Security & trust

Strait of Hormuz per-vessel intelligence: the live-AIS vessel manifest (MMSI-keyed, flag derived from the MMSI MID), the OFAC-sanctioned vessels currently in the Persian Gulf window with program detail, per-vessel risk bands, latest raw AIS positions, the top AIS-dark hulls with the full dark count alongside, and OFAC + UK sanctions reference-list sizes (per-IMO multi-body detail at /api/premium/vessel/{imo}).

Top stables ranked by mcap with peg deviation (now/24h/7d) + stability score + risk

Deep x402 audit: the full endpoint audit plus a live probe for rail coverage (Base/Solana), multi-rail detection, HTTP status, and latency — a premium trust report on any x402 endpoint.

Keccak Merkle proof verifier — validate inclusion plus exact leaf index and count proof shape for the Atlas sorted-pair tree profile.

JSON Web Key (JWK) inspector — validate bounded public RSA, EC, or Ed25519 keys and calculate RFC 7638 SHA-256 thumbprints without ownership or trust claims.

Check whether a wallet is KYC-eligible for a gated (RWA / tokenized-treasury) yield. Returns the normalized KYC status and, when required, where to complete verification — call before actions_enter on gated yields.

Get the risk profile for a yield — ratings and scores from independent risk providers (Credora, Staking Rewards) so agents and users can weigh safety before depositing.

The risk factors identified in companies' 10K filings. Can't find what you're looking for? POST feedback to /feedback, no charge.

Audit text for malicious AI-skill patterns. Requires `content`. Nothing to audit — crawling, or discovering this endpoint cold? POST /audit/registry runs the same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Resolve an HTTP or HTTPS URL through redirects and return the complete redirect chain, HTTP status for each hop, final URL, and redirect safety findings. Use when an agent needs to determine where a URL actually leads before visiting, citing, downloading, or trusting it.

Before your agent onboards, pays, or contracts with a counterparty: screen the name against the U.S. Treasury OFAC sanctions lists (SDN + Consolidated non-SDN, synced every 6h) for $0.01. Benchmarked 114/114 sanctioned names found with zero false positives on a 152-case adversarial corpus of misspellings, word-order swaps, and transliterated aliases. Ranked candidates with confidence 0-100, program tags, and match evidence. Assistive screening signal, not a certified compliance determination.

Before your agent trusts, cites, or transacts with a U.S. bank: verify it is actually FDIC-insured, for $0.01, against the FDIC's own BankFind Suite records, synced daily. Look up by institution name (fuzzy, word-order-tolerant, confidence-scored), FDIC certificate number, or website domain. Returns insurance status, charter class, HQ city/state, and the FDIC cert; renamed and failed/inactive institutions stay findable. Assistive screening signal, not a certified compliance determination.

Nord Pool day-ahead electricity spot prices (EUR/MWh, 15-min resolution) for the ee, fi, lv and lt bidding zones, from the Estonian TSO Elering's open-data API. Defaults to the last 24h; ?start=&end= (ISO 8601 UTC, max 7 days) select a window, ?zone=fi filters one zone. Day-ahead prices publish once daily; served with a 1h cache.

Authoritative domain registration facts from the ICANN-mandated RDAP protocol (rdap.org bootstrap -> registry of record), normalized across all TLDs: registration/expiration/last-changed dates, computed age_days, registrar name, EPP status locks and nameservers. Query: ?domain=google.com (required). No personal data served. 24h cache.

One call returns the full domain profile for vetting, deliverability, or phishing/fraud checks: live DNS (A/MX/NS + record counts), RDAP/WHOIS registration (registrar, domain age, expiry, status, DNSSEC) and email authentication (SPF, DMARC policy, detected DKIM selectors) — plus a one-line summary. Bundles three lookups into one hourly-fresh read. Keyless, license-clean, pay-per-call.

Trust gate for AI agent payments: TRUST/DISTRUST verdict with confidence and score before a transaction

Sybil forensics for ERC-8004 AI agents: reviewer concentration, ghost reviewers, burst detection in the reputation registry

Website audit in one call: WCAG 2.2 accessibility issues (European Accessibility Act) with fixes and a score, SEO basics, security headers and tech stack.

Pay-per-KYA: an agent pays to verify another agent's post-quantum identity + scope credential (Dilithium-2, NIST FIPS 204), with a live FRC-55 on-chain reputation read. ERC-8004-aligned Know Your Agent for autonomous agent-to-agent commerce. x402-native.

Batch Spot Check. REQUIRES ?hosts= on the paid request — a signed request without it is refused before the gate and no money moves. Read existing host records as a signed batch; no live probes or rankings Full listing: https://scvd.store/menu/batch_spot_check. MCP tool: buy_batch_spot_check.

Health-check and tool-schema inspection for any public MCP server before you rely on it.

Security audit for an EVM token: rug-pull, honeypot, and trading risk signals.

npm package safety gate: vulnerabilities, malware advisories, typosquatting, install-script risk.

For 1 to 10 NPIs, the CMS NPPES status of each (active or deactivated, with deactivation and reactivation dates), provider name or organization, practice city, state and ZIP and taxonomies, plus any HHS-OIG LEIE exclusion listed under the NPI, as facts from the files: not a credential check and not a determination about the provider.

Screen a name against the US OFAC SDN and Consolidated lists: potential matches with list, programs, name score and reasons; optional type, date of birth and country re-rank. Fuzzy, folds accents, any script. Not a determination: an empty candidates list is a paid 200 and certifies nothing. Not UN, EU or UK.

Up to 25 counterparty risk checks in one call, billed per item, each with a signed ES256 attestation.

Website accessibility audit (a11y, WCAG compliance check): WCAG 2.1 level A and AA conformance of any live URL or raw HTML, tested with axe-core in a real headless browser. Returns every violation with rule id, impact, help text and affected node count. Deterministic rules; a check that cannot run returns an error, never a pass.

Europe regional macro + geopolitical stress pulse (no params)

Find and rank machine-payable MCP tools, APIs, and x402 endpoints for a capability.

Check Python packages from PyPI before you pip install or bump versions. Send {"packages":["requests==2.25.0","flask>=2.0"]} or {"requirements":"<requirements.txt text>"}, up to 50 packages. Per package: latest release and date, whether a pinned version is behind, license, yanked status, requires_python, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM.