Security & trust

Before your agent re-runs a contract review or due diligence after time has passed: a structured diff of the consolidated text — word-level segments plus a git-style unified patch — for up to 50 French or EU article references, each between its own two dates, in one call, from the official LEGI and EUR-Lex datasets. Covers 12 major French codes and statutes and key EU acts (GDPR, DSA, AI Act, MiCA and more).

Before a payment run: validate up to 500 IBANs in one call, resolve bank and BIC from national bank registries, and check SEPA reachability per scheme (SCT, SCT Inst, SDD Core/B2B) against the EPC register

Which public companies name a given audit firm in their annual reports — exact- phrase 10-K full-text join per registrant with filing counts and dates. Map auditor concentration and shared-auditor networks in one call. Pay per call (x402 USDC or prepaid card credits); no subscription, no API key signup.

Search CVEs, CISA Known Exploited Vulnerabilities status, and GitHub Security Advisory package/ecosystem metadata in one call. Composes three separately licence-cleared sources: the NVD CVE API (CVSS scoring, descriptions), CVE Program data from cve.org (delivered via NVD), the CISA KEV catalog (CC0 1.0), and the GitHub Security Advisory Database's github-reviewed set (CC-BY-4.0), ingested only via a local git checkout of the public repository -- never the live GitHub Security Advisories API. Do

Screen a name in one call against US OFAC SDN, the EU Consolidated Financial Sanctions List, UK OFSI, the UN Security Council Consolidated List, and Wikidata-derived Politically Exposed Persons (PEP) data -- with fuzzy name matching, not exact-only. Real competitor research (2026-09-11) found this exact bundle+fuzzy-match shape is what actually converts in this niche; the single-source exact-match ofac-sanctions-search-v1 listing did not.

Audit one public URL for title, meta description, H1 count, image alt text, canonical, robots, language, Open Graph, Twitter cards, headings, hreflang, feeds, and Schema.org data; return a deterministic score and prioritized issue codes.

Run a website due diligence and counterparty risk report with seven live checks in one call: DNS and RDAP registration, domain age, TLS, page metadata, technology fingerprint, hosting context, OFAC name screening, and GLEIF legal-entity lookup. Hosting context carries no threat score and an OFAC name match requires human review.

invinoveritas /decision-receipt — a signed receipt for a bounded-choice decision (OpenAI Decisions API, Jev, any classifier): hashes of

invinoveritas /residence/act — THE BUNDLE: a home for your agent. One governed call does what would be separate /reason + /review + /memory calls — it reasons,

invinoveritas /review/external — the scaffold's GOVERNANCE layer: second-opinion review of code or agent output (Sentinel) before you act on it. Part of the

Use when you must check whether a person is a politically exposed person (PEP) for AML/KYC: heads of state and government, ministers of every country, central bank governors, MEPs and national MPs of the EU, EEA, UK, US and Switzerland, current or former (default 5 years). Fuzzy matching with positions, country and dates. Pairs with sanctions screening.

Sanctions screening (AML, KYC, KYB) against the EU, UN, UK and US OFAC lists, one name per call. Use when you must check whether a person or company is under sanctions: screens the name against the EU, UN, UK and US OFAC lists (25,000+ persons, companies and vessels with aliases, refreshed weekly). Fuzzy matching handles spelling, transliteration and word order; returns scored possible matches with lists, references and birth dates.

KYC onboarding check in one call: sanctions, PEP, email, phone, VAT. Use when onboarding a customer, seller or business and you want one answer: screens the name against EU, UN, UK and US sanctions and the PEP list, verifies email and phone, and checks an EU VAT number in VIES, all in parallel, with one verdict: pass, review, block_review or incomplete. Send any of name, email, phone, vat.

Find out if an AI agent's reputation is earned or bought: ORGANIC/FARM/BURST origin detection with sybil forensics

Dependency health across PyPI, npm, Go, Cargo, Maven, Composer, and NuGet via deps.dev and OSV: versions, licenses, and known vulnerabilities. POST /v1/tool with {package, ecosystem}, or GET /v1/package for the Bazaar listing. Deterministic per advisory state. Pay per request in USDC; no account, no API key.

Single-call combined pre-trade security check - runs token-risk and contract-health-audit in parallel against the same GoPlus data and returns both, plus a deduped union of risk_flags. No composite score or letter grade is computed - every field is copied unchanged from the two underlying checks. Paid in USDC on Base.

LP (liquidity pool) lock/burn audit reusing the same GoPlus data as token-risk - checks whether liquidity is locked, burned, or freely held by a single wallet, a rug-pull signal token-risk does not cover. No qualitative judgment, only GoPlus's own lock/burn numbers. Paid in USDC on Base.

Answers 'What changed in Tesla's risk factors this year?' or 'Which new risks did Apple add?'. Compares a section of a company's 10-K (Risk Factors, MD&A, Business, Legal, Market Risk, Cybersecurity) with an earlier year's from SEC EDGAR: added, removed and edited paragraphs with a word-level diff, plus a summary. Latest vs previous year by default, or any years since 2001. By ticker, CIK or name. Not charged if a section is missing. $0.04 USDC per call.

Phone number intelligence for agents: pass any number and get back whether it is a valid E.164 number, its country, the carrier that holds it, and the line type — mobile, landline, or VoIP. One paid call, no account, no API key. Decide whether a number is worth calling or texting, or flag a VoIP number before you trust it. Free-format numbers are normalized; a syntactically bad number is rejected before any charge.

US motor carrier safety verdict by USDOT: authority, out-of-service, rating, crashes. Unverified raw FMCSA data, ~24h old.

Sanctions screening (AML/KYC): screen a person, company, vessel or aircraft against the OFAC SDN and consolidated lists, the UK Sanctions List and the EU financial sanctions list, read from the governments' own files with each list's date returned. Fuzzy and word-order free: aliases and typos match, a different surname does not. Each hit: list, programmes, countries, birth dates, UN reference. Input: name; optional type, country, birth_year.

Security headers check for a website: audits HTTPS, HSTS, Content- Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options / clickjacking protection, Referrer-Policy and CORS from the real HTTP response of any live URL. Findings with severity for what is missing. Header posture only, not a penetration test.

a pack of cards. Five signed pressings from the season's set, drawn by HMAC over the day's committed seed on the wheels at /design, each with a print number, a page at /p/{card_id} that unfurls, and a verify URL; the signed manifest at /api/pack/{pack_id} binds the seed commit and the inputs, and a crossed milestone drops a one-of-one in. Instant. Full listing: https://scvd.store/menu/pack. MCP tool: buy_pack.

Resolve one exact 20-character Legal Entity Identifier against the public GLEIF LEI record API and return a compact normalized legal-entity reference snapshot. Forest reports source facts only and does not turn LEI status into a KYC, AML, credit or legal decision. Base mainnet USDC

Hash caller-supplied UTF-8 text deterministically with SHA-256 or SHA-512 and return both hexadecimal and Base64 digests. Input is bounded to 100 KiB, no network request or external provider is used, and Forest never treats a digest as proof of authenticity or password security. Base mainnet USDC

Detect whether normalized public npm or PyPI package registry state changed since a saved fingerprint. Returns a deterministic SHA-256 fingerprint for package/version existence, latest/resolved version, deprecation or yank state, license and runtime requirement. No dependency graph, vulnerability scan or registry mutation. Base mainnet USDC

Verify an OpenTimestamps proof (.ots as base64, from btc-timestamp or any ots client): upgrades pending proofs from the calendars, checks each Bitcoin attestation against the real block's merkle root and returns status (confirmed, pending), block height and time, the upgraded proof, and whether your text, hash or URL matches.

Verify an IOTA notarization: give the object id or transaction digest of any notarization on the IOTA mainnet (ours or anyone's, official IOTA Notarization package) and optionally the text, SHA-256 or URL to check. Returns the stored hash or data, creation time from the ledger, lock status (can it be changed or deleted), owner, and matches true or false for your content. Read-only, no wallet needed.

Everything needed to evaluate hiring or employing someone in one country, in ONE call: minimum wage, standard work week, public holidays (with in-lieu policy), parental leave, retirement age, corporate tax, business hours, banking hours and business readiness. For HR agents, EOR/global-hiring tools and payroll compliance. 195 countries with government source URLs and verification dates. Example: /api/v1/kit/hiring/DE

IP reputation and malicious-IP check — screens an address against AbuseIPDB and AlienVault OTX threat feeds and returns a composite risk score, threat categories, malware families, and full source data.