Security & trust

Known vulnerabilities for a package (OSV.dev — aggregate of GHSA, PyPA, RustSec, Go and more) or a free-text CVE search (NVD), with severity and fixed versions

OFAC SDN sanctions screening for a crypto address or a person/company name. Covers all 963 digital-currency addresses OFAC lists across 19 chains (BTC, ETH, TRX, USDT, SOL, XMR and more) plus 19k sanctioned entities and their aliases. Straight from the US Treasury's own list, refreshed daily.

Airdrop and Claim Scam Verification — On-chain & DeFi

Paid x402/MCP/A2A/Bazaar consult. Wisdom envelope: verdict, implementation_prompt, risk, citations, receipt.

Paid verification layer for autonomous AI agents. Verify claims before decisions using web evidence and source-backed analysis

txpeek (Tanod) pre-transaction check: risk verdict for an address in about a second (proxy and admin control, verification, risky functions, token basics). Heuristic, not an audit. Use when an agent is about to send funds to or call an address and wants a quick risk check first.

utilpeek (Tanod) JWT verifier: signature, expiry, audience and issuer checks with a secret, PEM key or JWK Set. Use when an agent must check a JWT's signature and exp, aud and iss with a secret, a PEM key or a JWK Set.

chainpeek (Tanod) sanctions screening: one crypto address against the US OFAC SDN digital-currency-address list only, as of list_date. A screening aid: not legal advice or a full compliance check.

sitepeek (Tanod) security headers: a score and grade (A-F) of one response's HSTS, CSP, framing, content-type, referrer, permissions, cross-origin and cookie headers. Read-only; not an audit.

Anthropic IPO data as JSON: filing status (confidential draft S-1), expected timing and listing window, target valuation range, expected proceeds, lead underwriters, last private round (Series H) size and valuation, run-rate revenue, valuation multiples, dated timeline. Each item has its own source URL and verification grade.

Checks one crypto address against the OFAC SDN list published by the US Treasury, across 16 currencies including Ethereum, Bitcoin, Tron and USDT. A hit returns the actual list entry - sanctioned entity, its type and its sanctions programmes - not a risk score. Exact matching only, never fuzzy. Every answer carries the publication date of the list snapshot. No API key, no account.

JSON tier (deterministic, no LLM): verifies a claimed value lives at a named JSON path in a public endpoint's response, by independent double re-fetch. Use it for machine-readable API responses; for HTML pages use /verify. Claim keys are paths (data.items[0].price). Type-strict; volatile values return unverifiable, never a guess. Public HTTPS JSON only. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

XML tier (deterministic, no LLM): verifies a claimed value lives at a named path in a public XML document, by independent double re-fetch. Use it for feeds and sitemaps; for JSON use /verify-json, for HTML use /verify. Paths address elements and @attributes (urlset.url[0].loc). String-exact; ambiguous or volatile values return unverifiable, never a guess. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

OpenAI IPO data as JSON: confidential S-1 filing status and announcement date, reported 2027 listing expectations, Sam Altman ruling out a 2026 IPO, latest verified private funding round committed capital and post-money valuation, banks reported working on filing preparation (not confirmed underwriting mandates), and dated timeline. Each factual item has a source reference and verification grade; uncertain dates and unverified figures are omitted.

AI lab funding rounds and valuations as JSON (OpenAI, Anthropic): round size, post-money valuation, rounds in talks, employee tender offers, IPO valuation targets, strategic investor commitments. Each row keeps its source URL, verification grade (primary/secondary/reported) and value type.

Latest releases of Bitcoin Core and the Lightning implementations (LND, Core Lightning, Eclair, LDK) as JSON: version, date, days since release, link to notes, and a plain keyword flag when notes mention security fixes. Read live from GitHub.

Smart contract security audit for developers and auditors: finds vulnerabilities, gas optimizations, and best-practice violations in Solidity, Rust, Move, or TypeScript code, with a diff review mode for proposed changes. Category: inference.

Bridge exploit track record: for one bridge, its hack history (incidents, total USD lost, funds returned, worst technique); with no bridge, a ranked leaderboard of every bridge hack by USD lost. Sourced from DefiLlama's hack dataset, joined and normalized by us.

Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull drift. Returns a 0-100 risk score, category, per-tool findings and content hashes. Security indicators, not a guarantee.

Product recall and safety check for a consumer good, food, drug or medical device by brand or product name. Fuses CPSC and openFDA recalls into one cited JSON with hazard, FDA class, remedy, status and a deterministic risk score. Risk indicators, not advice.

Vulnerability scan for a software package by ecosystem, name and version, or by package-URL (purl). Queries OSV.dev for known advisories, collects their CVE ids and enriches them with NVD CVSS, CISA KEV and EPSS, then returns a prioritized list of advisories with exact fixed versions. Risk indicators, not advice.

Resolve authentication requirements across an OpenAPI 3.x or Swagger 2.x document. Returns the catalog of security schemes (`components.securitySchemes` in OpenAPI 3, `securityDefinitions` in Swagger 2) verbatim, the document-level default, and the *effective* security for each operation after layering.

Khan 2024 AHA PREVENT base 10-year total CVD percent (ASCVD plus heart failure) for age 30-79 from sex, lipids, treated systolic BP, diabetes, smoking, eGFR, BMI, antihypertensive, and statin. Sex-specific, race-free Table S12 coefficients. Not 30-year, not ASCVD-only, not HF-only, not 2013 PCE, not SCORE2, not a diagnosis or statin order. magent does not assay lipids.

MCP server readiness API for agents: audit tools/list, schemas, manifests, discovery, and integration readiness for $0.01 USDC before publishing or connecting a client. Call when you need this bounded result without an API key or subscription. Returns machine-readable JSON via x402 on Base or Solana. Limitation: results cover only the supplied input or one bounded public endpoint at request time; callers must verify before acting.

Calculate a bounded exponential backoff schedule for reliable autonomous retries. Use it before an autonomous workflow acts on untrusted input, changes an API, retries a request, or evaluates production reliability. Returns bounded machine-readable JSON for $0.002 USDC via x402 on Base or Solana. Execution is deterministic, first-party, local-only, stateless, and does not call an upstream provider; structured validation failures are not billed.

Digest Header Verify: verifies a sha-256 Digest value against caller-supplied text bytes using only bounded caller-supplied values. Call when you need a bounded digest header verify result before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for Digest Header Verify as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base or Solana. First-party, stateless, me…

Inspect login and auth surface signals such as forms, reset flows, signup links, and headers for $0.01 USDC. Call when you need this bounded result without an API key or subscription. Returns machine-readable JSON via x402 on Base or Solana. Limitation: results cover only the supplied input or one bounded public endpoint at request time; callers must verify before acting.

Maximum-safe LTV for collateralized agent loans. Computed from (cv + λ·j²)-derived variance over loan horizon + 6-mode regime cap. Lender-specifiable max_default_prob. Returns binding constraint (math vs regime_cap) so agents can see WHY the cap is what it is. Same calibrator as Agent-SOFR rate endpoint.

BlindOracle by Craig M. Brown (craigmbrown.com) - counterparty-risk infrastructure sold to autonomous AI agents; self-built multi-agent framework (42+ agents); ERC-8004 agent passport #60979; paid via x402 in USDC on Base | Signed attestation that a specific process was followed (not just that an outcome occurred) - useful when a counterparty needs evidence of *how* something was done, not only *that* it was done.

CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status.