Security & trust

HTTP Header Audit

BTC Volatility Risk Premium — DVOL minus Parkinson realized vol (72h). Positive = sell-vol opportunity, negative = buy-vol. Response includes regime classification (LOW/MID/HIGH), raw inputs for audit (DVOL, RV_72h, RV_6h, spot), timestamp, and open methodology URL.

Unforgeable operating history for any AI agent attesting through TenPrint: record count, first-seen date, continuity days, and recent activity, computed from HCS-anchored attestations that cannot be backdated.

Official USD/BRL and EUR/BRL exchange rates (PTAX, Central Bank of Brazil).

Batch KYA Trust Score analysis for up to 50 AI agent or wallet addresses in one call. Returns a per-address 7-component trust score (0-100), risk tier, and sanctions status.

CVE vulnerability lookup. Returns security vulnerability records by CVE id or keyword from the NIST National Vulnerability Database and GitHub Security Advisories, each with CVSS score, severity, CWE weakness class, affected products, and references, filterable by severity and source. For vulnerability triage and dependency risk checks. Keyless.

Signed bearer temporal evidence for cross-node execution-window grounding and audit

Is anything breaking right now? Composite crypto market-stress digest: a 0-100 score (low/moderate/elevated/high) blended from GLOBAL USD-stablecoin depeg health (DefiLlama) and BASE on-chain DEX exit-liquidity, with a per-leg breakdown and an AI risk line. Covers stablecoin systemic risk + Base liquidity microstructure (NOT derivatives or sentiment). Both legs required. A read older than an hour regenerates inline. $0.002 per call.

Score a URL for phishing risk before an agent opens or trusts it. Keyless, deterministic heuristics - typosquat / homoglyph of a known brand, punycode / mixed-script hosts, credentials-in-URL, raw-IP hosts, suspicious TLDs, over-deep subdomains - plus a best-effort domain-age check (young domains are a top phishing signal). Returns a 0-100 risk score, a SAFE / SUSPICIOUS / DANGEROUS verdict, and labelled reasons. No API keys, no LLM.

Screen an EVM wallet or contract address BEFORE paying it. Deterministic, keyless compliance / safety gate: checks the address against the OFAC sanctioned crypto-address list and a curated taint set (mixer, hack, scam) and returns a single BLOCK / REVIEW / ALLOW recommendation plus the matched sources, so an AI agent can decide whether to send funds. No API keys, no LLM, one x402 USDC micropayment per call.

Detect the technology stack of a public website: CDN, web server, language/runtime, frontend framework (Next.js, Nuxt, SvelteKit, Remix, Astro, React, Vue, Angular), CMS (WordPress, Drupal, Ghost, Shopify, Wix, Squarespace, Webflow), analytics (GA, GTM, PostHog, Mixpanel, Segment, Hotjar, Plausible, Fathom), and payments (Stripe, PayPal). Signature-based; no third-party API.

AgentCheck: independent report on an x402 seller before you pay it. Are its buyers real (repeat wallets on their own money) or funded by the seller itself, measured from 30 days of on-chain payments, plus results of our own paid test purchases where we have them. Query: ?domain=<seller-domain>. GET /sellers (free) lists covered domains.

Splits caller-supplied proposal text into sentences, scores each sentence by normalized non-stopword frequency, and returns the highest-scoring sentences in source order. It does not infer unstated intent, verify claims, or produce an abstractive interpretation.

Calculates each group positive-outcome rate, compares it with an explicit or automatically selected reference group, and reports rate differences and selection-rate ratios. Aggregate disparity metrics do not establish discrimination, fairness, causation or legal compliance and can conceal intersectional or sampling effects.

Run a fast live probe for one x402 endpoint and summarize challenge/payment-flow readiness.

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Website uptime and change check: is this URL up right now, and has the page changed? Fetches the URL and returns the HTTP status, Last-Modified and ETag headers, a SHA-256 fingerprint of the content, and whether it changed versus a hash you pass in. Use it to check a site is live, detect stale data, monitor a page for changes, or decide whether to invalidate a cache before your agent acts on what it says. Returns a signed attestation.

The Confession. REQUIRES ?confession= on the paid request — a signed request without it is refused before the gate and no money moves. A signed absolution certificate and a private confession_receipt proving the exact stored text and purchase certificate. Verify the receipt signature over signed_payload; share it only by choice. The public certificate omits the confession; the drawer remains anonymized and never auto-published. Full listing: https://scvd.store/menu/the_confe…

Site SEO Audit by Cult OS

TradFi risk-on/risk-off in one $0.003 call for crypto agents. Returns the S&P 500 and Nasdaq-100 regime state, how many equity sectors are green out of 11 (breadth), whether the permission ladder allows risk at all, and the same engine's BTC/ETH trend gate — size against equity risk appetite instead of guessing. Regime states flip rarely (days, not minutes); recomputed ~5-9 min in-session by a live long-only engine scoring ~565 US names. Research, not advice.

Phone-number intelligence in one call: validity and E.164 normalization, line type (mobile, fixed line, VOIP, toll free, premium rate), country and region, carrier hint, timezones, and a deterministic 0-100 fraud/KYC risk score with a band and reasons. Offline number-plan metadata from Google libphonenumber. Risk indicators only, not a definitive fraud verdict; no live status and no owner identity; the input number is not stored.

Grade any x402 seller's payment-security posture from the outside - a read-only black-box check mapped to the 'Five Attacks on x402' failure modes. Probes the URL's 402 challenge (never pays) and scores TLS transport, gated-response cache hygiene (Attack III / cache leakage), error/info-leak hygiene, and payment-terms well-formedness, then returns a letter grade with per-check findings and an honest note on what only insider/active testing can confirm.

Return only the public certificate validity window and remaining lifetime for TLS port 443. It does not scan ciphers, vulnerabilities or private hosts. Base mainnet USDC

Give this API any text or binary data and it returns its fingerprint under whichever hash algorithms you choose - SHA-256, SHA-512, MD5, BLAKE2, CRC32 and more. It also signs data with a secret key (HMAC) and safely verifies whether an incoming signature matches, using a timing-safe comparison. Language models cannot hash: they emit a string of the right length and character set that is simply wrong, so every webhook check built on a guessed hash is silently broken.

Current multi-hazard intelligence for any coordinates. Finds nearby wildfire, earthquake, flood, tropical cyclone, volcano, and drought signals and returns compact deterministic risk scores without generating satellite images.

Verify a URL: does it resolve, what's the final status and redirect chain, is it archived on the Wayback Machine, and (optionally) does expected text appear on the page. Checked via direct fetch and the Internet Archive.

Unforgeable operating history for any AI agent attesting through TenPrint: record count, first-seen date, continuity days, and recent activity, computed from HCS-anchored attestations that cannot be backdated.

Scan supplied code with transparent deterministic rules for common secret, injection, shell, weak-hash, and Solidity risks. This is not a professional audit.

Domain age and registration intel from authoritative RDAP/WHOIS records: exact creation date, age in days and years, expiration date and days-until-expiry. The fast trust and risk signal agents use to vet a counterparty, link, or sender and to flag newly-registered or soon-to-expire domains. Returns structured JSON, keyless, pay-per-call. ccTLDs without RDAP return an uncharged 503.

Reputation of a public IP address for anti-abuse and KYC. Returns ASN, AS-org, country, datacenter/hosting classification, Tor-exit and Spamhaus DROP flags, plus a deterministic risk score with reasons.