Security x402 offerings

Approve or deny an agent action instantly against a human-set policy — no waiting. Returns a signed decision receipt; anything over the policy line escalates to a human. Input: ?action=&counterparty=&amount= (counterparty required)

Look up the track record of any domain or wallet: how many times it has been assessed, verdict history, times flagged, first and last seen, a reputation score and a signed credential — a credit score for counterparties. Computed only from DYOE's own logged prior assessments; thin history is labeled as such. Input: ?target=

Is this online store safe to buy from? Scam/fraud check + trust verdict (safe/caution/avoid) + store signals (checkout, returns, payment methods) — counterparty trust for shopping & commerce agents before they pay. Input: ?url=

Check whether a website, business, or wallet is a scam before an agent trusts or pays it — fraud, phishing and rug-risk screening. Returns verdict (safe/caution/avoid), trust_score, domain age, red_flags. Input: ?target=domain

Screen a crypto wallet address before an agent sends funds to it: OFAC sanctions check, on-chain footprint (empty or disposable address), human-vouch overlay. Returns verdict (safe/caution/avoid), sanctioned flag, on-chain activity, red_flags. Input: ?address=0x...

Score any website 0-100 for legitimacy, trust, SEO and contactability — due diligence on a company in one call. Returns a verdict plus prioritized fixes. Input: ?url=domain

Verify one Ed25519 signature over up to 8,000 characters of exact UTF-8 receipt text using a supplied 32-byte public key. Returns cryptographic validity and message hash. Does not establish issuer identity, trusted time, licensing or the truth of the receipt. No private keys accepted.

Verify one Ed25519 signature over up to 8,000 characters of exact UTF-8 receipt text using a supplied 32-byte public key. Returns cryptographic validity and message hash. Does not establish issuer identity, trusted time, licensing or the truth of the receipt. No private keys accepted. New modular adapter: retained result recovery for 24 hours, minimal receipt metadata for 90 days. Existing live route unchanged.

Verified URL Evidence Snapshot: bounded credential-free public HTTPS observation pinned to public IPv4, with HTTP headers, authenticated TLS, seven checks, and optional SHA-256 content fingerprint. Defaults: url=https://example.com/ and content_fingerprint=true. Request-target limits: 2300 raw UTF-8 bytes; 2302 bytes as a JSON string.

Deterministic read-only audit of a public x402 v2 GET endpoint: protocol, payment binding, Base USDC, Bazaar discovery, leakage checks, remediations, and SHA-256 report integrity.

Deterministic read-only audit of a public x402 v2 GET endpoint: protocol, payment binding, Base USDC, Bazaar discovery, leakage checks, remediations, and SHA-256 report integrity.

Vet an x402 server or any URL for scam/phishing/trust in ONE call: transport, content-safety, domain, metadata + x402-compliance sub-scores, each with transparent evidence

Audit text for malicious AI-skill patterns. Requires `content`. Nothing to audit — crawling, or discovering this endpoint cold? POST /audit/registry runs the same scanner over the newest servers in t…

Scan the newest servers in the official MCP registry for supply-chain risk — no input required

Scan an entire public GitHub repo for malicious AI-skill/supply-chain patterns. Requires `repo`. No repo in mind? POST /audit/registry runs this same scanner over the newest servers in the official M…

Fetch a URL and grade its HTTP security headers (HSTS, CSP, X-Frame-Options, etc.)

Fetch a URL and audit its content. Requires `url`. No URL to hand? POST /audit/registry runs the same scanner over the newest servers in the official MCP registry: no input required, $0.005.

One-call company and domain profile from public records: RDAP registration (age, registrar, status, expiry, nameservers) plus certificate-transparency history for infrastructure footprint and subdoma…

Certificate-transparency history for a domain (crt.sh) — every TLS certificate issued, which doubles as subdomain discovery

Known vulnerabilities for a package (OSV.dev — aggregate of GHSA, PyPA, RustSec, Go and more) or a free-text CVE search (NVD), with severity and fixed versions

One-call counterparty check: wallet activity profile (EOA vs contract, balances, tx count, risk flags) plus OFAC SDN sanctions screening, resolved into a single clear/blocked verdict. Reports 'unscre…

Supply-chain health from deps.dev: OpenSSF Scorecard (14 checks — branch protection, signed releases, pinned deps…) plus stars, license and open issues

Use when an agent must decide whether to write to an address, or clean a list before sending: it scores one email 0-100 with a verdict (ok, risky, disposable, undeliverable, invalid) and the evidence under it: every point lost is itemised with the field that proves it. 12,141 disposable domains from two maintained open lists pinned to a commit, 4,897 free providers, 1,018 role names, typo fix (gmial.com > gmail.com), live MX/SPF/DMARC. No SMTP probe, no API key.

Email authentication posture check: parses SPF, DMARC and DKIM plus MX for any domain and grades deliverability/anti-spoofing gaps (SPF +all, SPF >10 lookups, DMARC p=none, missing DKIM). Clean JSON for deliverability and security-ops automation.