Security x402 offerings

Deterministically compare caller-supplied content with a caller-supplied SHA-256 digest. Integrity comparison only; no identity, provenance, or security guarantee.

Read the codes in an image URL: QR, Data Matrix, Aztec, PDF417, EAN-13, UPC, Code 128, Code 39... with format, content and position; flags URLs, crypto payment URIs (bitcoin:, ethereum:, solana:) and wifi credentials.

Content-safety classification (Llama Guard): safe/unsafe plus category codes.

Decode a JWT header and payload (signature not verified).

Cryptographically-secure random integers in a chosen range (CSPRNG, rejection-sampled to avoid modulo bias) — real entropy an LLM cannot produce itself.

Expand a shortened or redirecting URL: follows the redirect chain server-side and returns every hop plus the final destination, re-validating each hop against SSRF.

Full x402 endpoint audit: verifies the 402 challenge, payment fields, Bazaar discovery metadata, and the origin's discovery surfaces (llms.txt, openapi.json, .well-known/x402, discovery/resources), returning a 0-100 score, pass/warn/fail checks with evidence, and recommended fixes.

Deep x402 audit: the full endpoint audit plus a live probe for rail coverage (Base/Solana), multi-rail detection, HTTP status, and latency — a premium trust report on any x402 endpoint.

Runs a comprehensive full scan of targets to detect vulnerabilities, exposures, and intelligence indicators.

IP threat intelligence from first-party honeypot observations (not scraped blocklists): was this IP seen scanning, brute-forcing or probing a live honeypot, which traps it triggered (credential stuffing, webshell, exploit scans, scrapers), bot category and confidence. Works for IPv4 and IPv6.

Cryptographically secure randomness: N random bytes as hex, a uniform integer in a range, or a batch of up to 100 values in one call. Use it when an agent needs unpredictable values for nonces, sampling, shuffles or test data and cannot trust its own generator.

Generate cryptographically-secure random bytes, returned as hex, base64 or base64url.

Full-domain intelligence report in one call: complete DNS sweep (A/AAAA/MX/NS/TXT/SOA/CNAME), RDAP registration data (registrar, dates, statuses), DNSSEC presence, mail posture summary (SPF/DMARC/DKIM selectors), TLS certificate snapshot (issuer, expiry, protocol), Certificate Transparency subdomain census, and HTTP probe (status, redirects, https enforcement, server header) — each section scored, overall weighted score and verdict. Query param: domain (required).

Executable header forensics for a file URL (defensive reverse-engineering): parses ELF (32/64, LE/BE), PE (32/64) and Mach-O headers — architecture, PIE/ASLR, NX stack, section entropy, imports, compiler/linker timestamps, interpreter, overlay and security verdicts (packed/signed/mitigations). Static parsing only, the sample is never executed. Query param: url (required). Max 8 MiB.

Static file triage for any file URL (defensive reverse-engineering): magic/format identification, MD5/SHA-1/SHA-256 hashes, Shannon entropy with packed-region detection, embedded-file signature scan and classified string extraction (URLs, IPs, paths, crypto markers). The sample is fetched and analysed in memory only — never executed. Query param: url (required).

Subdomain enumeration via Certificate Transparency logs (crt.sh, with Cert Spotter fallback): unique subdomains with issue/expire date ranges, grouping by function (www, mail, api, dev, admin, cloud, cdn...), issuing CAs and cert counts. Recon-grade attack-surface mapping for a domain. Query params: domain (required), limit (optional, default 100, max 250).

TLS/SSL audit for any host: live handshake — certificate chain details (subject, issuer, SANs, expiry, fingerprint), negotiated protocol and cipher, a TLSv1.0/1.1/1.2/1.3 support matrix, and a graded findings list. Query param: domain (required; host or URL).

Verify a package: does it exist, is it deprecated or yanked, and does it have known vulnerabilities? Checked against the npm/PyPI/crates.io registry plus OSV.dev advisories.

Verify an x402 seller before paying it: does it exist and respond with a well-formed 402 challenge, is its own declared input/output schema internally consistent, and is its payout address sanctioned? Checked live against the seller itself plus Chainalysis's sanctions oracle and Blockscout (Base payTo addresses only). Confirms the checkable things about a seller check out -- not a guarantee of trustworthiness, which no free source can promise.

RecallGuard inventory matcher: match up to 100 items against US recalls, $0.10 per call

Production-grade threat monitoring oracle exposing aggregated risk data from 8 real-time feeds (USGS, NASA, NOAA, GDACS, disease, currency, and Solana DePIN telemetry).

Mask emails, phone numbers, credit-card-like numbers, IPs, and SSNs in text. Returns the redacted text and counts by type.

Redact PII and Secrets From Logs and Tickets — Replaces personal data and secrets in a text with typed placeholders and leaves every other character exactly as it was, so the text can go into a log, a ticket, a prompt or a shared document. Covers email addresses (also written out as "at" and "dot"), phone numbers in any format, IBANs, payment card numbers, national ID numbers such as the Bulgarian EGN, IP addresses, and secrets - passwords, API keys, tokens, the password inside a connection str…

Follow the redirect chain of a URL (up to 10 hops): status code and time of each hop, final URL, domain changes and HTTPS-to-HTTP downgrades. Unmask short and affiliate links before visiting them.