Security x402 offerings

CISA Known Exploited Vulnerabilities added in the last N days, with EPSS, due date and required action

CVE details - CVSS, CISA KEV status, EPSS exploit probability, affected packages and patch priority

MCP server security scan - tool poisoning, prompt injection and risky capabilities before you connect

Website security grade for a hostname (Mozilla HTTP Observatory) - letter grade, score and tests passed

Secure random integer in a range plus random bytes as hex and base64

Prompt injection detection - screen text, a web page or tool output for block, review or allow with a risk score

Summarizes suspected scams into a quick, readable brief.

Scan source code or configuration text for hardcoded secrets: AWS access keys, GitHub/Slack/Google tokens, Stripe and OpenAI keys, PEM private-key blocks, JWTs and high-entropy secret assignments. Pl…

Return the input text with every detected PII span replaced. `mode` controls the replacement: "label" (default) → `[EMAIL]`; "mask" → the value covered with a mask character; "hash" → `[EMAIL:1a2b3c4…

Find personally identifiable information in a text blob: emails, phone numbers, credit cards (Luhn-validated), IBANs (mod-97 validated), IPv4/IPv6 addresses, US SSNs and JWTs. Returns every match wit…

Check up to 50 CVE IDs against CISA's Known Exploited Vulnerabilities (KEV) catalog. Returns membership, vendor/product, exploitation evidence, ransomware-use status and remediation guidance from CC0…

Prüft am Objekt cookie den Befund Wert der CSP-Kopfzeile.

Search 19+ platforms in a single API call: Reddit, Hacker News, GitHub, Stack Overflow, arXiv, npm, PyPI, X/Twitter, YouTube, Product Hunt, Dev.to, Qiita, Zenn, Semantic Scholar, GitLab, Hashnode, Lobsters, Lemmy, and x402 Bazaar. Includes Deep Research with AI synthesis. Accepts USDC payments on Base and Solana via x402 protocol.

Checks whether a value you did not fetch yourself is actually on the page it came from. Independently re-fetches the source and returns a signed pass/fail/unverifiable verdict. A claim is never certified unless the re-fetched page contains it, and anything unconfirmed is unverifiable, never pass. Server-rendered pages only. $0.01 per check. First 100 checks per client are free: resend this exact request with header X-Use-Free-Allowance: yes and no payment to use them.

JSON tier (deterministic, no LLM): verifies a claimed value lives at a named JSON path in a public endpoint's response, by independent double re-fetch. Use it for machine-readable API responses; for HTML pages use /verify. Claim keys are paths (data.items[0].price). Type-strict; volatile values return unverifiable, never a guess. Public HTTPS JSON only. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

Redirect tier (deterministic, no LLM): verifies where a public URL actually leads: final URL (byte-exact), first response status, and hop count of the HTTP chain, walked twice with per-hop SSRF checks. Use it to confirm a link or a moved page points where it claims. Loops and unstable chains return unverifiable, never a guess. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

Checksum tier (deterministic, no LLM): verifies the exact bytes served at a public URL hash to a claimed sha256, by independent double re-fetch. Use it to confirm a download or artifact matches its published checksum. Bodies up to 3 MB; dynamic pages return unverifiable, never a guess. sha256 only. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

Checksum tier (deterministic, no LLM): verifies the exact bytes served at a public URL hash to a claimed sha256, by independent double re-fetch. Use it to confirm a download or artifact matches its p…

Redirect tier (deterministic, no LLM): verifies where a public URL actually leads: final URL (byte-exact), first response status, and hop count of the HTTP chain, walked twice with per-hop SSRF check…

Checks whether a value you did not fetch yourself is actually on the page it came from. Independently re-fetches the source and returns a signed pass/fail/unverifiable verdict. A claim is never certi…

JSON tier (deterministic, no LLM): verifies a claimed value lives at a named JSON path in a public endpoint's response, by independent double re-fetch. Use it for machine-readable API responses; for …

XML tier (deterministic, no LLM): verifies a claimed value lives at a named path in a public XML document, by independent double re-fetch. Use it for feeds and sitemaps; for JSON use /verify-json, fo…

Screenshot Evidence Check — Reads a description of how a web page was captured or measured - a headless browser capture with a window size, a tall screenshot, a document width reading, a local Lighthouse run, a PageSpeed Insights run, an automation session that has been open for hours, a command-line download size on Windows - and says what that evidence proves, what it cannot prove and the one measurement that would decide, answered as JSON with a verdict. Knows the ways the capture itself pro…

Solana wallet risk screen via x402 (quick flag): service/router quarantine, bundler-routing hint, identity when covered, coverage and cached freshness. Low-cost first check before forensics, lineage or PnL. Not a live scan, sanctions check or verdict.