Security x402 offerings

Detect whether a User-Agent belongs to a known bot, crawler, AI agent or HTTP tool, and if so return its name and category (search, social, seo, ai, monitoring, tool, …).

One call, one verdict: PROCEED, CAUTION or BLOCK for any EVM wallet or token, with the reasons attached. $0.02 USDC per call on Base, no API key or account. GET ?address=0x... (required), chain=base|ethereum, type=wallet|token. Checks the OFAC SDN list (synced daily), scam and phishing lists, and honeypot, tax and mint signals. Returns verdict, a one-line summary, reasons[] strongest first, risk_score 0-100 and sources. Never PROCEED when a source could not be checked.

Fetch the result of an Icypeas search launched by icypeas/email-search, email-verification, or domain-scan. Pass `id` (the `item._id` from the launch response); or list recent searches with `mode: "single"` (+ optional `type`: email-search|domain-scan|email-verification) or `mode: "bulk"`, `limit` ≤ 100. Read `items[0].status`: NONE/SCHEDULED/IN_PROGRESS = keep polling (every 3-5s, ≤30 reads/min); FOUND/DEBITED = done, read `items[0].results`; NOT_FOUND/DEBITED_NOT_FOUND = processed, nothing fo…

Verify an email address's deliverability via Icypeas (SMTP-level). Pass `email`. Returns `{ item: { _id } }` immediately — the search runs async. KEEP POLLING icypeas/result with that `id` (every 3-5s; Icypeas caps reads at 30/min) until `status` leaves NONE/SCHEDULED/IN_PROGRESS. FOUND/DEBITED = hit, NOT_FOUND/DEBITED_NOT_FOUND = processed but empty. Second verification rung next to tomba/email-verifier — same price, different infrastructure; cross-check risky addresses before a send.

2Captcha — submit a captcha task (reCAPTCHA, Turnstile, hCaptcha, image; ~0.3¢). Params: `task` object per 2Captcha createTask schema. Poll with twocaptcha:result.

Fetch the result of an Icypeas search launched by icypeas/email-search, email-verification, or domain-scan. Pass `id` (the `item._id` from the launch response); or list recent searches with `mode: "s…

Validate a jwt: tests the value against a well-known jwt pattern and returns valid true/false, the pattern used (so you can reuse it), and, when it fails, the first character position that breaks the rule. Format validation without writing regexes. $0.01 per call.

Validate a sha256: tests the value against a well-known sha256 pattern and returns valid true/false, the pattern used (so you can reuse it), and, when it fails, the first character position that breaks the rule. Format validation without writing regexes. $0.01 per call.

Validate a strong password: tests the value against a well-known strong password pattern and returns valid true/false, the pattern used (so you can reuse it), and, when it fails, the first character position that breaks the rule. Format validation without writing regexes. $0.01 per call.

Evaluates text or model outputs against specified values or policies and returns a numeric alignment score with explanatory feedback.

One anchored capture by its sha256: coarse location, capture time and EAS attestation on Base.

Checks vehicles for active recalls and safety notices.

Live IP geolocation: country, city, org, and ASN for fraud and routing agents

Composite 0-100 trust/risk score for a domain in one call — blends domain age, SSL/TLS, DNS health, email auth (SPF/DKIM/DMARC), IP reputation, and certificate transparency into a single "safe to do business with this domain?" verdict with per-signal breakdown and actionable flags. Partial results never read as safe.

Follow a public redirect chain with per-hop HTTP status (SSRF-safe) for security agents

TLS peer certificate subject, issuer, expiry, and authorization status for a public host

One payment: DNS + TLS cert + RDAP WHOIS + HTTP HEAD for brand protection and security agents

SSRF-safe public GET with status, headers, and size-capped JSON/text body for agent tool use

Compare supplied routing-notice versions and return bounded evidence, validated network identifiers, and hashes.

Compare supplied routing-notice versions and return bounded evidence, validated network identifiers, and hashes.

Compare two supplied public-source text versions and return bounded, hash-backed evidence of change.

Verdix: call before an agent sends funds to an EVM address on Base. Returns safe/caution/danger with reasons from OFAC sanctions, scam/phishing lists, address-poisoning lookalikes, burn-address and contract/deployer checks; quick adds address age, standard/deep on-chain behaviour. "safe" is not a guarantee. Legacy route that sells 3 tiers (a default client buys quick); new integrations should call /risk/address/quick, /standard or /deep.

Verdix deep ($0.50): call before large or first-time payments to an EVM address on Base when your policy asks for the top tier. Same full check set as standard: sanctions, scam/phishing lists, address poisoning, contract/deployer signals, on-chain behaviour. Returns safe/caution/danger with reasons.

Verdix lite ($0.01): call before an agent sends funds to an unfamiliar address on Base or Ethereum (chain=ethereum). Checks OFAC, known scam/phishing addresses (GoPlus), address poisoning and burn addresses; phishing tokens and flagged deployers on Base only. Ethereum poisoning data is a daily scan, not live. Clean = no_known_risk, never safe; for safe use /risk/address/quick.