Security x402 offerings

IP address or AS number lookup: holder, announced prefixes, origin AS, country, RPKI status and abuse contact. Use when: you need to know who runs an IP address or network.

Given a business website domain, audits its home page in a real browser and returns a ranked fix list with evidence: analytics and tag-manager tags, the consent manager and whether tracking loads before a consent choice, structured data (schema.org), AI-crawler access (robots.txt, llms.txt) and SEO basics. Findings that depend on what a visitor sees are marked as leads to verify. Not charged if the page cannot be audited (bot block, error).

Deterministic preflight check for a proposed AI agent action - a tool call, payment, fetch, or write - before it executes. Evaluates up to four independent checks (prompt-injection scan on action text/untrusted text, URL/hostname validation, a bounded JSON-schema check on a payload, and a spend proposal against a spend mandate) and returns ALLOW, REVIEW, or BLOCK with stable reason codes plus a SHA-256 request/receipt hash pair.

How ready a website is for AI agents: llms.txt, AI-crawler rules in robots.txt, sitemap, x402 payment discovery, OpenAPI, MCP manifest, security.txt, with a 0-100 score and concrete recommendations.

Deterministic lookup against Cook et al. (ACM TOPS 2026) testing whether off-the-shelf LLMs generate working ICS attack code. Pass technique (name/ID, e.g. 'Brute Force I/O' or T0806), vendor (Siemens, Schneider Electric, Rockwell Automation — only these tested), and/or campaign (Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, Triton). Only Network/Register-Tags techniques succeeded; 1.08% success rate; Claude excluded (stronger guardrails). No LLM in lookup path.

Combines security flags with the verified ABI's function names, then AI explains the contract's dangerous capabilities — owner can mint, pause, blacklist, upgrade or self-destruct — with a danger level. Goes beyond raw flags to read what the contract can actually do.

AI Crawler Access Check: Who Gets a 403 — Reads the results of probing a website with AI-crawler user agents (status codes per bot, a control request, sometimes robots.txt or the site's settings) and says what they really show as JSON - whether training bots, search bots and user-triggered agents are open, blocked, mixed or unknown, what is behind a refusal, and whether the robots.txt that answered is the site's own file. Knows the traps - a bare bot name proves nothing and lies differently for…

Analyzes AI-generated images for safety, copyright, and policy compliance, flagging violations and suggesting corrective actions.

POST /api/scan — agent-readiness scan for a domain (~$0.01 USDC per call)

Knowledge, understanding, and tooling is power. Research-backed education on agentic security, free resources, then AgentGuard360 and Protection SDK when you're ready to protect what you ship.

Knowledge, understanding, and tooling is power. Research-backed education on agentic security, free resources, then AgentGuard360 and Protection SDK when you're ready to protect what you ship.

Knowledge, understanding, and tooling is power. Research-backed education on agentic security, free resources, then AgentGuard360 and Protection SDK when you're ready to protect what you ship.

Trust check an npm package before an agent installs it: typosquat screen, deprecation, package age, maintainers, weekly downloads, source link.

Replaces private-key blocks, credential assignments, email addresses, Luhn-valid payment-card candidates, IPv4 addresses and phone-like digit strings, returning only sanitized text and per-category counts. The request archive stores only input field names and the result archive stores only this method via the endpoint factory. Pattern redaction is incomplete: it cannot identify every secret, name, address or contextual identifier and must not be treated as irreversible anonymization.

Spend Cap Review: Do Cost Limits Really Stop? — Reviews pasted code and configuration that spends money (paid AI or API calls, purchases, paid lookups, anything billed per use) and checks whether the limit on that spending really stands in the way of the spending. It flags a cap that sits beside the path instead of on it (a gateway limit while a script calls the provider directly, a counter only in the browser), a missing setting that means no limit, an alert or a budget email used as the prote…

Machine-readable Happiness-First Decision Pack for AI agents. Reframes decisions around reduced suffering, dignity, rights, future generations, ecology, creativity, concrete action, stop rules, and honest evidence. Static JSON delivery after verified Base mainnet USDC settlement. No account or personal data.

Deterministic MCP audit of claimed AI results. Separates real external value from plans, code, deployment, listings, monitoring, self-access, and test activity; returns the next missing evidence.

Email deliverability & domain security check — validates SPF, DKIM (multi-selector), and DMARC, detects spoofing and misconfigurations, and returns an A–F email security grade with transparent deduct…

Prompt injection detection and content moderation for AI agents: flags hidden instructions aimed at an LLM (none / suspicious / malicious + score) and harmful content (hate, violence, sexual, harassment, self-harm, illegal). Any language, JSON output.

Prompt injection detection and content moderation for AI agents: scan untrusted text (web pages, emails, tool output) before your LLM reads it. Verdict none / suspicious / malicious with a score, plus harmful-content flags (hate, violence, sexual, harassment, self-harm, illegal). Any language, JSON output.

SSL certificate check: is the HTTPS certificate of a domain valid? Issuer, expiry date, days remaining, names covered (SAN), hostname match and TLS version. Expiry monitoring for agents.

Token security check and rug pull / honeypot detector for any Base token: A-F risk grade from fixed rules, price, liquidity, round-trip loss (hidden taxes), impact of a $1,000 sale, owner, upgradeable proxy, mint / pause / blacklist functions, plus a short plain-English verdict.

Preview free synthetic x402 security reports, then buy machine-readable challenge and discovery audits from $0.01 in Base USDC.

Preview free synthetic x402 security reports, then buy machine-readable challenge and discovery audits from $0.01 in Base USDC.