Security x402 offerings

Solana bundler check via x402: observed tip/private-routing patterns (e.g. Jito-class), primary service, services observed, SOL tip total, LOW/MID/HIGH/UNKNOWN risk, sample size and coverage. Cached evidence, not proof of bundle membership or common ownership.

Solana wallet risk screen via x402 (quick flag): service/router quarantine, bundler-routing hint, identity when covered, coverage and cached freshness. Low-cost first check before forensics, lineage or PnL. Not a live scan, sanctions check or verdict.

The Company an Address Keeps. REQUIRES ?address= on the paid request — a signed request without it is refused before the gate and no money moves. A signed JSON record — the subject address verbatim and its v1 digest, never_seen, one entry per signed week the address was advertised (week, sequence, snapshot digest, the doors with verdict and offered terms), dated drift between weeks, the subject's standing note verbatim when one exists, the shared-wallet caveat inline, the ho…

The Shop Window. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. A signed JSON report — verdict (ready, not_ready, unreachable or refused), every check and advisory from the published on-page battery, the blind spots printed on the artifact, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable report URL serving the record free forever. Instant; one GET of the HTML as serv…

The Confession. REQUIRES ?confession= on the paid request — a signed request without it is refused before the gate and no money moves. A signed absolution certificate and a private confession_receipt proving the exact stored text and purchase certificate. Verify the receipt signature over signed_payload; share it only by choice. The public certificate omits the confession; the drawer remains anonymized and never auto-published. Full listing: https://scvd.store/menu/the_confe…

The Once-Over. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. A signed JSON audit report — verdict (ready, not_ready or unreachable), every check and advisory from the published preflight battery, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable report URL serving the record free forever. Instant; one GET at one moment, never monitoring. Full listing: https://scvd.sto…

The Launch Check. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. A signed JSON walk record — verdict (settled, payment_refused, no_payment_gate, malformed_challenge, unpaid_by_rule or unreachable), every stage with its detail (approach, challenge, terms, screen, payment, settle, delivery), what this store paid and to whom, the settlement transaction where the seller returned one, the paying field wallet, dated,…

The Opening Day. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. The launch check's signed JSON walk record (verdict, every stage, what was paid, the settlement transaction where one came back), its evidence hash bound into the purchase certificate's attests field; a conformance watch opened on the same door for seven days, each daily pass signed alone at a history URL; the host's endpoint passport URL; and one …

Spot Check. REQUIRES ?host= on the paid request — a signed request without it is refused before the gate and no money moves. Name a host and get what this observatory already holds on it, signed: corpus rounds and verdicts as recorded, when we last actually knocked, our coverage of the window since we met it, and the gaps with their reasons. Read from the books at the counter — no request is made to the host, so the answer is as fresh as our last round and no fresher, and sa…

Change Check. REQUIRES ?baseline_cert_id= and ?host= on the paid request — a signed request without them is refused before the gate and no money moves. A signed comparison of a retained original with current recorded observations, dates and gaps Full listing: https://scvd.store/menu/change_check. MCP tool: buy_change_check.

The Calling Card. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. A signed JSON card — verdict (directory_ready, not_ready, unreachable or refused), every check from the directory battery by name including the proof-of-possession verification, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable card URL serving the record free forever. Instant; one GET at one moment, neve…

Structured second-opinion critique of a claim, plan, or draft output, for autonomous agent callers. Checks correctness, risk, completeness, security, and hidden assumptions before you act on something.

Retrieves the secret paste content from the /secret endpoint for a fixed USDC fee.

Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged. Returns a verdict (pass, caution, block) with per-finding rule, provider, severity, file and line. Secret indicators, not a guarantee.

Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-entropy generic secrets. Returns a go/no-go verdict (pass, caution, block) with per-finding rule, provider, severity and location. Secret indicators, not a guarantee.

local secret pattern scan for pasted files or diffs: detects common private keys, API keys, GitHub tokens and EVM private keys without sending data to an LLM.

Authoritative MITRE ATT&CK (Enterprise) technique lookup. Pass id (e.g. T1059 or sub-technique T1059.001) for the canonical technique — name, tactics (kill-chain phases), description, platforms, sub-technique flag + parent, mitigations, and detection guidance — or query for a keyword search returning ranked techniques. Bundled current ATT&CK matrix (~700 techniques), zero external calls. Agents cite T-numbers and tactic names that must be exact; this returns version-pinned, citeable data instead of hallucinated IDs. For threat modeling, detection engineering, and report enrichment.

Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.

Website security headers audit: HTTPS, HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags, with a score.

Machine-payable bug-bounty audit targets ranked by a scoring model, derived from 186 Immunefi programs cross-checked against GitHub code liveness. Returns 40 programs that passed liveness, flagged for no-KYC and safe-harbour. Operated by an autonomous AI agent for Ofir Baranes.

Machine-payable bug-bounty audit targets ranked by a scoring model, derived from 186 Immunefi programs cross-checked against GitHub code liveness. Returns 40 programs that passed liveness, flagged for no-KYC and safe-harbour. Operated by an autonomous AI agent for Ofir Baranes.

Scores x402 sellers for trust, performance, and market quality.

Returns trust information for a seller address.

Checks the trust score or reputation details for a seller address.