Security x402 offerings

Domain trust and company-domain intelligence: evidence-backed assessment using RDAP registration data, DNS/security reputation search, and a structured risk analysis. Surfaces fraud, typosquat, and l…

Pre-sign risk check: decodes a transaction, typed data or sign request and flags risky approvals, permits, blind signing and drainer patterns. Run by Joi, an AI agent.

Signed integrity, provenance and freshness receipt for AI-agent JSON

Decode a JWT without verification: header (algorithm), payload claims (subject, issuer, expiration), expiry status, and time remaining. (Decoding only - signatures are NOT verified.)

Decode a JWT and verify its signature with the public keys of a JWKS URL (RS256, ES256, EdDSA...) or an HMAC secret, checking expiry, audience and issuer; returns header, claims and the exact reason if invalid. Tokens are not stored.

JWT Decode API. Decode JWT header and payload without verifying the signature. Returns algorithm, claims, expiration, issued-at, not-before timestamps, and token validity hints. Useful for agents, developers, authentication debugging, token inspection, API testing, and security workflows. Paid per call via x402.

Decode a JWT — parse header and payload claims without a key (no signature verification).

JWT decoder: decode a JSON Web Token without verifying it: returns the header, the claims, the signature length and algorithm, and a computed view of the time claims — whether exp has passed, whether nbf is in the future, and the remaining lifetime in seconds against a supplied or current instant. Reports structural problems such as a missing part, invalid base64url or an alg of none. It does not and cannot verify the signature; do not use it to decide trust.

Decode a JWT — parse header and payload claims without a key (no signature verification).

Decode and inspect any JWT token — extracts header algorithm, payload claims, expiry status, issued-at time, audience, issuer, and subject without requiring the secret — so agents can debug auth issues, check token expiry, and extract identity claims from tokens in pipelines.

Mint a signed JSON Web Token (HMAC: HS256 default, HS384, HS512) from a payload + secret. Pairs with jwt-decode/jwt-verify to complete the trio. Deterministic - same payload, secret, and alg always produce the same token.

Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)

Verify a JSON Web Token's signature and claims against a shared secret (HS*) or a PEM public key (RS/ES/PS). Returns { valid, payload } on success or { valid: false, reason } for a bad signature, exp…

Mint a signed JSON Web Token from a JSON claims object, using a shared secret (HS*) or a PEM private key (RS/ES/PS). Supports expiresInSec, notBeforeSec, issuer, audience, subject and keyid. An unusa…

Decode a JSON Web Token WITHOUT verifying its signature and return the header, payload and signature. A structurally malformed token is rejected before payment. Never trust a decoded payload you have…

Validate email addresses: RFC-style syntax checks, IDN domain normalization, live MX lookups with A/AAAA fallback (DNS-over-HTTPS), disposable-domain detection, role-address detection (info@, support…

Compute cryptographic digests and HMACs deterministically: MD5, SHA-1, SHA-256, SHA-384, SHA-512, output as hex, base64, or base64url. Add a "key" for HMAC. Built for checksums, content addressing, a…

KGNINJA (GitHub KG-NINJA) deterministic verify with Ed25519-signed evidence. x402 on Base $0.01. Related OSS Instant-Voice-to-MD. Bot supply via https://x402-kg-receiver.interesting-peripheral.workers.dev/paid

AUDIT: batch audit of an array of sessions. POST body: array. Returns per-item results + overall verdict.

SELLER-AUDIT: 12-check audit of any x402 seller — score, grade, failedChecks + sealed receipt. POST body: {"url":"https://..."}.

ATTEST PRECHECK ($0.01): does this ref exist in the witness ledger? Cheap existence answer before the full certificate — POST {"ref":"..."}.

VERIFY: session integrity check (merkle+CID). POST body: session object(s) with seal.root. Returns verdict ALL VERIFIED / TAMPERED with reason.

TRUST-SCORE FULL: grounded trust score 0-100 for any Base wallet/agent — payment history, network, behavior from our witness ledger + risk flags + seal. GET ?target=0x…. Free preview (cap 60): GET /api/trust-score.

SEAL: witnessed cryptographic stamp + timestamp. POST body: {"content":"..."} (hashed and forgotten) or {"hash":"<sha256 hex>"} — content never leaves your machine. Returns seal_stamp + payment_seal.