Security x402 offerings

ShieldAPI - x402 security preflight before agents trust an identity, sender, or email counterparty

Invisible bot protection. Score form submissions 0-100 based on behavioral signals. No CAPTCHAs.

Know Your Merchant (KYM) trust score: pass a merchant domain and get a deterministic 0-100 trust score with a band (high/medium/low/very_low/avoid) and human-readable reasons. Live signals: domain age from the RDAP registry of record, malware/phishing blocklist verdict via Cloudflare Security DNS, TLS certificate health, mail capability, and refund/privacy/contact page presence. The merchant-side check an agent runs BEFORE committing funds — the complement to know-your-agent.

Reads the constraints inside a single certificate — basic constraints, key usage, extended key usage — and reports, per role, whether the certificate permits being used that way under the pinned OpenSSL build's rules. Roles covered are TLS client, TLS server, S/MIME signing and encryption, and timestamp signing. This answers the frequent confusion where a certificate is deployed for a purpose its own extensions forbid, and the failure only shows up as an opaque handshake error later.

Opens a TLS connection and reports the chain the server presents. Per certificate: subject and issuer, validity window with days remaining, serial, SHA-256 fingerprint, key type and size, and the subject alternative names. Above that it answers the questions a monitor asks: is the requested hostname covered by the leaf certificate including wildcard rules, how many days until the nearest expiry, is any certificate self-signed or signed with a weak algorithm, does the server send its…

Parses a definite-length binary artifact and returns every ASN.1 object it contains with its byte offset, nesting depth, header and content lengths, whether it is constructed, and the type as OpenSSL names it. This is the tool for the moment a certificate, key or signature is rejected with an unhelpful parse error and the question is which byte is wrong. Because offsets are exact, a diff against a known-good artifact localises the difference instead of describing it.

Checks a detached OpenPGP signature against the bytes it claims to cover, using the pinned GnuPG build and nothing else. What comes back is the verdict in GnuPG's own terms, the fingerprint that actually signed, the signature timestamp, the algorithms used, and whether the key is expired or revoked. A wrong key, a tampered byte or a signature made by someone else each produce a distinct verdict rather than a bare false.

Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.

Produces a ready-to-post RFC 3161 TimeStampReq for a SHA-256 digest you already computed. The pinned OpenSSL build encodes the message imprint, adds a fresh nonce so a replayed response can be detected, and sets the flag that asks the timestamp authority to include its signing certificate in the reply. The result is returned as a binary artifact together with the imprint it was built around, so the caller can check that the request really covers the intended digest.

Takes a cipher policy in OpenSSL syntax and resolves it into the concrete list of TLS 1.2 cipher suites that the pinned build would actually offer, in the order it would offer them. This closes the gap between a policy string in a configuration file and what a server ends up negotiating: aliases expand, exclusions apply, and suites below the build's security level drop out silently in normal operation. Here they simply do not appear in the list, and the count says how many survived.

Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities found with their identifiers, severity and summary, and the single figure that decides what to do next: the lowest version that fixes all of them, derived from the fixed-version events in the affected ranges.

Takes a public key in SubjectPublicKeyInfo PEM form and runs the pinned OpenSSL build's own consistency checks over it, then reports the algorithm, the key size in bits and the parameters it found. This catches keys that parse but are structurally unusable: a modulus that is not a valid product, curve parameters that do not match a known group, a size that no longer meets the build's security level. The reported bit count comes from the key itself, not from the label a producer attached.

Accepts up to sixteen certificates in any PEM shape and returns a single normalized bundle. Duplicates are identified by their canonical DER encoding, not by the PEM text, so the same certificate supplied twice with different line wrapping, different header text or trailing whitespace collapses into one entry. The reply gives the input count, the unique count and the resulting bundle, which makes it usable as a preparation step before a trust store is built or shipped.

Builds a PKCS#12 container holding certificates only, for the common case where a runtime insists on PKCS#12 as its trust store format. The password is explicitly empty and reported back as such, so nothing depends on an undocumented default, and the reply states outright that the store contains no private keys. That matters: a PKCS#12 file is the usual carrier for a key, and a consumer must be able to tell a trust store from an identity store without opening it.

Reads the central directory of a supplied ZIP archive with the pinned unzip build and reports what it would do if you unpacked it, without unpacking anything. Every entry is listed with its uncompressed size and method, and three specific hazards are named: paths that climb out of the target directory, names the archive repeats so that a later entry silently overwrites an earlier one, and a total uncompressed size far out of proportion to the archive.

Wraps the supplied bytes in a CMS EnvelopedData envelope using the pinned OpenSSL build, addressed to every recipient certificate you pass in. A single content-encryption key protects the payload and is itself encrypted once per recipient, so any one holder of a matching private key can decrypt, and nobody else can. The reply names the cipher actually used and the recipient count, so an agent can record what it produced rather than assume it.

Runs the pinned OpenSSL build against a submitted certificate request and answers two questions a registration authority has to settle before it signs anything: does the request carry a valid self-signature over its own body, and what exactly is being requested. The reply names the subject, the public key parameters and every requested extension as OpenSSL parses them, so a policy check compares against the parsed request rather than the text an applicant supplied.

Prüft am Objekt abschnitt den Befund maschinenlesbaren Inhaltstyp.

Verify a Sign-In with Ethereum (EIP-4361) login: parses domain, address, chain, nonce and dates, checks the signature and expiry, and optionally the expected domain and nonce. Authenticate users or agents by wallet.

Full detail for a single vulnerability advisory by CVE / GHSA ID (e.g. 'ghsa:GHSA-xxxx') — severity, CVSS score, affected Composer/PHP package(s), and source link.

Real-time crypto threat and risk intelligence for AI agents. Get up to 20 recent source-linked risk reports with risk scores, freshness, validation status and cached PG1 checks when available. Designed for automated triage and review. 0.01 USDC per snapshot on Base via x402; no API key or subscription required.

Token honeypot / security risk check before buy or approve. Input ERC20 contract + chain. Returns verdict avoid|caution|ok, is_honeypot, sell/buy tax, blacklist, owner powers. Use for honeypot detection, scam token screening, rug check, token security on Base Ethereum BSC Arbitrum Optimism Polygon.

HMAC-SHA256 integrity commitment over node health assessment and eBPF XDP/LSM status. Provides tamper evidence (BLAKE3+Ed25519 per paper Section 6.3). Not a zero-knowledge proof.

JWT decoder: decode a JSON web token header and payload, with safety flags (never verifies the signature)