Security & trust

Cheap structural IBAN validation: ISO 13616 checksum + per-country structure/length. Returns valid plus, on rejection, a granular error_type (invalid_checksum, invalid_length, invalid_structure, invalid_country), the country and the format spec. Offline (schwifty, MIT); no network or keys. A cheap-first entry before the fuller /bank/verify fusion route.

Confirm a USDC payment actually settled: given a tx hash (and network), returns whether it succeeded and the USDC transfers it contains (from, to, amount). Optionally check it paid a specific address at least a minimum amount. Read-only proof of payment.

Validate a Cloudflare Turnstile, Google reCAPTCHA, or hCaptcha token server-side. You pass your OWN provider secret plus the token from the client; we relay to the provider's siteverify endpoint (never logged) and return the normalized verdict (success, hostname, action, score, error codes). The legitimate backend half of bot protection - no solving, no bypass.

Is this domain trustworthy, or is it a phishing site / typosquat / scam? Pull the reputation signals an analyst checks before clicking anything: domain age, cert issuance history, hosting reputation, DNS topology, tech-stack fingerprint, and page-content red flags. Different from a security audit - this is about whether the domain is what it claims to be.

Full page SEO + security audit: content extraction, metadata, HTTP headers, robots policy, and sitemap health in one call. Page audit skill pack: one x402 payment runs 5 underlying tools (extract, meta, http-headers, robots-check, sitemap); partial-success per step.

Verify an email address is deliverable - syntax validation plus MX record check on the domain. Contact verification skill pack: one x402 payment runs 3 underlying tools (email-validate, dns-lookup, spf-check); partial-success per step.

Enumerate a domain's external attack surface in one workflow: certs, DNS posture, email auth, HTTP security headers, and tech stack. Security audit skill pack: one x402 payment runs 7 underlying tools (cert-transparency, dns-lookup, spf-check, dmarc-check, http-headers, tls-cert, tech-stack); partial-success per step.

The production ingest path for every incoming webhook: verify the provider signature (GitHub / Stripe / Shopify / Slack, constant-time, replay-window enforced), schema-validate the now-trusted body against the provider envelope, fingerprint the raw bytes for redelivery dedup, normalize the event timestamp to UTC + epoch, and redact PII before anything hits a log. Five pure-CPU tools - the accept-or-reject gate, run on every event.

TLS/SSL security posture check: live certificate inspection, HTTP security headers, and CAA DNS records. SSL audit skill pack: one x402 payment runs 3 underlying tools (tls-cert, http-headers, dns-lookup); partial-success per step.

Boolean verdict with reasons: is this address a real factory-issued B20 on Base? Checks the 0xB200 address prefix, ERC-20 readability, and whether the B20 feature set is activated on the registry.

Look up a CVE by id, or search CVEs by keyword or product: the NVD description, CVSS severity and vector (v4.0, v3.1, v2), CWE weaknesses, affected products and versions (CPE), and reference links, joined with the EPSS exploitation probability (next 30 days) and whether CISA lists it as a known exploited vulnerability (date added, due date, ransomware use). This product uses the NVD API but is not endorsed or certified by the NVD.

Screen a person or company name against the OFAC SDN list. Returns exact and substring matches with the SDN entry id and type, so every hit can be checked against the published list itself. Matching is exact, substring, or all-tokens (every word of your query appears as a whole word in the entry, in any order - so 'Vladimir Putin' finds 'PUTIN, Vladimir Vladimirovich').

Lint an OpenAPI spec and validate a sample payload against it - catch schema errors in one pass. OpenAPI spec audit skill pack: one x402 payment runs 3 underlying tools (openapi-lint, openapi-validate-payload, openapi-security-summary); partial-success per step.

Decode and verify a JWT in one pass - see the payload and check the signature. JWT toolkit skill pack: one x402 payment runs 3 underlying tools (jwt-decode, jwt-verify, jwt-sign); partial-success per step.

Validate an A2A (Agent2Agent protocol) Agent Card: required fields, skill shape, transport names, capability flags - spec v0.3 structural core. Returns errors, interop warnings, and a normalized summary (skills, interfaces, capabilities). Deterministic mini-A2A tooling - check a card before your agent trusts it.

List EAS (Ethereum Attestation Service) attestations for an address as recipient, attester, or either, on mainnet/Base/Optimism/Arbitrum/Sepolia. Returns attestation id, attester, recipient, schema id, revocable/revoked flags, timestamp, and decoded data JSON. Use to verify Gitcoin Passport stamps, Coinbase verifications, KYC attestations, or any other on-chain claim about an address.

Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)

Tamper-evident history of every change to a namespace - an append-only, hash-chained audit log the server attests to (provenance an agent can't forge for itself).

Score a password's strength: character-set size, entropy bits, a 0–4 rating, and an estimated offline crack time. The password is never stored or logged.

Risk-adjusted return: (mean return - risk-free rate) / sample standard deviation of returns (n-1). Pass periodsPerYear to also get the annualized ratio (× sqrt(periodsPerYear)).

Verify an Ed25519 execution certificate against the exact SQL statement you are about to run - the gate your database layer calls before it obeys an agent. Checks the signature, the certificate version, the expiry, and that the statement's SHA-256 matches the one certified, so a certificate for a different (or edited) statement is rejected. Returns { valid, reason, payload } and never throws on a malformed token, so the executor always gets one uniform answer.

Verify a webhook's HMAC signature against the correct per-provider scheme: GitHub (X-Hub-Signature-256, sha256=hex), Stripe (Stripe-Signature t/v1 over "<t>.<body>" with replay tolerance), Shopify (X-Shopify-Hmac-Sha256, base64), Slack (X-Slack-Signature, v0:<ts>:<body> with replay tolerance). Constant-time comparison; the secret is never echoed. Pass the RAW request body string - signatures are over the raw bytes. Deterministic.

Audit cache headers for missing policy and sensitive public-cache exposure. Use it before an autonomous workflow acts on untrusted input, changes an API, retries a request, or evaluates production reliability. Returns bounded machine-readable JSON for $0.002 USDC via x402 on Base or Solana. Execution is deterministic, first-party, local-only, stateless, and does not call an upstream provider; structured validation failures are not billed.

Measure achieved reliability against an SLO target from good and total events. Use it before an autonomous workflow acts on untrusted input, changes an API, retries a request, or evaluates production reliability. Returns bounded machine-readable JSON for $0.002 USDC via x402 on Base or Solana. Execution is deterministic, first-party, local-only, stateless, and does not call an upstream provider; structured validation failures are not billed.

Drawdown percent from peak to trough for risk reports. Call when measuring path risk on an equity or price series peak/trough pair. Returns drawdown percent as deterministic JSON for $0.001 USDC via x402 on Base. First-party local math only—no RPC, live market feed, API keys, storage, or mediagen. Advisory only; the caller owns capital, risk, and production controls.

Checks whether an npm, PyPI, or crates.io package is safe to install: confirms it exists, flags malicious or typosquatted/slopsquatted names, checks known CVEs (OSV.dev), and pulls its OpenSSF Scorecard. Returns an ALLOW/WARN/BLOCK verdict before your agent installs it.

Checks whether a URL/domain is safe to fetch, cite, or follow: flags phantom-squatted or typosquatted brand domains, unregistered or brand-new domains, and known malicious infrastructure (URLhaus). Returns an ALLOW/WARN/BLOCK verdict before your agent trusts the link.

Smallest paid pack ($0.005): a machine-readable merge checklist and a one-request smoke purchase on this store. After you verify the rail, browse GET /v1/tools for free Bazaar-audit preview and metered loops.

Validate an IBAN and check whether a bank account number is valid. Verifies the ISO 13616 MOD-97 checksum, structure and country length against the IBAN registry, and returns validity, the country, the BBAN and a formatted IBAN. Instant, deterministic bank account number validation and verification for any European or international IBAN.

Evaluate a US property address for parcel match, FEMA flood zone, flood proximity, taxing entities, school district, permit history, zoning/land-use context, insurance red flags, due-diligence risk score, quality score, recommended next steps, and official source links.