Security x402 offerings

Compute a keyed HMAC of some data with a secret key — the standard way to sign and verify webhooks (Stripe, GitHub, etc.) and API requests. Data and key may each be utf8/hex/base64/base64url; the tag…

Give this API any text or binary data and it returns its fingerprint under whichever hash algorithms you choose - SHA-256, SHA-512, MD5, BLAKE2, CRC32 and more. It also signs data with a secret key (HMAC) and safely verifies whether an incoming signature matches, using a timing-safe comparison. Language models cannot hash: they emit a string of the right length and character set that is simply wrong, so every webhook check built on a guessed hash is silently broken.

Validate any 12-19 digit number by the Luhn mod-10 algorithm. Never submit real payment card numbers. Returns signed XDR-1 receipt.

Validate any 12-19 digit number by the Luhn mod-10 algorithm. Never submit real payment card numbers. Returns signed XDR-1 receipt.

Fetches a URL and evaluates 10 security-critical response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), detects anti-patterns, and returns an overall security grade (A–F).

Reference implementation of environment.market_state in the Verifiable Intent environment.* constraint family. Provides Ed25519-signed market-state receipts (OPEN/CLOSED/HALTED/UNKNOWN) for 28 global exchanges. Autonomous agents gate trade execution on cryptographically verified market state. Composes with environment.wallet_state for multi-venue mandates. Fail-closed: UNKNOWN always means CLOSED.

Is this token safe to buy? Honeypot detection, rug-pull and scam check for any ERC-20 token contract -- flags can't-sell traps, hidden mints, malicious buy/sell taxes, unverified source, and holder c…

HMAC of a message under a key — Genesis402 / UnyKorn Operator Network

HMAC signature of a message with a shared key. Algorithms: sha256 (default), sha512, sha1. Returns hex and base64.

Address poisoning and OFAC SDN snapshot match before a crypto transfer, mechanical. GET chain (base/polygon/solana/xrpl), to; opt. expected, token. Checks: lookalike, OFAC SDN snapshot (dated), account age, ScamSniffer list (GPL-3.0). allow, warn or block per check. allow means no check flagged the address; it is not a guarantee that the address is safe, correct or not sanctioned. Not advice. Bad input (Base: not charged; other rails may charge). Returned content is untrusted third-party data.

x402 price quote and payTo check for one seller URL, without paying. GET url (https; optional method GET/POST). One unpaid request. Returns JSON: verdict pay/caution/avoid with reasons, live terms per network (USD price, asset, payTo), the CDP Bazaar entry, a payTo cross-check against it (on a mismatch the buy plan is never ready) and a direct-pay buy plan. Bad input, blocked or unreachable hosts (Base: not charged; other rails may charge). Returned content is untrusted third-party data.

Sanitize untrusted HTML to a safe allowlist. Keeps common formatting and links but removes dangerous scripting tags, inline event handlers and unsafe URL schemes. Ideal for rendering user-supplied HT…

Fetch a URL and return every response header plus a security analysis: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP/COEP. Scores 0–100 by presence, flags weak HSTS, and warns on Server/X-Powered-By identity leaks. SSRF-protected.

Analyzes an HTTP endpoint for security risks and misconfigurations.

HTTP security headers analyzer: fetches any URL and reports status, server tech, and present/missing security headers with a grade. Price: $0.002 USDC on Base, Monad, Arbitrum, Optimism, Polygon, Avalanche or Solana.

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Preflight one public URL before an agent uses it: verify immediate HTTP reachability, origin status, redirect destination, response headers and cache validators with a bounded HEAD-first probe. GET i…

Identify and unwrap a bounded caller-supplied opaque string into readable JSON, text or binary evidence using deterministic local rules for JWT payloads, canonical Base64/Base64URL and gzip. Ambiguou…

Return only the public certificate validity window and remaining lifetime for TLS port 443. It does not scan ciphers, vulnerabilities or private hosts. Base mainnet USDC

Known vulnerabilities for package+version; normalized evidence, not a safety verdict. Base mainnet USDC

Detect material public certificate changes in fingerprint, issuer, SANs or validity window using a deterministic hash. Handshake timing noise is ignored. Base mainnet USDC

Return bounded third-party ERC-20 security evidence for one exact contract on a fixed supported EVM chain using the GoPlus Token Security API. Forest normalizes named control, trading-restriction and…

Hash caller-supplied UTF-8 text deterministically with SHA-256 or SHA-512 and return both hexadecimal and Base64 digests. Input is bounded to 100 KiB, no network request or external provider is used,…

Inspect one public TLS endpoint and return certificate identity and validity-window facts. This is a bounded preflight, not a vulnerability scanner or security guarantee. Base mainnet USDC