Security & trust

Cyre Decision Receipt — seal an intent hash, the signals you saw, and the action you took into a signed audit receipt. Verify free at /api/receipt/verify. Patterns, not verdicts. Agent guide: https://cyre.dev/SKILL.md

Recovers the address that signed a personal_sign (EIP-191) message and tells you whether it matches the address you expected. This is how you prove a wallet is controlled by whoever is talking to you.

Single higher-value composite report for one domain: DNS resolution, TLS/SSL certificate validity and issuer, RDAP/WHOIS registration and nameservers, and email deliverability (MX/SPF/DMARC) signals, plus a derived trust score and risk band. Built entirely from already-cleared, already-live internal capabilities (domain-dns-check-v1, domain-ssl-check-v1, domain-whois-lookup-v1, email-domain-deliverability-check-v1) -- no new source, no new licence question, no proprietary reputation database.

Use when an agent needs x402 endpoint verify. Returns Verify and lint a third-party x402 endpoint: probes the URL (SSRF-guarded), confirms it answers with a well-formed HTTP 402 challenge, and reports protocol-conformance findings — accepts[] completeness, facilitator price floor on Base, PAYMENT-REQUIRED header/body consistency, timeout sanity. $0.02.

Authoritative domain registration facts from the ICANN-mandated RDAP protocol (rdap.org bootstrap -> registry of record), normalized across all TLDs: registration/expiration/last-changed dates, computed age_days, registrar name, EPP status locks and nameservers. Query: ?domain=google.com (required). No personal data served. 24h cache.

European supplier and invoice verification for e-invoicing compliance in Belgium (mandate since 1 Jan 2026) and Poland (KSeF): registry identity, VIES VAT check, Peppol reachability (BE), IBAN form + key, bank and, in Poland, the official White List: is the IBAN DECLARED by the taxpayer? Paying an undeclared account over 15,000 PLN costs the VAT deduction and joint liability. Natural person or doubtful form (BE, PL): no name or address (ecartes). Deterministic verdict, closed-list reasons.

Check if a password has appeared in known data breaches using the HaveIBeenPwned Pwned Passwords API with k-anonymity — the full password is never transmitted, only a 5-character SHA-1 hash prefix — returns breach count and a risk classification so agents can enforce password policies without storing or exposing credentials.

Query the Internet Archive Wayback Machine to check if a URL has ever been archived, get the closest snapshot to a given date, retrieve the most recent capture, and return archival history stats — so agents can access historical web content, verify past content claims, and recover deleted pages.

Follows a URL through its full redirect chain (up to 20 hops), recording status codes, timing, headers, TLS status, and protocol downgrades per hop, then returns an overall redirect health grade (A–F).

Check a URL against URLhaus malware database and heuristic phishing pattern analysis — returns threat classification, malware family if known, threat confidence, and risk score so agents can screen links before following them or sharing them in automated workflows.

Invoice verification and supplier verification — verify supplier before payment in France, the invoicing pack of the e-invoicing mandate France September 2026 (all VAT-liable companies must receive): legal identity, obligation dates, intra-EU VAT number checked LIVE against VIES, IBAN form + key check, bank identified, deterministic pret_a_facturer verdict, closed-list reasons. Not a payee verification: no holder name, no account existence check. A VIES outage never yields a false invalid.

Performs a TLS handshake to inspect the certificate chain, probes supported TLS versions (1.0–1.3), detects weak keys and expiry issues, and returns an overall security grade (A/B/C/F). For just the cert facts fast, see the cheaper /ssl/cert (quick tier).

One call returns the full domain profile for vetting, deliverability, or phishing/fraud checks: live DNS (A/MX/NS + record counts), RDAP/WHOIS registration (registrar, domain age, expiry, status, DNSSEC) and email authentication (SPF, DMARC policy, detected DKIM selectors) — plus a one-line summary. Bundles three lookups into one hourly-fresh read. Keyless, license-clean, pay-per-call.

Look up a vulnerability by CVE or GHSA id (NVD: description, CVSS score and vector, CWE, CISA known-exploited flag; OSV: affected packages and fixed versions) or check a package version for known vulnerabilities via OSV.dev (npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, Debian ...). Params: cve_id, or package + ecosystem (+ version, recommended), limit (default 20).

Screen a person or company name against the official OFAC SDN list (with aliases), the EU consolidated financial sanctions list and the UN Security Council consolidated list. Fuzzy, word-order independent matching with scores, list, program and aliases. Lists refresh every 12 hours. A screening aid, not a legal determination. Params: name (required), type ('individual' or 'entity', optional), threshold (0.5 to 1, default 0.85), limit (default 10).

Inspect SSL/TLS certificate for any domain. Returns valid boolean, days_remaining, issuer, valid_from, valid_to, subject_alt_names (SANs), fingerprint_sha256, and protocol version. Default port 443. Use for certificate expiry monitoring, security audits, or HTTPS verification.

Check a URL before you cite, visit or trust it: liveness, final URL and redirect chain, soft-404 detection, page title, domain registration age (RDAP), robots.txt policy for AI agents, and Wayback Machine snapshot availability. $0.002 per check.

Screen a name against OFAC SDN plus the EU, UN, and UK consolidated lists with fuzzy matching and confidence scores. POST /v1/ofac with a {name} and get matches and the lists checked as one JSON object. Deterministic per daily cache. Pay per request in USDC; no account, no API key.

Curated aesthetic-medicine brand directory, partially verified. One call returns the full core catalog of filler, toxin, and thread brands: name, manufacturer, country, categories, certifications, treatment areas, and verification status. Some fields may be null.

Check a URL for phishing signs without fetching it: raw IP hosts, punycode, user@host, credential words in the host, very long hosts and deep subdomains. The verdict is suspicious or unknown, never clean, because no threat database is consulted; the response says what ran. POST /v1/reputation with {url}. Pay per request in USDC; no account, no API key.

Discover OCI 1.1 artifacts referring to an image digest, such as SBOM or attestation evidence. Presence is reported only; Forest does not verify signatures or download blobs. Base mainnet USDC

Return manifest-declared OCI config and layer sizes before an agent pulls an image. Values are registry declarations, not a compressed download or vulnerability measurement. Base mainnet USDC

Sanctions screening for compliance, AML, KYC and KYB agents: use before onboarding, paying or contracting with a person or organization. Fuzzy-matches the name against the official OFAC SDN list and the UN Security Council consolidated list, aliases included, and returns scored matches with list, sanctions program, entity type and source reference. Diacritic- and case-insensitive, tunable min_score (default 0.6). One keyless USDC call.

NVD (National Vulnerability Database) CVE record by id, or search by keyword in recent CVEs: description, severity and CVSS base score, status, published and last-modified dates, and whether it is on CISA's Known Exploited list. Cached; records refreshed within about 48 hours.

Verdix lite ($0.01): call before an agent sends funds to an unfamiliar EVM address on Base, when cost matters most. Checks OFAC sanctions, scam/phishing lists, address poisoning, phishing tokens and flagged deployers. A clean answer is no_known_risk, never safe; for a verdict that can say safe, call /risk/address/quick.

Before your agent onboards or pays a counterparty: screen the bank account for sanctions — flags sanctioned banks (BIC) and high-risk jurisdictions against the official OFAC, EU, UN and FATF lists, for KYB/AML compliance

Sanctions Screen ($0.006 — below the category-leading "sanctions screening" comparable's $0.01): screen a name and/or crypto wallet address against the U.S. Treasury OFAC SDN list (primary names + aliases + OFAC-published digital-currency addresses) in one call. Fetched live from OFAC's official export service, not a snapshot. Accepts the leading comparable's `type`/`threshold`/`lists` body fields for drop-in compatibility (`type` filters by person/entity, `threshold` overrides the default 0.6…

Sanctions Delta ($0.008): which OFAC SDN entries (and OFAC-published crypto addresses) were added, removed, or modified since a given date, derived from OFAC's own official change-tracking feed (sanctionslistservice.ofac.treas.gov/changes/...) — not a self-diff of two snapshots. Body { since: "YYYY-MM-DD", entity_type?, crypto_only?, limit? }. Check free /v1/sanctions_delta/availability first.

Screen a person, company, vessel or crypto address against US Treasury OFAC sanctions lists (SDN and Consolidated): fuzzy name matching across names and aliases (word order, accents, suffixes, typos), exact crypto address matching. Each match: score, OFAC ID, programs, aliases, addresses, DOB, nationality. Refreshed every 12 hours. For KYC, payments and vendor checks. $0.005 USDC per call.

Check whether a source supports, contradicts, or gives insufficient information about a claim - a typed verdict with a real probability, not generated text. Powered by Jev (TypeSafe System One). $0.001 per call, no OpenRouter or TypeSafe account needed. Try GET /verify/sample.