Security x402 offerings

Pay-per-call: Agent Skill Supply-Chain Risk Scan

Pay-per-call: Agent Input Guard — Prompt Injection & Agent Security

Pay-per-call: true402 Wallet Risk — reported scams & theft, contract risk, before you send or approve

Pay-per-call: true402 Robots Check — robots.txt & llms.txt: which AI crawlers are allowed

Pay-per-call: Agent Skill Supply-Chain Risk Scan

Pay-per-call: true402 Security Headers Check — HTTP headers grade (CSP, HSTS, cookies)

Token safety & rug check — on-chain honeypot/tax/owner-privilege/holder-concentration risk verdict for any EVM token (GoPlus + DexScreener). Pay-per-call via x402. An empty body is answered for USDC on Base (the x402 settlement asset); send {"token":"0x…"} for any other token.

Address intelligence on Base — EOA/contract/ERC-20 + nonce + ETH/USDC balance + keyless GoPlus security verdict (phishing/sanctioned/mixer/…). The loop input for triaging a counterparty. Pay-per-call via x402. An empty body is answered for the wallet that pays on Base (the payment's signer); send {"address":"0x…"} for any other address.

Is this email address worth sending to? Syntax, domain DNS (MX, then A/AAAA), disposable/role/free-provider lists, a typo suggestion (gmial.com -> gmail.com), a normalized form and a risk verdict with reasons. No SMTP probe: it vouches for the domain, never the mailbox. An invalid address is a paid verdict; a DNS failure is 502, not charged. Pay-per-call via x402. An empty body is answered for the published example address (name@example.com); send {"email":"…"} for any other address.

Find AI agents by skill: searches what live ERC-8004 agents declare (skill, domain or name) and returns each match with its endpoint, payout wallet and that wallet's risk band and OFAC sanctions verdict, plus a funding cluster when two rows are one operator. Optionally only agents that accept x402. 100 per page. Base. Free: GET /v1/search. Trial: /v1/trial.

Find the security page of a website: fetches the homepage, scans link text and URLs for security patterns and returns the best candidate URL(s) with the anchor text, plus a confidence. Agents use it to land on the right page without crawling. $0.01 per site.

Bulk fix fastmail typo domain: up to 20 emails in one call, processed concurrently, results in input order with a per-item error field and a failure count. Same answer per item as the single endpoint. Batch enrichment for agents that hold a list. $0.10 per batch.

Did the user mistype hotmail.com? Checks the domain part against 9 known misspellings of hotmail.com (hotmial.com, hotmal.com, hotmai.com…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype icloud.com? Checks the domain part against 5 known misspellings of icloud.com (iclould.com, icloud.co, icloud.cm…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype mail.ru? Checks the domain part against 3 known misspellings of mail.ru (mail.com.ru, mial.ru, mail.ur…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype naver.com? Checks the domain part against 3 known misspellings of naver.com (naver.co, navr.com, naver.con…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype orange.fr? Checks the domain part against 2 known misspellings of orange.fr (orange.com, ornage.fr…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype pm.me? Checks the domain part against 2 known misspellings of pm.me (pm.com, pmme.com…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype proton.me? Checks the domain part against 4 known misspellings of proton.me (protonmail.co, proton.com, protonmial.com…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Did the user mistype rogers.com? Checks the domain part against 3 known misspellings of rogers.com (rogers.ca, roger.com, rogers.co…) and edit-distance near-misses, returning whether it is a likely typo and the corrected address. Fix signups before the confirmation mail bounces. $0.01 per check.

Use when an agent is about to approve, buy, or first interact with an unfamiliar Base token or contract and needs a safety verdict before risking funds. Flow contract safety verification: send a token or contract address on Base and get a verdict (safe|caution|danger), a 0-100 safety score, the red flags found, and plain-English agent advice (APPROVE / REVIEW_MANUALLY / DO_NOT_APPROVE).

Use when an agent is about to approve, buy, or first interact with an unfamiliar Base token or contract and needs a safety verdict before risking funds. Flow contract safety verification: send a toke…

Use this when a carrier looks suspicious — a name change, a new USDOT number tied to an old fleet, a business you suspect re-registered after a revocation — and you need the full evidence: every othe…

Use this as a lighter-weight fraud signal than check_carrier_identity: how many distinct business addresses and phone numbers a carrier reports across FMCSA's independent records of it (census, licen…