Security & trust

Free, read-only security scanner for remote MCP servers, before you connect them.

UK property data: prices, rents, valuations, sold prices, planning, flood risk, titles and UPRNs.

UK estate-planning calculators + knowledge (IHT, intestacy, trusts, wills). Read-only.

Check if an MCP server tool changed or hides injection patterns before you trust it.

Instagram audits, carousel decks, AI images and video with one consistent face — from chat.

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Website uptime and change check: is this URL up right now, and has the page changed? Fetches the URL and returns the HTTP status, Last-Modified and ETag headers, a SHA-256 fingerprint of the content, and whether it changed versus a hash you pass in. Use it to check a site is live, detect stale data, monitor a page for changes, or decide whether to invalidate a cache before your agent acts on what it says. Returns a signed attestation.

The Confession. REQUIRES ?confession= on the paid request — a signed request without it is refused before the gate and no money moves. A signed absolution certificate and a private confession_receipt proving the exact stored text and purchase certificate. Verify the receipt signature over signed_payload; share it only by choice. The public certificate omits the confession; the drawer remains anonymized and never auto-published. Full listing: https://scvd.store/menu/the_confe…

Site SEO Audit by Cult OS

TradFi risk-on/risk-off in one $0.003 call for crypto agents. Returns the S&P 500 and Nasdaq-100 regime state, how many equity sectors are green out of 11 (breadth), whether the permission ladder allows risk at all, and the same engine's BTC/ETH trend gate — size against equity risk appetite instead of guessing. Regime states flip rarely (days, not minutes); recomputed ~5-9 min in-session by a live long-only engine scoring ~565 US names. Research, not advice.

Grade any x402 seller's payment-security posture from the outside - a read-only black-box check mapped to the 'Five Attacks on x402' failure modes. Probes the URL's 402 challenge (never pays) and scores TLS transport, gated-response cache hygiene (Attack III / cache leakage), error/info-leak hygiene, and payment-terms well-formedness, then returns a letter grade with per-check findings and an honest note on what only insider/active testing can confirm.

Return only the public certificate validity window and remaining lifetime for TLS port 443. It does not scan ciphers, vulnerabilities or private hosts. Base mainnet USDC

Publisher discovery audit fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Attested sanctions and export-control screening: OFAC SDN and Consolidated (primary and alternate spellings), UN Security Council, UK OFSI, EU and BIS Denied Persons. Fuzzy token matching (screen-matc

Verify a citation: does it exist, is it retracted, and do the given title/authors/year/journal match the canonical record? Checked against Crossref (retraction data included) with OpenAlex as a fallback when no DOI is given.

ERC-8004 agent reputation with sybil filtering: reviewers are clustered by who funded them and each cluster counts once, so reviewers paid for from one wallet count as one vote. Returns feedback and reviewer counts, independent clusters, the sybil-flagged share, counts by evidence class (payment proof, task link, none) and per-tag means, and refuses to average tags with conflicting scales. Base. Free: GET /v1/verify. Trial: /v1/trial.

Give this API any text or binary data and it returns its fingerprint under whichever hash algorithms you choose - SHA-256, SHA-512, MD5, BLAKE2, CRC32 and more. It also signs data with a secret key (HMAC) and safely verifies whether an incoming signature matches, using a timing-safe comparison. Language models cannot hash: they emit a string of the right length and character set that is simply wrong, so every webhook check built on a guessed hash is silently broken.

Expand a shortened or redirecting URL: follows the redirect chain server-side and returns every hop plus the final destination, re-validating each hop against SSRF.

Current multi-hazard intelligence for any coordinates. Finds nearby wildfire, earthquake, flood, tropical cyclone, volcano, and drought signals and returns compact deterministic risk scores without generating satellite images.

Verify a URL: does it resolve, what's the final status and redirect chain, is it archived on the Wayback Machine, and (optionally) does expected text appear on the page. Checked via direct fetch and the Internet Archive.

Unforgeable operating history for any AI agent attesting through TenPrint: record count, first-seen date, continuity days, and recent activity, computed from HCS-anchored attestations that cannot be backdated.

Scan supplied code with transparent deterministic rules for common secret, injection, shell, weak-hash, and Solidity risks. This is not a professional audit.

Domain age and registration intel from authoritative RDAP/WHOIS records: exact creation date, age in days and years, expiration date and days-until-expiry. The fast trust and risk signal agents use to vet a counterparty, link, or sender and to flag newly-registered or soon-to-expire domains. Returns structured JSON, keyless, pay-per-call. ccTLDs without RDAP return an uncharged 503.

Reputation of a public IP address for anti-abuse and KYC. Returns ASN, AS-org, country, datacenter/hosting classification, Tor-exit and Spamhaus DROP flags, plus a deterministic risk score with reasons.

Fetches a URL and evaluates 10 security-critical response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), detects anti-patterns, and returns an overall security grade (A–F).

US Treasury interest rates: the Daily Treasury Par Yield Curve fused with the average interest rates on the outstanding debt by security type. Computes the 2s10s spread and an inversion flag. The yield curve is a resilient partial grain that degrades to the average rates if its upstream is unreachable.

Scan a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with a raw lockfile or a components array and get per-dependency verdicts (malicious, vulnerable, suspicious, clean) from OSV.dev and the OpenSSF Malicious Packages feed, each with a summary and snapshot timestamp. Pay per request in USDC; no account, no API key.

Check whether a supplied public source supports or contradicts a factual claim. Validate citations in AI-generated answers against the supplied URL. TruthPal returns source-grounded evidence and a supported, contradicted, or uncertain verdict; when the source is insufficient, the result is uncertain. It assesses only the supplied source and does not independently corroborate the claim.

Verify SAM.gov entity registrations: UEI, legal name, registration status, and expiration. POST /v1/entity with a {name} (or UEI) and get the matching records as one JSON object. Deterministic per record. Pay per request in USDC; no account, no API key.

AI-powered smart contract audit checklist matching - analyzes contract code and returns relevant security checklist items. PRICING (based on model): DeepSeek: $0.05 USDC, Sonnet: $0.15 USDC, Fable: $0.30 USDC. Payment must match selected model.