Security x402 offerings

Verify an Ed25519 execution certificate against the exact SQL statement you are about to run - the gate your database layer calls before it obeys an agent. Checks the signature, the certificate versi…

Verify a webhook's HMAC signature against the correct per-provider scheme: GitHub (X-Hub-Signature-256, sha256=hex), Stripe (Stripe-Signature t/v1 over "<t>.<body>" with replay tolerance), Shopify (X…

TLS/SSL security posture check: live certificate inspection, HTTP security headers, and CAA DNS records. SSL audit skill pack: one x402 payment runs 3 underlying tools (tls-cert, http-headers, dns-lo…

Validate a Cloudflare Turnstile, Google reCAPTCHA, or hCaptcha token server-side. You pass your OWN provider secret plus the token from the client; we relay to the provider's siteverify endpoint (nev…

Enumerate a domain's external attack surface in one workflow: certs, DNS posture, email auth, HTTP security headers, and tech stack. Security audit skill pack: one x402 payment runs 7 underlying tool…

Compute the current TOTP code (RFC 6238, 30s period, SHA-1, 6 digits) from a base32 secret. Useful for agents that must complete 2FA flows they are authorized for.

Inspect the TLS certificate of any public host: subject, issuer, validity window, days remaining, SANs, and SHA-256 fingerprint.

Is this domain trustworthy, or is it a phishing site / typosquat / scam? Pull the reputation signals an analyst checks before clicking anything: domain age, cert issuance history, hosting reputation,…

Look up a CVE by id, or search CVEs by keyword or product: the NVD description, CVSS severity and vector (v4.0, v3.1, v2), CWE weaknesses, affected products and versions (CPE), and reference links, j…

Score a password's strength: character-set size, entropy bits, a 0–4 rating, and an estimated offline crack time. The password is never stored or logged.

Extract EXIF metadata from an image (camera make/model, timestamps, exposure, orientation, GPS). Send a public image URL or a base64 image; JPEG, PNG (eXIf chunk), and TIFF carry EXIF. Stripped image…

What's a competitor using? Tech stack, HTTP headers, WHOIS, and page metadata in one call. Competitor scan skill pack: one x402 payment runs 4 underlying tools (tech-stack, http-headers, whois, meta)…

Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)

Fetch and validate a domain's DMARC policy at _dmarc.<domain> (RFC 7489). Surfaces the enforcement policy (none/quarantine/reject), reporting addresses, alignment modes, and common misconfigs (no rua…

Deterministic preflight check for a proposed AI agent action - a tool call, payment, fetch, or write - before it executes. Evaluates up to four independent checks (prompt-injection scan on action tex…

Classify an IP address: version, public/private/loopback/link-local, integer form, and reverse-DNS (PTR) lookup.

Risk facts for an EVM token before a trade. One deterministic call returns a verdict (ok, caution, unsafe) with the named facts behind it: honeypot, can-sell, buy and sell tax, mintable supply, hidde…

How old and legit is this domain? WHOIS registration, DNS resolution, and TLS certificate in one pass. Domain age and legitimacy skill pack: one x402 payment runs 3 underlying tools (whois, dns-looku…

Mint a signed JSON Web Token (HMAC: HS256 default, HS384, HS512) from a payload + secret. Pairs with jwt-decode/jwt-verify to complete the trio. Deterministic - same payload, secret, and alg always p…

Search public Certificate Transparency logs for every cert issued to a domain. Two independent public CT search services are queried, the second only if the first is slow or fails, and `source` names…

Decode a JWT without verification: header (algorithm), payload claims (subject, issuer, expiration), expiry status, and time remaining. (Decoding only - signatures are NOT verified.)

Publisher discovery decision fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Publisher discovery repair plan fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Agent card discovery audit fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.