Security x402 offerings

Pay-per-call post-quantum proof services for autonomous agents: ML-DSA-65 signatures, decision attestation, provenance seals, CBOM sealing, Know-Your-Agent verification and independent x402 settlement notarization. Every paid response carries an offline-verifiable ML-DSA-65 receipt (3309-byte signature; public key at https://fractalai.net.co/.well-known/jwks.json). ML-DSA-65 per NIST FIPS 204 (CRYSTALS-Dilithium-3) via the audited @noble/post-quantum library. Not a CMVP-validated (FIPS 140-3) module; no government-suite conformance claimed. Pre-pilot, low volume. Transport: plain HTTP+JSON x402 resources (see each skill's x-fractalai.resource); the A2A JSON-RPC message/send method is NOT implemented.

Pay-per-Seal: one post-quantum (Dilithium-3) provenance seal + a self-contained ML-DSA-65/Dilithium-3 (NIST FIPS 204) signature — drand-timestamped, with on-chain anchoring attempted per call and reported in the response — over a dataset/training/content hash. EU AI Act (Art. 10/50/53) provenance for autonomous agents, x402-native.

Pay-per-Training-Provenance: an agent pays to seal the provenance of a dataset or training run — a C2PA-compatible manifest binding the dataset/artifact hash to a declared origin, served with a post-quantum ML-DSA-65 / Dilithium-3 (NIST FIPS 204) signature over the same canonical claim (manifest anchor: Dilithium-3). Built for EU AI Act Art. 10/53 training-data provenance. Privacy-preserving (only the hash is bound). x402-native.

Pay-per-Verify: an agent pays $0.01 to verify a post-quantum (ML-DSA-65 / Dilithium-3 or Dilithium-2, NIST FIPS 204; scheme auto-detected by size) signature over a message against a public key. A generic machine-to-machine PQC proof primitive for autonomous agents. x402-native.

FractalAI Notary: pay for an independent ML-DSA-65 attestation of an x402 settlement.

Pay-per-CBOM-Seal: a drand-timestamped, re-verifiable seal over a CycloneDX CBOM (ECMA-424) cryptographic inventory — a Dilithium-3 (NIST FIPS 204) `.cbomseal` cert PLUS an additive ML-DSA-65 / Dilit…

Pay-per-Proof: one post-quantum ML-DSA-65 / Dilithium-3 (NIST FIPS 204) signature over your message/hash, x402-native.

Pay-per-Training-Provenance: an agent pays to seal the provenance of a dataset or training run — a C2PA-compatible manifest binding the dataset/artifact hash to a declared origin, served with a post-…

Pay-per-KYA: an agent pays to verify another agent's post-quantum identity + scope credential (Dilithium-2, NIST FIPS 204), with a live FRC-55 on-chain reputation read. ERC-8004-aligned Know Your Age…

Pay-per-Verify: an agent pays $0.01 to verify a post-quantum (ML-DSA-65 / Dilithium-3 or Dilithium-2, NIST FIPS 204; scheme auto-detected by size) signature over a message against a public key. A gen…

Pay-per-KYA-credential: a post-quantum-signed agent identity + scope credential — a Dilithium-3 (NIST FIPS 204) credential PLUS an additive ML-DSA-65 / Dilithium-3 (NIST FIPS 204) served signature ov…

FractalAI Notary: pay for an independent ML-DSA-65 attestation of an x402 settlement.

Pay-per-Seal: one post-quantum (Dilithium-3) provenance seal + a self-contained ML-DSA-65/Dilithium-3 (NIST FIPS 204) signature — drand-timestamped, with on-chain anchoring attempted per call and rep…

Frame Ancestors Check: checks whether a CSP frame-ancestors directive contains a required source using only bounded caller-supplied values. Call when you need a bounded frame ancestors check result before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for Frame Ancestors Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base or Solana. First-party, sta…

Fusion anti-abuse risk score for an email and/or IP in one call. Combines domain-level email intelligence (MX, SPF, DMARC, disposable, free, role) with IP reputation into a deterministic 0-100 score with per-dimension reasons. Works with either input alone.

Fusion anti-abuse risk score for an email and/or IP in one call. Combines domain-level email intelligence (MX, SPF, DMARC, disposable, free, role) with IP reputation into a deterministic 0-100 score with per-dimension reasons. Works with either input alone.

Reputation of a public IP address for anti-abuse and KYC. Returns ASN, AS-org, country, datacenter/hosting classification, Tor-exit and Spamhaus DROP flags, plus a deterministic risk score with reasons.

Reputation of a public IP address for anti-abuse and KYC. Returns ASN, AS-org, country, datacenter/hosting classification, Tor-exit and Spamhaus DROP flags, plus a deterministic risk score with reasons.

Free audiobooks on "Murder": public-domain recordings (LibriVox and Internet Archive audio) whose subject tags match, with runtime, language and mp3 links, most downloaded first. Add words to narrow. $0.01 per page of 20.

Evaluates caller-supplied telemetry samples against declared reaction-time, actions-per-second, movement-speed, and impossible-event rules. Flags are review signals only; the service does not identify software, inspect a device, establish intent, or justify an automatic ban.

Evaluates caller-supplied telemetry samples against declared reaction-time, actions-per-second, movement-speed, and impossible-event rules. Flags are review signals only; the service does not identif…

Call after your agent completes an action it may later have to prove: seal the hashes of its input and output (only your action label and meta are published) into GBLIN's signed append-only transpare…

Call after your agent completes an action it may later have to prove: seal the hashes of its input and output (only your action label and meta are published) into GBLIN's signed append-only transparency log and get a portable receipt: Ed25519 signature, RFC 6962 inclusion proof, C2SP signed checkpoint; root anchored daily on Base (EAS). Proves existence and time, not correctness. Free reads and demo: gblin-mcp.gblin-mcp-worker.workers.dev/log

GDPR and imprint check of a website as a first-time visitor who has not clicked anything: which third parties load before consent (Google Analytics, Meta Pixel, Hotjar, Google Fonts, YouTube and Maps embeds and about 30 more), which cookies are set and which of them are known tracking cookies, whether a consent banner is shown, which tool runs it and whether it has a reject button on the first layer.