Security x402 offerings

Triage a smart contract before an agent interacts with it: verified Solidity source, heuristic vulnerability scan, known-address check, function-selector resolution, and a read-only dry-run of the exact call you plan to make. Contract audit skill pack: one x402 payment runs 5 underlying tools (contract-source, solidity-scan, selector-lookup, address-label, tx-simulate); partial-success per step.

Hand the agent an opaque string - a JWT, a base64'd JSON payload, a gzip-encoded API response, a hex-encoded hash - and walk it through identifying what it is and unwrapping it layer by layer until it's human-readable.

How old and legit is this domain? WHOIS registration, DNS resolution, and TLS certificate in one pass. Domain age and legitimacy skill pack: one x402 payment runs 3 underlying tools (whois, dns-lookup, tls-cert); partial-success per step.

Full domain security and SEO intelligence in one call: WHOIS, DNS, TLS cert, HTTP headers, tech stack, robots policy, and certificate transparency. Domain intel skill pack: one x402 payment runs 6 underlying tools (whois, dns-lookup, tls-cert, http-headers, tech-stack, robots-check); partial-success per step.

Full email auth posture: SPF, DMARC, DKIM, and composite deliverability score in one call. Email security skill pack: one x402 payment runs 4 underlying tools (spf-check, dmarc-check, dkim-lookup, email-deliverability); partial-success per step.

Is this domain trustworthy, or is it a phishing site / typosquat / scam? Pull the reputation signals an analyst checks before clicking anything: domain age, cert issuance history, hosting reputation, DNS topology, tech-stack fingerprint, and page-content red flags. Different from a security audit - this is about whether the domain is what it claims to be.

Decode and verify a JWT in one pass - see the payload and check the signature. JWT toolkit skill pack: one x402 payment runs 3 underlying tools (jwt-decode, jwt-verify, jwt-sign); partial-success per step.

Full page SEO + security audit: content extraction, metadata, HTTP headers, robots policy, and sitemap health in one call. Page audit skill pack: one x402 payment runs 5 underlying tools (extract, meta, http-headers, robots-check, sitemap); partial-success per step.

Enumerate a domain's external attack surface in one workflow: certs, DNS posture, email auth, HTTP security headers, and tech stack. Security audit skill pack: one x402 payment runs 7 underlying tools (cert-transparency, dns-lookup, spf-check, dmarc-check, http-headers, tls-cert, tech-stack); partial-success per step.

TLS/SSL security posture check: live certificate inspection, HTTP security headers, and CAA DNS records. SSL audit skill pack: one x402 payment runs 3 underlying tools (tls-cert, http-headers, dns-lookup); partial-success per step.

Take a signup form submission and run the full onboarding workup deterministically: validate the email, score the chosen password, mint a stable internal ID, derive a URL-safe handle from the display name, generate a recovery / API secret, hash the password for storage, and verify the 2FA setup code. One pass, every step a pure-CPU call.

The production ingest path for every incoming webhook: verify the provider signature (GitHub / Stripe / Shopify / Slack, constant-time, replay-window enforced), schema-validate the now-trusted body against the provider envelope, fingerprint the raw bytes for redelivery dedup, normalize the event timestamp to UTC + epoch, and redact PII before anything hits a log. Five pure-CPU tools - the accept-or-reject gate, run on every event.

Before your agent negotiates or shares data with another agent, make both prove they qualify. Open a channel with on-chain conditions (hold 1,000,000 USDC, hold a governance token, carry a verified a…

Generate random integers for applications and smart contracts using a paid API endpoint.

Email address check: verdict (deliverable_likely/risky/invalid) with reasons from syntax, MX/A records, disposable-provider list, role address, free provider, typo suggestion, SPF/DMARC/DKIM and doma…

Website trust check: verdict (trustworthy_likely/caution/risky) with reasons from domain age (RDAP), DNS (A/MX/NS), HTTPS reachability and redirect chain, security headers, phishing/malware list snap…

Scans Solana programs for security and risk signals.

Full AI verdict on a Solana token combining holders, snipers, dev history, bonding curve, freeze/mint authority — single comprehensive risk score. Sources: Solana RPC + PumpPortal.

Solana wallet trust scoring. Live on-chain analysis via Helius: wallet age, tx diversity, DeFi activity, risk flags. Works for any Solana address.

Use this to be told when a Solana program you rely on changes hands or code, or when a new advisory hits your Cargo.lock: 30 days of hourly checks, signed webhook on each change. One payment.

Solana Watchdog advisory check: RustSec/OSV advisories affecting the crates of a whole Cargo.lock (or up to 100 listed crates) at their exact pinned versions. Instant, per request.

Solana Watchdog: dependency advisories split by on-chain vs toolchain surface, plus known Solana/Anchor bug-class leads, for a public GitHub repo. A scan, not an audit.

Generate 1 to 1000 independent random numbers on the 53-bit grid in [0,1); zero is included and one is excluded. Uses the server OS CSPRNG. Returns consumed bytes for reproducible calculation, not proof of their origin. Price: 0.007 USDC per request, including the bounded batch.

Generate length cryptographically random bytes, encoded as lowercase hexadecimal. length defaults to 32 and may be 1 to 4096. Uses the server OS CSPRNG. Returns consumed bytes for reproducible calculation, not proof of their origin. Price: 0.007 USDC per request, including the bounded batch.