Security x402 offerings

Verifica una entrega web (HTML, CSS, JavaScript) sin ejecutarla: 86 reglas de seguridad, sintaxis de JavaScript y recursos externos. Determinista, sin modelo. Lo que NO se pudo comprobar se declara aparte y nunca cuenta como limpio.

Use this when you need to know who is behind an EVM address, typically a token deployer, before trusting what it launches. Price: $0.01 in USDC on Base or Solana, or $0.02 in USDG or $SWOGE on Robinh…

Use this to check a draw independently: recomputes the SHA-256 of a revealed server_seed against its hash, and the numbers of a swoge-hmac-sha256-v1 draw, or the 52-card shoe of a SWOGE casino hand (…

Use this before any draw other players must trust (a game between agents, a raffle, a giveaway): the server picks a secret seed and publishes its SHA-256 hash now, so it cannot change the seed later.…

Use this when you need passive reconnaissance on internet infrastructure: a domain, an IP address, a website URL, an autonomous system (AS15169) or a CVE id. Price: $0.01 in USDC on Base or Solana, o…

Fetch a URL (following redirects) and return the final response's HTTP headers, the server banner and content-type, plus a security-header audit reporting HSTS, Content-Security-Policy, X-Content-Typ…

Verify a webhook's HMAC signature against the correct per-provider scheme: GitHub (X-Hub-Signature-256, sha256=hex), Stripe (Stripe-Signature t/v1 over "<t>.<body>" with replay tolerance), Shopify (X-Shopify-Hmac-Sha256, base64), Slack (X-Slack-Signature, v0:<ts>:<body> with replay tolerance). Constant-time comparison; the secret is never echoed. Pass the RAW request body string - signatures are over the raw bytes. Deterministic.

Domain intelligence in one call: RDAP registration (registrar, age, expiry, status), live DNS (A/AAAA/MX/NS/TXT), the mail and DNS providers behind them, the SaaS vendors the domain's TXT verification tokens reveal, SPF/DMARC posture, and risk signals like newly-registered or no-registrar-lock.

Off-chain due diligence on a project's web presence — the half on-chain rug checkers cannot see. Domain age and registrar, whether a team page, whitepaper, docs and socials exist, whether the site is an off-the-shelf template, and a cross-check of the contract address you are about to trade against the addresses actually printed on the project's own website. Returns weighted risk signals and an A-F grade. Reads nothing on-chain.

Audits a website for accessibility issues and improvement opportunities.

One call audits a site: tech stack, TLS certificate, accessibility (WCAG, grade), GDPR cookies and trackers before consent, domain and email security, optional screenshot. Returns a sorted issue list, grades and each section; a failed section is reported in checks while the others still return. Cheaper than calling the six checks separately. Set screenshot false to skip the image.

Verified URL Evidence Snapshot: bounded credential-free public HTTPS observation pinned to public IPv4, with HTTP headers, authenticated TLS, seven checks, and optional SHA-256 content fingerprint. Defaults: url=https://example.com/ and content_fingerprint=true. Request-target limits: 2300 raw UTF-8 bytes; 2302 bytes as a JSON string.

A $5 Base-USDC website release audit: one bounded public HTTPS GET, 22 deterministic transport, security-header, technical SEO, and accessibility-surface checks, weighted score, observed evidence, copy-paste fixes, dossier ID, and SHA-256 report integrity.

A $5 Base-USDC website release audit: one bounded public HTTPS GET, 22 deterministic transport, security-header, technical SEO, and accessibility-surface checks, weighted score, observed evidence, copy-paste fixes, dossier ID, and SHA-256 report integrity.

A $5 Base-USDC website release audit: one bounded public HTTPS GET, 22 deterministic transport, security-header, technical SEO, and accessibility-surface checks, weighted score, observed evidence, copy-paste fixes, dossier ID, and SHA-256 report integrity.

website trust report from a direct HTTPS fetch: status, response headers, HSTS, CSP and clickjacking protection signals.

Parser-blocking script budget repair plan fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Parser-blocking script budget decision fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Parser-blocking script budget audit fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Verify an EIP-191 personal_sign or EIP-712 typed-data signature and recover the signer address from public inputs (message + signature). Verification/recovery only — never signs.

Your public IP address as the server sees it, IPv4/IPv6, whether it is public or private, plus your user agent. Calculated by Vextorium, no third-party lookups. Check where an agent exits from or whether a proxy/VPN works.

WhiteMagic continuity-receipt verification: POST a signed receipt bundle and receive a verdict (TRUSTED / PROVISIONAL / INSUFFICIENT_EVIDENCE / UNTRUSTED) with coded errors and an optional signed verification receipt. Verification is stateless, offline-verifiable, and fail-closed; keyless /health, /info, /revocations and GET /anchors remain free.

WHOIS Lookup API. Retrieve domain registration data including registrar, WHOIS server, creation date, expiration date, updated date, nameservers, domain status, and privacy/redaction signals. Useful for agents, developers, domain intelligence, expiry checks, registrar lookup, ownership investigation, and security workflows. Paid per call via x402.

Check whether a wallet currently holds a valid, unexpired Wicked Identity agent-liveness assertion.