Security x402 offerings

Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents.

Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents.

Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents.

Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents.

Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents.

Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents.

Verify claims, resolve FIGI identity, extract claims, and sign x402 delivery receipts over MCP.

Verify claims, resolve FIGI identity, extract claims, and sign x402 delivery receipts over MCP.

Verify claims, resolve FIGI identity, extract claims, and sign x402 delivery receipts over MCP.

Cryptographically signed market state verification for autonomous financial agents.

Cryptographically signed market state verification for autonomous financial agents.

x402 payment security and pre-execution transaction risk screening for autonomous AI agents.

HostDeFi weekly safety-snapshot dataset: all graded tokens across 4 chains plus authority states, holder concentration and the gate-exit ledger

⚠️ BETA — IOC data under active verification 2026-05-25, do not rely on matches for production. Supply chain attack IOC catalog. List active campaigns: npm, PyPI, Composer. Shai-Hulud, TanStack, Laravel-Lang. For coding agents pre-install audit. Accepts payment on Base or Solana — either network works.

New vulnerabilities in one place: CISA Known Exploited Vulnerabilities from the last 14 days (due dates, ransomware use), CVEs published in the last 24 hours (CVSS, severity, CWE, vendor/product), and reviewed GitHub advisories (ecosystem, package, vulnerable and patched versions). Rebuilt every hour. $0.01 per call, no account. Free 24h-delayed sample: GET https://ioswarm.io/api/v1/feeds/security/sample.

New vulnerabilities in one place: CISA Known Exploited Vulnerabilities from the last 14 days (due dates, ransomware use), CVEs published in the last 24 hours (CVSS, severity, CWE, vendor/product), an…

Canonicalizes device_id, nonce and message, computes an HMAC-SHA256 tag with caller-supplied ephemeral key material, and optionally compares a claimed tag in constant time. It does not provision devi…

Canonicalizes firmware hash, version, device model and minimum bootloader version, then produces a SHA-256 manifest digest and HMAC-SHA256 release tag using caller-supplied ephemeral key material. Th…

Canonicalizes firmware hash, version, device model and minimum bootloader version, then produces a SHA-256 manifest digest and HMAC-SHA256 release tag using caller-supplied ephemeral key material. This is a symmetric integrity tag, not a vendor PKI signature or code-signing service.

Canonicalizes device_id, nonce and message, computes an HMAC-SHA256 tag with caller-supplied ephemeral key material, and optionally compares a claimed tag in constant time. It does not provision devices, store keys or replace asymmetric device identity; do not submit long-lived production secrets.

AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into. Pass ip (IPv4 or IPv6). Returns abuseConfidenceScore, totalReports, numDistinctUsers, lastReportedAt, usageType (e.g. Data Center / Residential), ISP, domain, hostnames, isTor, isWhitelisted, and country. Set verbose=true for the individual report records (categories + reporter country). Optional maxAgeInDays (1-365, default 90) bounds the reporting window. Live crowd data an LLM cannot know — SOC alert triage, login-abuse blocking, and firewall decisions.

Check an IP address against 15 major DNS blacklists (Spamhaus, Barracuda, SORBS, etc.) simultaneously — returns which lists it appears on, a reputation score, and a threat classification so agents can make block/allow decisions instantly.

Use when an agent must decide whether an IP is already known for abuse: it checks one IPv4 address against nine public DNS blocklists at once — SpamCop, UCEPROTECT, PSBL, Barracuda, DroneBL and four more — and returns each list's raw code and the reason text it publishes, not a score. Every list is re-checked on each call with its RFC 5782 test entry, so a dead list comes back as unavailable instead of reading as clean. Includes the delisting URL for each hit.

IP lookup and geolocation: resolve any public IPv4 or IPv6 address to location and network data from a local database (no third-party call, answers in milliseconds): country, country_code, region, city, lat/lon, IANA timezone, continent, is_eu, ASN with organization (isp, org, asn). Use for fraud and bot checks, geo-routing, analytics, or tagging traffic. Invalid, private and reserved addresses are rejected for free. Params: ip (defaults to the caller's IP).