Security x402 offerings

PRICE: 0.02 USDC. Pre-purchase counterfeit and listing-risk screening for Japanese anime collectibles. Cross-checks canonical identity, official references, price relationships and matched listing signals to flag bootleg risk, suspiciously cheap offers and identity mismatches. WHEN TO USE: Use when an offer is unusually cheap, the seller title is vague, official references are missing or Japanese and overseas listings disagree on identity. WHY PAY: Pay before recommending ...

Supply-chain check of a popular package (the 8,000 most used on each of npm, PyPI, crates.io and Go): latest version and release activity, maintainers or owners, install scripts, provenance, deprecation, retractions, and what changed since we began tracking it daily: releases by a new publisher account, owner changes, install scripts added, provenance dropped, source repository moved, yanks. Account names are never published. Signed.

Supply-chain watch across the 8,000 most-used packages on each of npm, PyPI, crates.io and Go, newest first: releases by a new publisher account, maintainer and owner changes, install scripts added, provenance dropped, source repositories moved, retractions, deprecations and yanks, with counts, for the last 1 to 30 days (days=, default 7), for one ecosystem or all. Signed.

Leaderboards from our independent checks of remote MCP servers in the Official MCP Registry: most reliable (up in 99%+ of probes, fastest first), servers whose tool definitions changed in the last 7 days, flagged servers (often down, new domains), and counts by sign-in mode, with the method. Rankings are never for sale. Signed.

Tool changes across remote MCP servers in the Official MCP Registry, newest first: tools added, removed or redefined (description, input schema or annotations), from our daily fingerprints. A tool that changes after you approved it is how 'rug pull' attacks work, so check before trusting a server again. Last 1 to 30 days, or one server with name= or url=. Servers whose tools change by design are marked. Signed.

Leaderboards from our independent checks of x402 services: most real (wash-adjusted) paying customers, most reliable, and flagged services (price or wallet mismatches, outages, mostly bot traffic, self-funded volume), with the method. With category= (shopping, ai-inference, crypto-data...), one category's boards. Rankings are never for sale. Signed.

Use before connecting a remote MCP server: independent checks by registry name or URL. Uptime and connect time from daily probes (initialize and tools/list; no tool is ever called), sign-in mode, protocol version, tool count, and tool-definition changes in 30 days (how 'rug pull' attacks work), with domain age, a grade and reasons. Covers remote servers in the Official MCP Registry. Signed.

APEX Runner: Risk Assessment Bundle Signal

Check a public domain's email authentication and anti-spoofing posture using MX, SPF, DMARC, caller-selected DKIM, MTA-STS, TLS-RPT, and BIMI DNS evidence.

Detect likely leaked API keys, tokens, private-key headers, JWTs, and credential assignments in caller-supplied source or configuration text. Return type, line, fingerprint, and a fully redacted preview with no network access or code execution.

Deterministically detect and redact PII and personal data in supplied text with overlap-safe matching for emails, phone numbers, validated IPv4 and IPv6 addresses, Luhn-valid payment cards, valid-checksum IBANs, and structurally valid US Social Security numbers.

Audit one public URL for title, meta description, H1 count, image alt text, canonical, robots, language, Open Graph, Twitter cards, headings, hreflang, feeds, and Schema.org data; return a deterministic score and prioritized issue codes.

Deterministic package existence for PyPI and npm, built from real published artifacts (never LLM guesses). Negative answers and typosquat-adjacency flags carry signed proof. $0.002 USDC per check.

Domain security check: SSL certificate, DMARC/SPF, DNSSEC, security headers and blocklist status with a score

Country, city, region, ISP/org, and lat/lon for an IPv4/IPv6 address (ipwho.is, keyless).

Full 5-phase EVM contract security audit for up to 3 addresses: Slither, Echidna fork fuzzing, deployer profiling, money-flow tracing, and holder concentration.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Evaluates a quote against configurable procurement requirements and returns likely_compliant / exception_identified / evidence_missing. Not legal advice.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.