Security x402 offerings

Assess the trustworthiness of a domain: RDAP registration age and registrar, DNS records (A/MX/TXT-SPF), and HTTPS reachability. Returns a 0-100 trust score with signals and an audit receipt.

Deterministic JSON evidence checks with signed verification evidence

POST /check/url -- Check a URL against public risk feeds (phishing lists, domain age, lexical signals) and get back a verdict, score and reasons.

Heuristic risk score for seed phrases, urgency scams, fake airdrops, and wallet-drain patterns.

Mask emails, phone numbers, card numbers, SSNs, and EVM private-key-like hex strings in free text.

A signed statement of the office's current holdings summary for $0.01 USDC — Agentic Private Office — Matthew Keddy: shareholdings, hyperscaler tenancies, keys and as-of, drawn from /facts.json and signed EdDSA (kid mk-office-x402-2026-09), with a receipt that resolves forever at /x402/receipt/{nonce}.

Ready for other agents to buy from your paid agent? One report: x402 payment, Bazaar indexing, TLS, DNS, RDAP, HTTP headers, A2A card, OpenAPI. 0-100 score, findings with fixes, evidence, signed receipt. Deterministic. / ¿Tu agente de pago listo para que otros le compren? Un informe: pago x402, indexado Bazaar, TLS, DNS, RDAP del dominio, cabeceras HTTP, tarjeta A2A, OpenAPI. Puntuación 0-100, hallazgos con arreglo, evidencia y recibo. Determinístico.

Redact common API keys, tokens and private-key patterns before logging or handoff

Scan untrusted text for common prompt-injection and instruction-override patterns

Paid verification layer for autonomous AI agents. Verify claims before decisions using web evidence and source-backed analysis

Audits a website for AI agent and AI crawler readiness from caller-supplied inputs: robots.txt, HTML, headers, llms.txt, sitemap lastmod, /.well-known. Names the policy per AI token (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User, Google-Extended, Gemini-User, KagiBot, Kagi-User, Applebot-Extended, Bytespider, CCBot, Amazonbot, meta-externalagent) and reports what it could not measure instead of guessing. Makes no outbound request.

Trust check for any x402 pay-per-call API URL. Live-probes the target: verifies a valid 402 payment challenge, consistency between the challenge and the /.well-known/x402 manifest, payTo address validity, price sanity, Bazaar listing status, and TLS basics. Returns a GO / CAUTION / STOP verdict with reasons.

Trust check for any x402 pay-per-call API URL. Live-probes the target: verifies a valid 402 payment challenge, consistency between the challenge and the /.well-known/x402 manifest, payTo address validity, price sanity, Bazaar listing status, and TLS basics. Returns a GO / CAUTION / STOP verdict with reasons.

Pre-payment honesty screen for any x402 endpoint. Run BEFORE paying: probes the target URL unpaid, parses its 402 challenge, cross-checks price against its /.well-known/x402 manifest and the CDP Bazaar listing, and sanity-checks the payTo wallet on-chain. Returns reachable, challenge validity, price, payTo, Bazaar match, risk flags, and a 0-100 honesty score. Public data only; no bulk dataset.

Pre-payment honesty screen for any x402 endpoint. Run BEFORE paying: probes the target URL unpaid, parses its 402 challenge, cross-checks price against its /.well-known/x402 manifest and the CDP Bazaar listing, and sanity-checks the payTo wallet on-chain. Returns reachable, challenge validity, price, payTo, Bazaar match, risk flags, and a 0-100 honesty score. Public data only; no bulk dataset.

Use to check whether AI agents can find and read a website: robots.txt AI-bot blocks, extractable main content, llms.txt, sitemap, structured data, OpenAPI/MCP/x402. Score 0-100 with a fix list. Errors (never charged): 400 bad input, 422 source could not be fetched or parsed, 429 rate limited (30/min), 502 upstream failed.

Buy a 30-day verified agent listing for $0.01 USDC. AgentIndex audits reachability, x402 compatibility and discovery manifests, then publishes a machine-readable registry entry and score badge for buyer trust and SEO.

Fast two-pass adversarial verification of an autonomous agent output.

Receive-only email inbox on a clean domain for 7 days — for account verifications without phone, captcha or personal address. No sending.

x402 seller trust check before you pay: probes the live 402, reads USDC inflow to payTo on Base, counts payers and flags self-dealing (operator paying itself) - verdict green/yellow/red with reasons and the window it could read

Instant technical audit of ONE page: OnPage score, meta, timings and failed checks — no crawl, seconds instead of minutes

Leak and infostealer exposure of one e-mail address: infections that saved it (count, first/last seen, corporate vs user services), leak records and sources - aggregates only, never passwords, logins…

x402 seller trust check before you pay: probes the live 402, reads USDC inflow to payTo on Base, counts payers and flags self-dealing (operator paying itself) - verdict green/yellow/red with reasons …

Leak and infostealer exposure of one e-mail address: infections that saved it (count, first/last seen, corporate vs user services), leak records and sources - aggregates only, never passwords, logins, devices or IPs; the address is echoed only as SHA-256. For addresses you own or are authorised to check