Security x402 offerings

npm package safety gate: vulnerabilities, malware advisories, typosquatting, install-script risk.

Prompt-injection and manipulation scan for untrusted text, HTML, email, and tool output.

Statically analyse a Model Context Protocol (MCP) server manifest for security risks. Tool descriptions enter the model context, a prime prompt-injection vector. Deterministic and offline (inline man…

MD5 digest of text or raw bytes — Genesis402 / UnyKorn Operator Network

Certified extract of one Middle Eastern reference value (policy rate, VAT, minimum wage, statutory interest, tax rates and more, 9 Middle Eastern countries): the value and its citation, sha256 of the archived official source and the verification chain, Ed25519-signed for audit and compliance files. Refused without charge when no archived evidence exists. GET /v1/certified/{country}/{series}.

Compare Flag fast, short and text-heavy cues for explicit editorial review. against a bounded caller-supplied previous snapshot and return exact change witnesses. Baseline is caller supplied and is never authenticated as historical server output. Pure bounded timing/source-quote validation runs before payment. Exactly one current motor call, zero baseline provider calls. Full current provider disclosure retained; baseline is not submitted to the provider.

Compare Locate caller-specified literal redaction strings; no semantic PII detection. against a bounded caller-supplied previous snapshot and return exact change witnesses. Baseline is caller supplied and is never authenticated as historical server output. Pure bounded timing/source-quote validation runs before payment. Exactly one current motor call, zero baseline provider calls. Full current provider disclosure retained; baseline is not submitted to the provider.

Compare Timestamped source search for loading discussion wording; literal vocabulary only. against a bounded caller-supplied previous snapshot and return exact change witnesses. Baseline is caller supplied and is never authenticated as historical server output. Pure bounded timing/source-quote validation runs before payment. Exactly one current motor call, zero baseline provider calls. Full current provider disclosure retained; baseline is not submitted to the provider.

Compare Cross-reference subtitle cues with contained source words and flag label mismatch. against a bounded caller-supplied previous snapshot and return exact change witnesses. Baseline is caller supplied and is never authenticated as historical server output. Pure bounded timing/source-quote validation runs before payment. Exactly one current motor call, zero baseline provider calls. Full current provider disclosure retained; baseline is not submitted to the provider.

Compare Separate provider confidence bands from unknown confidence values. against a bounded caller-supplied previous snapshot and return exact change witnesses. Baseline is caller supplied and is never authenticated as historical server output. Pure bounded timing/source-quote validation runs before payment. Exactly one current motor call, zero baseline provider calls. Full current provider disclosure retained; baseline is not submitted to the provider.

Diagnose a public x402 origin with 25 linter and 14 compliance checks, plus six separate request-example/schema and challenge consistency diagnostics. Use quote_mode fast for an immediate 402, resend unchanged input with one payment proof, then poll using the returned capability. Successful reports are stored before settlement. Examples are checked offline, never replayed; unsupported schemas stay unknown. No target payment, paid-delivery verification or safety guarantee.

Tamper-evident history of changes to a namespace - a hash-chained audit log the server attests to (provenance an agent can't forge for itself). Entries are kept for a bounded window (see retention in the answer), and an entry naming a key or document that was later deleted is redacted while still linking the chain.

The csrf-token meta tag of a page: whether it is present and its content (name= or property= form), plus length and a note when the value looks wrong (empty, too long, or a placeholder). One tag, one answer, for SEO and social-preview checks. $0.01 per page.

Builder Inclusion Analyzer analyses only the evidence supplied by the caller. It does not claim to query a chain, identify a legal status or replace an independent audit. Missing signals lower confidence and are listed explicitly; every classification includes the exact thresholds used.

MIME type for .cer files: application/x-x509-ca-cert. Returns the Content-Type to send, the category, whether browsers render it inline, whether it is compressible, common magic bytes and related extensions. Set headers and validate uploads for .cer correctly. $0.01 per call.

MIME type for .crt files: application/x-x509-ca-cert. Returns the Content-Type to send, the category, whether browsers render it inline, whether it is compressible, common magic bytes and related extensions. Set headers and validate uploads for .crt correctly. $0.01 per call.

Weigh any x402 counter and get a verdict: does its URL answer a coherent 402, would the CDP Bazaar validator accept its discovery metadata, and is it actually listed in the discovery index? Returns a per-check report (passed / found-wanting / unweighed) with evidence, optionally HMAC-signed. Three keyless checks for sellers and machine-service buyers.

Chain-of-custody license certificate for any digital asset: a SHA-256 content hash bound to issuer, subject, and license terms under an HMAC-SHA-256 signature. Deterministic, portable, and verifiable through the issuer while the current HMAC v1 profile is active — a receipt an agent can carry to record what it licensed, from whom, and on what terms.

Chain-of-custody license certificate for any digital asset: a SHA-256 content hash bound to issuer, subject, and license terms under an HMAC-SHA-256 signature. Deterministic, portable, and verifiable…

HTTP header analysis. 🆓 5 free trial calls per signed wallet

reCAPTCHA v2/v3, hCaptcha, Turnstile. Paid per call via x402 in USDC on Base. No free trial — every call spends a prepaid solver balance.

Combined domain check: SSL cert validity (issuer, expiry, days remaining) + HTTP headers. Two checks, one call. $0.005/call, 5 free trials.

HTTP header analysis. 🆓 5 free trial calls per signed wallet

Combined domain check: SSL cert validity (issuer, expiry, days remaining) + HTTP headers. Two checks, one call. $0.01/call, 5 free trials. 🆓 5 free trial calls per signed wallet