Security x402 offerings

Discover and validate a public A2A Agent Card, its skills, provider, authentication, endpoint consistency, and unsafe URLs.

Live BlockchainSecurity-backed address labeling with normalized entity and label provenance.

Bundle Agent Card, repository, package, domain, OpenAPI, and x402 endpoint preflight checks before an agent installs or delegates to a capability.

Check whether an AI agent's role, purpose, authority, and spend limit fit the x402 service or data product it wants to buy.

Inspect an unpaid x402 endpoint, decode its payment requirements, and flag unsafe or malformed commerce metadata.

Score an MCP server manifest or tool list before an agent connects it to a runtime.

Run x402 origin due diligence for an AI buyer: resources, payment consistency, metadata quality, seller risk, and next checks.

Return an AgentOps Guard ALLOW/REVIEW/BLOCK decision before a side-effecting agent action runs.

AI agent x402 payment firewall: enforce budgets and mandates, simulate transactions, score merchant and domain risk, prevent replay, require human approval, and audit delivery before autonomous spend…

Attested risk scores for stablecoins, DeFi protocols and wallets, with receipts.

Attested risk scores for stablecoins, DeFi protocols and wallets, with receipts.

Attested risk scores for stablecoins, DeFi protocols and wallets, with receipts.

Attested risk scores for stablecoins, DeFi protocols and wallets, with receipts.

Bulk agent-readiness screening for agencies, VCs and portfolio owners: scan up to 50 URLs in one paid call ($0.02/URL, $0.10 minimum) and get a compact per-URL verdict — level 0-5, passing checks, top gaps. The single-URL scan with full evidence stays free at /api/x402/deep-scan; this buys scale and rate-limit bypass.

Higher-confidence evaluation for high-impact, sensitive, or difficult-to-reverse agent actions.

Low-latency pre-action screening for routine agent responses and tool-call decisions.

Detect jailbreaks, prompt injection, and instruction conflicts before the agent follows them.

DCL Trust Oracle. Call only when the text must include the substring AI and must not include "I cannot be held responsible" or "no guarantees". POST JSON {"response","agent_id"}. COMMIT means those c…

Scan text for personal data: email, phone, national id, bank card, IBAN, crypto address, IP address, passport. COMMIT when nothing matches. NO_COMMIT on any finding. POST JSON {"response","agent_id"}.

Scan text for exposed credentials, API keys, private keys, database URLs, and webhook secrets. COMMIT when nothing matches. NO_COMMIT on any finding. POST JSON {"response","agent_id"}.

Password - CASA Cybersecurity Assessment - Consolidates evidence on secure communications, including certificate validity, hostname matching, protocol and cipher strength, forward secrecy, and TLS vulnerabilities. It determines whether the service uses a secure, authentic, and correctly configured transport channel.

Password - CASA Cybersecurity Assessment - Consolidates evidence on secure communications, including certificate validity, hostname matching, protocol and cipher strength, forward secrecy, and TLS vu…

Checks one or more domains to see whether they are set up to show a brand logo next to emails in Gmail, Apple Mail, and Yahoo. It looks up the BIMI settings the domain has published, checks the logo file follows the required format, checks any logo certificate is valid and unexpired, and confirms the domain has strict enough email protection turned on. Returns a clear pass or fail per domain, plus a plain list of what is broken when something fails.

Timestamp anything on Bitcoin with OpenTimestamps: send text, a SHA-256 hash or a URL and get a standard .ots proof (base64). Only a salted hash leaves our server. The public calendars anchor it in a Bitcoin block within hours; then btc-timestamp-verify returns the block and the complete proof, which anyone can check with the open-source ots tool. For contracts, AI outputs, datasets, invoices and web evidence.