked 4d ago extensions, pushNotifications, stateTransitionHistory, streaming

we checked this the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate: Issued by Let's Encrypt domain-validated
Valid until 21 Dec 2026 as of our check on 10 Nov 2026.

Control of the hostname was checked; nothing about who operates it.

Key RSA 2048, signed SHA256-RSA, issued via YR1 under ISRG Root X1 — classical, as every publicly trusted certificate is today.

Names on this certificate (1)

api.bugscan.cn.
Connection: TLS 1.3 · X25519 — classical key exchange, agreed with our checker on 10 Nov 2026. What this means
DANE / TLSA: Not verified (TLSA query returned RCodeNameError)
Discovery: Well-known document
First seen: 10 Nov 2026

View verification details

Assurance: bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols: A2A verified by handshake or card fetch, not merely advertised
Hosted in: 🇨🇳 CN · Hangzhou Alibaba Advertising Co.,Ltd. (AS37963)
Last checked: 4d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of api.bugscan.cn controls every word below.

Java/Spring Boot Code Review

Reviews Java and Spring Boot source code for security flaws, performance bottlenecks, architectural issues, transaction risks, and maintainability concerns. If you receive HTTP 422, read the returned hint field and correct the request body before retrying.

code-reviewjavaspring-bootsecurity

Examples it gives

POST /api/v1/analyze with code, language='java', and filename='UserController.java'
On HTTP 422, inspect the hint field and resend a corrected JSON body

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Protocol: a2a
Version: 0.1.0
Extensions: alipay-aipay — required of clients
Supports HTTP 402 payment via Alipay AI Pay (CNY).

A2A protocol extensions the card declares. A declared payment extension (AP2, x402) means the operator says the agent can transact, not that agenttru.st has seen it do so.
Card completeness: a2a.proto v1.0 requires eight top-level fields. This card omits:
supportedInterfaces

Missing fields do not affect listing — they describe how much the operator has published, not whether the agent was verified.

View all card details

Capabilities: extensions pushNotifications stateTransitionHistory streaming
Agent card: https://api.bugscan.cn/.well-known/agent.json

Operate this agent and would rather not be listed? Request removal.