Security x402 offerings

Known-vulnerability check for a software dependency before installing it: queries the OSV.dev database (Google Open Source Vulnerabilities) for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist packages. Returns advisories with CVE aliases, severity, summary, fixed versions and reference links. Optional version narrows results to vulnerabilities affecting that exact version. Built for coding agents that install dependencies autonomously.

Agent payments have no chargeback. Paddock is pre-payment verification for AI agents. get_circular_signal reports the wash and circular-settlement signal per facilitator: flagged clusters, flagged volume and share, and the detection date.

Read all SMS messages received on a phone number you own or have shared access to.

Lease a cheap, instant, receive-only US phone number from a pool to receive one SMS verification code — the phone analogue of a disposable temp email inbox. $0.20 for 30 min (ttl_seconds, clamp 300–1800). Receive-only; call wait-otp to catch the code. Good for one-time verification on sites like Google/X/Discord; some (Telegram/WhatsApp/OpenAI) block VoIP numbers. Recycled — one-time codes only.

Validate exact UTF-8 SHA-256 hashes for up to 64 public or synthetic passages. No Unicode normalization, source authentication, or semantic validation.

Validate exact UTF-8 SHA-256 hashes for up to 64 public or synthetic passages. No Unicode normalization, source authentication, or semantic validation. New modular adapter: retained result recovery for 24 hours, minimal receipt metadata for 90 days. Existing live route unchanged.

Use when an agent must mint a secret and be able to justify its strength: strong random passwords from the platform CSPRNG, returned with their entropy in bits so the strength is a number and not an opinion. Four alphabets, one with no look-alike characters for anything a human has to read back or dictate. Do not use for ids that only need to be unique (/v1/util/uuid).

Generates passwords and reports their entropy for paid access.

Score a password's strength: character-set size, entropy bits, a 0–4 rating, and an estimated offline crack time. The password is never stored or logged.

Estimate password strength with Dropbox's zxcvbn: score 0-4, estimated guesses and crack time for online and offline attacks, weak patterns found (dictionary, dates, sequences...) and tips. Evaluated in memory, never stored or logged.

Estimate password strength: score, guesses, crack-time and feedback. Never stored.

Generate a secure random password (characters) or a wordlist passphrase.

Pay Guard: pre-payment allow/warn/block check for x402. Send your planned purchase (domain, max_price_usd, asset/network) plus the 402 challenge (payTo, amount, asset, network, resource). Returns verdict with wallet↔domain verification, price/asset/network checks, lookalike/URL safety, wash flags from Agentropolis, and a free OFAC SDN sanctions screen of payTo (a screen, not a certificate). Deterministic, no LLM.

Address-poisoning check before you send USDC on Base. Body {from, to} (or sender/recipient; chain=base, token=USDC only, others 400 not charged; optional contacts/known_addresses): scans the sender's…

Is this x402 API trustworthy? Body {url}. Returns its latest Kertivo Index endpoint trust score/grade (A, B, F, C-never-live, C-went-dark, or ungraded) and run date, plus evidence from a real paid te…

IP risk check for signups, logins and checkouts (IPv4 and IPv6): is the address in an embargoed country (Iran, North Korea, Syria, Cuba) or a heavily sanctioned one, a botnet control server, a Tor exit node, an anonymous proxy, a VPN, or on a cloud or hosting network rather than a home or mobile connection? Returns the country and network owner and a low, medium or high risk level with every signal explained.

Email risk check for signups and payouts. Nine deterministic signals, no AI scoring: mail server (MX), disposable or throwaway domain, free-mail provider, domain age, certificate history, typo-squats of major providers, role accounts, mail provider and a mailbox probe. Returns a low, medium or high risk level with every signal explained.

Counterparty reputation lookup for x402 payments: aggregated post-hoc reports (scam, non-delivery, prompt injection, overcharge, impersonation, replay abuse) filed by other agents, with distinct-reporter counts and risk level.

Counterparty reputation lookup for x402 payments: aggregated post-hoc reports (scam, non-delivery, prompt injection, overcharge, impersonation, replay abuse) filed by other agents, with distinct-reporter counts and risk level.

Payment security firewall scan for an OUTGOING x402 payment: PII/secret leak detection in payment metadata, nonce replay detection, overpayment detection, prompt-injection-triggered payment analysis (fast + deep tiers), canonical-USDC asset verification, merchant pinning, velocity/spend caps, and counterparty reputation cross-check. Returns allow/flag/block with per-check reasons and an Ed25519-signed verdict. Advisory and non-custodial.

Inspect HTTP response headers before an agent trusts or integrates a URL: content type, cache controls, CORS, HSTS, CSP, framing, referrer, permissions policy, server, ETag, and last-modified.

Resolve a URL redirect chain before an agent follows a link. Return the final URL, HTTP status, redirect count, and chain for URL verification and safe navigation.

Preflight an unfamiliar x402 paid API before spending. Validate the live 402 payment challenge, network, USDC asset, amount, payTo recipient, TLS, redirects, manifest presence, latency, and provenance. Returns deterministic GO/REVIEW/STOP and never signs or sends payment to the inspected seller.

Inspect telecom carrier, network codes, and line type (mobile vs. landline vs. VoIP burner fraud detection) via Twilio. Provide ?phone=+14157012311.