Security x402 offerings

Attested verification-event custody: seal the fact that an identity/liveness/KYC check ran, its method, provider, and result — without the subject's identity ever reaching Rubric. Caller submits an opaque subjectRef (hash it client-side); the sealed record binds event to outcome, ML-DSA-65 signed and Hedera-anchored. Prove a verification happened and what it said, forever, to anyone.

Unforgeable operating history for any AI agent attesting through TenPrint: record count, first-seen date, continuity days, and recent activity, computed from HCS-anchored attestations that cannot be backdated.

Deterministic structural failure inspection of a caller-declared control mesh. Structural evidence only; never authorizes execution. 0.01 USDC per request.

Deterministic structural failure inspection of a caller-declared control mesh. Structural evidence only; never authorizes execution. 0.01 USDC per request.

AI-stack CVE intelligence. Filters fresh security disclosures to vendors and products in the AI inference, agent framework, training, vector DB, model gateway, and MCP tool layers. Each paper carries a tf_ai_category tag and a severity_rank, sorted with exploited-in-wild and critical-severity first. 99.8% of underlying data is from GitHub Security Advisories (CC BY 4.0).

AI safety incident exposure analytics. Per-developer and per-deployer incident counts with recency-weighted exposure_score (1.0 last 30d, 0.5 days 31-90, 0.25 older), risk_domain and SEP-view (Security/Ethics/Performance) distributions, top affected artifacts. Derived over the AVID (avidml/avid-db, MIT) snapshot refreshed daily. The "which AI vendors have the most recent reported safety incidents" call.

SHA-256 hex digest of UTF-8 text. Call when content addressing or dupe keys for text. Returns sha256 as deterministic JSON for $0.001 USDC via x402 on Base. First-party local math only—no RPC, live market feed, API keys, storage, or mediagen. Advisory only; the caller owns capital, risk, and production controls.

Analyzes text and flags potential warnings or risky wording.

Recent CVE highlights + CISA known-exploited-vulnerability entries, relayed from public sources (NVD, CISA KEV)

Live feed of freshly-detected malicious addresses on Base — address-poisoning seeders caught via zero-value transfer sprays, updated continuously by our on-chain collector. Poll ?since=<unix> to ingest only new threats into your agent's blocklist. Deterministic, evidence-backed, machine-readable.

Live feed of freshly-detected malicious addresses on Base — address-poisoning seeders caught via zero-value transfer sprays, updated continuously by our on-chain collector. Poll ?since=<unix> to ingest only new threats into your agent's blocklist. Deterministic, evidence-backed, machine-readable.

File-hash reputation and known-file context for a SOC or DFIR agent. Give an md5, sha1 or sha256 hash and get CIRCL hashlookup known-file status, a hashlookup trust score and file metadata (name, size, mimetype, source, database), plus malware family when a licensed feed is enabled. A known distribution or system file lowers the alert priority; an unknown hash is not itself evidence of malice. Indicators, not a guarantee.

Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.

Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

Connects a TikTok account for login and authorization.

Pay $0.05 USDC to seal up to 100 KB of text until a future date. Content is inaccessible via GET /open/{token} until unlock_at passes. An optional label is visible before unlock via GET /status/{toke…

Batch exact-version package vulnerability intelligence with OSV advisories, package-specific fixed versions, and best-effort FIRST EPSS and CISA KEV evidence.

Passive HTTPS security-header check for one public domain. Returns redirect-final URL, normalized security headers, present/missing breakdown, weighted hardening score and grade. No exploit attempts, port scanning or authenticated testing.

Inspect the TLS certificate of any public host: subject, issuer, validity window, days remaining, SANs, and SHA-256 fingerprint.

Use when an agent must audit what certificates exist for a domain: every currently valid one publicly issued for it, read from the Certificate Transparency logs - issuer, validity window, days to expiry, revocation status and every hostname each certificate covers. It reports what was ISSUED, which is how you find certificates you did not know existed - not what the server is serving today. No API key, no account.

Open an SSL/TLS connection to a host and report its certificate — issuer, subject, validity window, days remaining, SANs, fingerprint and trust status.

Full AI verdict on a Solana token combining holders, snipers, dev history, bonding curve, freeze/mint authority — single comprehensive risk score. Sources: Solana RPC + PumpPortal.