Security x402 offerings

Check an email address before sending: syntax, whether the domain exists and accepts mail (MX records), disposable or free-mail provider, role account (info@, support@), and a verdict.

Check text before your agent reads or forwards it: prompt-injection attempts aimed at AI readers, and contact details (emails, phones, handles, links). Returns flags, a risk level and a cleaned copy.

Remove personal information from a text before your agent stores or shares it: emails, phone numbers, names, street addresses, IDs and card numbers are replaced with labels.

Cryptographically secure random integers in a range you choose (unbiased), up to 1,000 per call.

Decode a JWT without verifying it: header (algorithm, key id), payload claims, and issued, not-before and expiry times with whether it is expired now.

Hash a text with SHA-256, SHA-384, SHA-512 or SHA-1: hex and base64 digests, for checksums, deduplication and content fingerprints.

DNS and email-security check of a domain: A, AAAA, MX, NS, TXT and CAA records, plus SPF and DMARC presence and policy, with plain findings (e.g. 'no DMARC: mail can be spoofed').

Agent-tier preview of the AI-visibility check: live pass/fail scan of the actual website — robots.txt AI-crawler blocks (GPTBot, ClaudeBot, PerplexityBot, Google-Extended + 10 more), llms.txt presence, Schema.org structured data, sitemap presence — plus a deterministic grade. No fix plan, no prioritization, no evidence rows (those are in the $0.50 full check). Any domain, any country.

Compute a deterministic similarity key for a name or address: the cheap first step of client-side blocking and deduplication. Records that share a key are duplicate candidates to confirm. Returns the key, the normalized form and the tokens. Indicators, not authoritative identity resolution.

x402 Doctor checkup of your own endpoint: payment request, prices, payTo and response time; once you prove you own the host (publish the token from /v1/doctor/verify at /.well-known/x402-doctor.txt), also a leak check: does it serve data without payment.

Analyze operation-level risk inside consolidated MCP tools. Returns evidence-backed ALLOW, DENY, or REQUIRE_APPROVAL decisions, retry semantics, schema-drift status, and a deterministic operation effect ID. Designed for MCP tools whose command/action arguments expose operations with different risk levels.

Health-check and tool-schema inspection for any public MCP server before you rely on it.

Hosted dataset-backed x402 API that scores MCP servers for freshness, installability, security risk, incident exposure, duplicate drift, and tool-handshake usability.

Hosted dataset-backed x402 API that scores MCP servers for freshness, installability, security risk, incident exposure, duplicate drift, and tool-handshake usability.

Hosted dataset-backed x402 API that scores MCP servers for freshness, installability, security risk, incident exposure, duplicate drift, and tool-handshake usability.

Security scan of a target MCP server: audits every advertised tool for prompt-injection / tool-poisoning / exfiltration / dangerous-capability / hidden-unicode (OWASP LLM01/LLM08). Returns findings + risk score + verdict (clear/review/block).

MCP tool risk scorer for agents: scans a tool JSON description for shell, filesystem, network and secret-access capabilities.

Static security scan of a single text or prompt blob: hidden unicode, prompt injection, data-exfiltration directives, dangerous-capability and tool-shadowing language, and obfuscation. Returns a 0-100 risk score, category and findings. Security indicators, not a guarantee.

Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee.

Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee.

Security audit for an EVM token: rug-pull, honeypot, and trading risk signals.

Wallet and counterparty risk check before an agent sends funds or grants approvals.

URL safety preflight: screen a link before an agent opens it — syntax, host/IP, patterns, redirects, optional threat intelligence.

Health-check and tool-schema inspection for any public MCP server before you rely on it.