Security x402 offerings

Dependency health across PyPI, npm, Go, Cargo, Maven, Composer, and NuGet via deps.dev and OSV: versions, licenses, and known vulnerabilities. POST /v1/tool with {package, ecosystem}, or GET /v1/pack…

Scan a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with a link to a lockfile on GitHub, GitLab or Bitbucket, the file pasted in, or a components array, an…

Decode, generate or validate barcodes and QR codes. Decode reads up to 32 codes from a public HTTPS image (QR, Data Matrix, Aztec, PDF417, EAN, UPC, Code 128 and more); generate answers a temporary H…

Detect and redact PII in text: find and mask names, addresses, SSNs, emails, and phone numbers. POST /v1/pii with {text} and get findings and masked output as one JSON object. Deterministic per rules…

Deterministic static pattern scan of Solidity smart-contract source text - a fixed ruleset flagging tx.origin authentication, delegatecall, selfdestruct, unchecked low-level calls, unchecked .send(),…

Full page SEO + security audit: content extraction, metadata, HTTP headers, robots policy, and sitemap health in one call. Page audit skill pack: one x402 payment runs 5 underlying tools (extract, me…

Full email auth posture: SPF, DMARC, DKIM, and composite deliverability score in one call. Email security skill pack: one x402 payment runs 4 underlying tools (spf-check, dmarc-check, dkim-lookup, em…

Fetch and parse a DKIM public-key record at <selector>._domainkey.<domain> (RFC 6376). Returns the parsed key params (algorithm, length, flags) so you can verify rotation status or key strength. Call…

Fetch a site's robots.txt and answer: may this user-agent crawl this path? Returns the matched rule and all declared sitemaps.

The production ingest path for every incoming webhook: verify the provider signature (GitHub / Stripe / Shopify / Slack, constant-time, replay-window enforced), schema-validate the now-trusted body a…

Triage a smart contract before an agent interacts with it: verified Solidity source, heuristic vulnerability scan, known-address check, function-selector resolution, and a read-only dry-run of the ex…

Take a signup form submission and run the full onboarding workup deterministically: validate the email, score the chosen password, mint a stable internal ID, derive a URL-safe handle from the display…

Check whether an email address has a Gravatar: hashes the normalized email (MD5, pure CPU - the raw address is never sent upstream), probes gravatar.com for an avatar, and fetches the public profile …

Check text for harmful content using OpenAI moderation (omni-moderation-latest). Returns flagged status, category breakdown (harassment, hate, self-harm, sexual, violence, etc.), and confidence score…

Mask emails, phone numbers, credit-card-like numbers, IPs, and SSNs in text. Returns the redacted text and counts by type.

Mint a stateless captcha challenge to gate your OWN endpoint: returns a human prompt plus a salted sha256 answer hash you keep and verify later (sha256(salt + normalized answer) === answerHash) - no …

HMAC signature of a message with a shared key. Algorithms: sha256 (default), sha512, sha1. Returns hex and base64.

Is this domain legitimate? WHOIS age, DNS resolution, scam/phishing search results, and HTTP headers for a quick trust assessment. Brand protection skill pack: one x402 payment runs 4 underlying tool…

Compute MD5, SHA-1, SHA-256, SHA-512, and CRC32 checksums of a string in a single call. Useful for verifying file or payload integrity across different checksum standards without needing five separat…

Decode and verify a JWT in one pass - see the payload and check the signature. JWT toolkit skill pack: one x402 payment runs 3 underlying tools (jwt-decode, jwt-verify, jwt-sign); partial-success per…

Fetch a URL and return every response header plus a security analysis: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP. Scores 0–100 by presenc…

Company name → verified identity + web footprint dossier: Wikidata facts, the official LEI legal-entity record, the SEC EDGAR filer, domain registration, tech stack, and brand favicon - in one pass. …

Full domain security and SEO intelligence in one call: WHOIS, DNS, TLS cert, HTTP headers, tech stack, robots policy, and certificate transparency. Domain intel skill pack: one x402 payment runs 6 un…

Cryptographic hash of a text string - sha256 (default), sha512, sha1 or md5 - returned as hex and base64. Use it for content fingerprints, integrity checks and deterministic ids; pure computation, in…