Security x402 offerings

utilpeek (Tanod) JWT verifier: signature, expiry, audience and issuer checks with a secret, PEM key or JWK Set. Use when an agent must check a JWT's signature and exp, aud and iss with a secret, a PE…

pactlint (Tanod) contract scan, up to 3,000 nSLOC: static security analysis of Solidity code (solc + Slither + custom detectors), JSON report with file:line findings. Automated, not an audit.

utilpeek (Tanod) JWT decoder: header, payload and claim times of a token, not verified. Use when an agent must read a JWT's header and claims (exp, aud, kid) without verifying it.

sitepeek (Tanod) security headers: a score and grade (A-F) of one response's HSTS, CSP, framing, content-type, referrer, permissions, cross-origin and cookie headers. Read-only; not an audit.

Check text for prompt injection: screen a web page, email or tool result of up to 20,000 characters. Input: text. Returns a verdict, a score and the flagged sentences; automated and heuristic. Use wh…

toolsniff (Tanod) static security scan of an AI-agent skill or MCP server package: prompt injection, hidden text, remote code, credential access, exfiltration, install hooks, over-broad MCP tools, ty…

imagepeek (Tanod) metadata removal: EXIF, GPS, XMP, IPTC and comments stripped.

Verify an email address: check its syntax and DNS (MX) to see whether it can receive mail, no SMTP. Input: email. Returns a verdict, MX hosts and disposable, role and free-provider flags. Use when an…

utilpeek (Tanod) hashes: sha256, sha512, sha3_256, blake2b, keccak256, md5, sha1 or crc32 of text or bytes.

chainpeek (Tanod) address-poisoning check before a token transfer: is the recipient a lookalike (same first and last 4 hex characters) of an address in the sender's history or contacts? Use when an a…

agentscan (Tanod) x402 endpoint preflight: a pay, caution or avoid verdict from the live 402 and the agent index (payTo change, price outlier, listing age, farm score). Use when an agent must decide …

pdfpeek (Tanod) PDF password protection: AES-256 encryption with permissions.

pactlint (Tanod) contract scan, up to 3,000 nSLOC: static security analysis of Solidity code (solc + Slither + custom detectors), JSON report with file:line findings. Automated, not an audit. Use whe…

utilpeek (Tanod) cryptographic randomness: integers, floats, bytes, UUID v4, dice rolls, picks and shuffles from a CSPRNG. Use when an agent needs cryptographic random integers, floats, bytes, dice r…

utilpeek (Tanod) user agent: browser, OS and device from a User-Agent string, plus a bot heuristic.

utilpeek (Tanod) HMAC: sign a message or verify a webhook signature (sha256, sha512 or sha1).

Use when an agent must decide whether an ERC-20 token on Base or Ethereum is safe to buy or interact with. Input: address, chain. Returns a verdict (high_risk, caution, no_major_flags_found, unknown)…

Audit a public HTTPS x402 API without payment: HTTP 402 challenge metadata, Bazaar and well-known discovery, OpenAPI 3.1 operation schemas and payment declarations, redirects, latency, and security headers.

Wallet drainer-protection scan: enumerates every live token approval (ERC-20, ERC-721, ERC-1155) your wallet has granted across major EVM chains, risk-ranks each spender (malicious flags, unverified contracts, unlimited allowances, EOA spenders), and returns a prioritized revocation action list. Deterministic security scan.

Purpose-bound Intercom observation (chat) using the existing fresh Stack-Monitor. Returns stack_intercom_decision, direct versus inferred status, evidence, optional version difference against a caller-owned baseline and reusable snapshot. Missing fingerprints do not prove absence. No background scheduling, CVE, compatibility or installed-extension inventory. Existing outbound safeguards remain in the injected motor. One public HTTPS root domain, up to150 baseline technologies; 9s timeout.

Purpose-bound Adyen observation (payment) using the existing fresh Stack-Monitor. Returns stack_adyen_decision, direct versus inferred status, evidence, optional version difference against a caller-owned baseline and reusable snapshot. Missing fingerprints do not prove absence. No background scheduling, CVE, compatibility or installed-extension inventory. Existing outbound safeguards remain in the injected motor. One public HTTPS root domain, up to150 baseline technologies; 9s timeout.

Purpose-bound Algolia observation (search) using the existing fresh Stack-Monitor. Returns stack_algolia_decision, direct versus inferred status, evidence, optional version difference against a caller-owned baseline and reusable snapshot. Missing fingerprints do not prove absence. No background scheduling, CVE, compatibility or installed-extension inventory. Existing outbound safeguards remain in the injected motor. One public HTTPS root domain, up to150 baseline technologies; 9s timeout.

Purpose-bound Monotype Fonts.com observation (fonts) using the existing fresh Stack-Monitor. Returns stack_fontsdotcom_decision, direct versus inferred status, evidence, optional version difference against a caller-owned baseline and reusable snapshot. Missing fingerprints do not prove absence. No background scheduling, CVE, compatibility or installed-extension inventory. Existing outbound safeguards remain in the injected motor. One public HTTPS root domain, up to150 baseline technologies; 9s t

Purpose-bound HubSpot observation (marketing) using the existing fresh Stack-Monitor. Returns stack_hubspot_decision, direct versus inferred status, evidence, optional version difference against a caller-owned baseline and reusable snapshot. Missing fingerprints do not prove absence. No background scheduling, CVE, compatibility or installed-extension inventory. Existing outbound safeguards remain in the injected motor. One public HTTPS root domain, up to150 baseline technologies; 9s timeout.