Security x402 offerings

Email-authentication posture for a domain: SPF record and policy, DMARC policy and alignment, DKIM selector presence. Use it to judge whether mail claiming to be from a counterparty can be trusted. Live DNS.

Analyse a domain for brand impersonation: homoglyph substitution, character insertion and omission, TLD swaps and known-brand proximity. Returns a suspicion verdict with the specific patterns matched. Heuristic — a match is a reason to check, not proof of intent.

Live TLS probe of a hostname: certificate validity and expiry, issuer, chain completeness, protocol and cipher. Confirms an endpoint you are about to send data to is actually serving a valid certificate right now.

Check before you pay or trade: pass / review / block for one wallet or contract address (EVM chains, Solana). Use it before you pay, trade with or approve an address: one cheap call returns pass, review or block with the reasons and the list dates.

Use this as a lighter-weight fraud signal than check_carrier_identity: how many distinct business addresses and phone numbers a carrier reports across FMCSA's independent records of it (census, licensing and insurance, crash reports). Several different addresses on one carrier is a common re-registration tell. Billed whenever the USDOT number resolves.

Use this when a carrier looks suspicious — a name change, a new USDOT number tied to an old fleet, a business you suspect re-registered after a revocation — and you need the full evidence: every other USDOT number sharing a contact identifier with it, and whether any of them carries a revocation or suspension motive. Call the free screen_carrier_identity first if you only need the flag and a count. Billed whenever the USDOT number resolves, even with no links found.

Adler-32 checksum (as used by zlib) over the input payload. Faster than CRC-32 but weaker for short inputs. Returns the checksum as an unsigned integer and 8-digit hex. Non-cryptographic.

CRC-16 over the input payload in one of several standard variants (ccitt-false, xmodem, modbus, ibm; default ccitt-false). Returns the checksum as an unsigned integer and 4-digit hex. Non-cryptograph…

Solana token safety / rug-pull check for SPL tokens (pump.fun, Raydium, Meteora, Jupiter): one-sentence verdict, blocking/warnings/unknowns, mint & freeze authority, RugCheck score & risks, LP locked %, holder count & top-10 concentration, liquidity & price, 1h volume & buy/sell flow, age -> casino|speculative|legit.

Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.

Static security scan of a SINGLE CI/CD job or step snippet (GitHub Actions, GitLab CI or CircleCI). The lightweight per-object form of /ci/scan: returns a verdict (pass, caution, block), a risk score and findings with rule, severity, location and fix hint. Security indicators, not a guarantee.

Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.

Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.

Returns the CISA Known Exploited Vulnerabilities feed for active threat monitoring.

Check citation metadata before an evidence review. Compare up to 20 declared source identities, revisions and locators; return exact mismatches and an integrity receipt. No source retrieval, passage-existence check or claim-support verification.

Check citation metadata before an evidence review. Compare up to 20 declared source identities, revisions and locators; return exact mismatches and an integrity receipt. No source retrieval, passage-existence check or claim-support verification. New modular adapter: retained result recovery for 24 hours, minimal receipt metadata for 90 days. Existing live route unchanged.

Domain and email security audit: SPF, DMARC, DKIM, MX, DNSSEC, CAA, HTTPS, HSTS, security headers and HTTP-to-HTTPS redirect, with a grade and the fixes to make.

OpenAI-compatible moderation (Llama Guard 3): same response shape as OpenAI /v1/moderations with flagged, categories and category_scores, plus the raw Llama Guard codes. Up to 10 inputs per call. Priced by size: $0.003 + $0.0004 per input + $0.0004 per 1,000 characters. Also callable as GET with the same fields as query parameters.

Verifiable random numbers from the drand public beacon (League of Entropy): numbers in a range, or a fair shuffle and pick of your items, with the beacon round so anyone can re-check the result.

Know Your Agent: trust check on an agent's wallet before you transact with it. x402 payment history matched against every seller in Coinbase's x402 directory (payments, USDC spent, sellers, last payment), wallet age, smart wallet or key, balances, OFAC sanctions screen, listed seller status, and a risk score with a plain verdict.

Breached password check: is this password in known data breaches, and how often? Send only the SHA-1 hash (never the password); just the first 5 characters reach Have I Been Pwned (k-anonymity). Up to 50 hashes per call.

Safety check (Llama Guard 3): classify up to 10 texts as safe or unsafe with hazard categories (violence, weapons, hate, self-harm, sexual content, privacy, elections and more). Check user input or your own reply before posting. Priced by size: $0.003 + $0.0004 per text + $0.0004 per 1,000 characters. Also callable as GET with the same fields as query parameters.

Package vulnerability check for coding agents: known CVEs/GHSAs for an npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet or Packagist package version, with severity, fixed versions and the latest release (OSV.dev).

Verify an email address: syntax check, domain MX lookup, disposable-domain and role-account flags. Use before sending or storing an address.