Security x402 offerings

Batch install-safety preflight for a whole dependency list or parsed manifest (up to 100 packages). Returns a verdict per package plus a blocked / caution / safe summary. Supply-chain indicators, not a guarantee.

Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.

Call before installing or updating an npm or PyPI dependency. Returns a verdict (ok, caution, avoid, unknown) plus evidence signals: install script added, maintainer or publisher change, very recent publish, build provenance dropped, known malware and vulnerability advisories. A clean result is not a guarantee of safety.

Scan a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with a link to a lockfile on GitHub, GitLab or Bitbucket, the file pasted in, or a components array, and get per-dependency verdicts (malicious, vulnerable, suspicious, clean) from OSV.dev and the OpenSSF Malicious Packages feed. Pay per request in USDC; no account, no API key.

Detect and redact PII in text: find and mask names, addresses, SSNs, emails, and phone numbers. POST /v1/pii with {text} and get findings and masked output as one JSON object. Deterministic per ruleset version. Pay per request in USDC; no account, no API key.

Dependency health across PyPI, npm, Go, Cargo, Maven, Composer, and NuGet via deps.dev and OSV: versions, licenses, and known vulnerabilities. POST /v1/tool with {package, ecosystem}, or GET /v1/package for the Bazaar listing. Deterministic per advisory state. Pay per request in USDC; no account, no API key.

Check a URL for phishing signs without fetching it: raw IP hosts, punycode, user@host, credential words in the host, very long hosts and deep subdomains. The verdict is suspicious or unknown, never clean, because no threat database is consulted; the response says what ran. POST /v1/reputation with {url}. Pay per request in USDC; no account, no API key.

Recent IPs caught probing Polyform's honeypot paths (credential/vuln scanners) — Polyform's own first-party telemetry, not a repackaged public list. Returns up to 500 most-recent scanner IPs with first-seen. For blocklists and threat research. JSON.

Give this API a hostname or IP address and it tries connecting to each port in your requested range. For every port that answers it reports whether it is open or blocked, which service is likely runn…

Renews access to an identity verification result. Present your last read credential to get a fresh one and keep collecting the evidence pack until the data is deleted.

Pay-per-use identity verification. Issues a capture link for one person to complete an ID document photo and a selfie with liveness and face-match checks. The response includes the outcome URL and a read credential, and no account is needed to read the result. Poll for free to collect the full evidence pack for your onboarding or underwriting decision.

Decodes (does not verify) a JWT by base64url-decoding its header and payload segments. Signature validity is never checked — do not use this to authenticate a token.

SHA-256 hash generator API. Computes the SHA-256 hex digest of any text. Deterministic and instant — an LLM cannot reliably compute real cryptographic hashes on its own.

Secure password generator API. Generates a cryptographically random password — true randomness an LLM cannot produce on its own. Accepts optional length (8-128), per-character-class toggles (uppercas…

MD5 hash generator API. Computes the MD5 hex digest of any text. Deterministic and instant — an LLM cannot reliably compute real cryptographic hashes on its own.

A Quality Gate For Prompts. Before they break production. Score any AI prompt against 8 dimensions, see what's weak, and get the fixed version in seconds.

A Quality Gate For Prompts. Before they break production. Score any AI prompt against 8 dimensions, see what's weak, and get the fixed version in seconds.

One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and findings with severity, file, line and a fix hint. One call instead of slicing the diff into several. Security indicators, not a guarantee.

One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and findings with severity, file, line and a fix hint. One call instead of slicing the diff into several. Security indicators, not a guarantee.

pre-deploy-security-checklist.zip — 18-Point Pre-Deploy Security Checklist — editable Markdown checks for secrets, authentication, data handling, dependencies, infrastructure, rollback, and sign-off.

Check execution risk before placing a crypto trade. Submit a visible order book, trade side and notional; receive PASS, CAUTION or AVOID with estimated slippage, spread, fill ratio, visible liquidity and depth utilization. Built for autonomous trading agents that need a fast pre-trade liquidity and execution-risk check. Read-only: never places orders, accesses exchange accounts or gives investment advice.

Is this transaction, token approval or signature safe to sign? Check it before your AI agent or wallet signs it: pre-sign verdict (green/orange/red + reason codes) for EVM and Solana transactions, token approvals and Permit/Permit2/EIP-3009/Seaport signatures. Screens the spender or recipient wallet for OFAC sanctions and scam, phishing or theft reports, and flags unlimited allowances, plain-wallet spenders and risky tokens. Bulk: 100 checks for $0.80 via /v1/credits.

Is this transaction, approval or signature safe to sign, explained for a person? The same pre-sign verdict as /v1/check (green/orange/red + reason codes) plus a short plain-language explanation in English or Dutch, for an agent to show its user before asking for approval. Bulk: 100 checks for $0.80 via /v1/credits.

Is this transaction, approval or signature safe to sign, explained for a person? The same pre-sign verdict as /v1/check (green/orange/red + reason codes) plus a short plain-language explanation in En…