Security x402 offerings

Returns supplier relationship status, risk indicators, and authorization evidence flags for LCG orchestration. Mock suppliers are explicitly labeled.

Heuristic ethics and constitution-style review of a prompt excerpt. Returns pass/fail, violation flags, and severity for agent policy screening.

Fast EVM smart-contract malicious-pattern triage. Returns risk score, verdict, top flags, and Phase-6 counterparty intel within ~30s for a single address.

Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad wo…

Compute keccak256/sha256, a 4-byte function selector, an event topic0, or an ENS namehash/labelhash from a string or hex input.

Vulnerability scan for a software package by ecosystem, name and version, or by package-URL (purl). Queries OSV.dev for known advisories, collects their CVE ids and enriches them with NVD CVSS, CISA KEV and EPSS, then returns a prioritized list of advisories with exact fixed versions. Risk indicators, not advice.

One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, blo…

Compute a deterministic similarity key for a name or address: the cheap first step of client-side blocking and deduplication. Records that share a key are duplicate candidates to confirm. Returns the key, the normalized form and the tokens. Indicators, not authoritative identity resolution.

Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and p…

Verify a business is real and get a legitimacy verdict plus a 0-100 risk score. Give one of name, lei, cik, ticker, isin or qid and get a verdict (real, likely_real, inactive, dissolved or not_found), a risk category, per-dimension flags, reasons, the official registry and which registries corroborated. Deterministic scoring, no LLM. Legitimacy indicators, not legal or credit advice.

Install-safety preflight for one dependency BEFORE pip install / npm i. Returns a safe / caution / block verdict fusing existence, OSV malware flags, typosquat distance to a popular package, a known-hallucination corpus, and freshness metadata. Supply-chain indicators, not a guarantee.

Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass th…

Standing-state audit of a wallet's live NFT operator approvals. Indexes every ApprovalForAll the address granted, filters to operators still live on-chain via isApprovedForAll, flags scam-listed, stale and canonical operators, and returns a ranked revoke plan with ready setApprovalForAll calldata plus a 0-100 risk and allow, warn or block verdict. Risk indicators, not advice.

Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserializa…

Single-CVE priority verdict from today's AIS ranked set (score, rank, factors) — or unlock every CVE route with an AIS CVE key ($19/30d): https://aislabs.ai/gateway/

CVEs added to CISA KEV in the last 7 days (complete catalog), annotated with today's AIS ranks — or unlock every CVE route with an AIS CVE key ($19/30d): https://aislabs.ai/gateway/

Today's full ranked CVE priorities (scores, KEV, EPSS, patch status, methodology) — or unlock every CVE route with an AIS CVE key ($19/30d): https://aislabs.ai/gateway/

Single-CVE priority verdict from today's AIS ranked set (score, rank, factors) — or unlock every CVE route with an AIS CVE key ($19/30d): https://aislabs.ai/gateway/

Verifiable RNG — cryptographically-random integer(s) signed by the treasury key. Drop-in VRF for game studios. $0.001 USDC.

Notarize agent payload. Returns signed PDR.

Validate a credit card or payment card number and detect its brand. Checks the Luhn checksum and identifies Visa, Mastercard, Amex, Discover, Diners or JCB, returning the BIN and last four digits. Structural card number validation for checkout forms and fraud pre-checks (does not verify the card exists or has funds).

Password strength and breach inspection: character classes, entropy bits, verdict, and Have-I-Been-Pwned breach count via k-anonymity (only a truncated hash prefix leaves the server; the password is never stored or logged).

invinoveritas /decision-receipt — a signed receipt for a bounded-choice decision (OpenAI Decisions API, Jev, any classifier): hashes of

invinoveritas /reason — strategic reasoning that ships with a SIGNED PROVENANCE PROOF: every answer carries a portable attestation you recompute offline