Security & trust

Up to 25 counterparty risk checks in one call, billed per item, each with a signed ES256 attestation.

Website accessibility audit (a11y, WCAG compliance check): WCAG 2.1 level A and AA conformance of any live URL or raw HTML, tested with axe-core in a real headless browser. Returns every violation with rule id, impact, help text and affected node count. Deterministic rules; a check that cannot run returns an error, never a pass.

Europe regional macro + geopolitical stress pulse (no params)

Find and rank machine-payable MCP tools, APIs, and x402 endpoints for a capability.

Check Python packages from PyPI before you pip install or bump versions. Send {"packages":["requests==2.25.0","flask>=2.0"]} or {"requirements":"<requirements.txt text>"}, up to 50 packages. Per package: latest release and date, whether a pinned version is behind, license, yanked status, requires_python, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no LLM.

Resolve a URL redirect chain before an agent follows a link. Return the final URL, HTTP status, redirect count, and chain for URL verification and safe navigation.

Sanctions/scam screening verdict for one address (?address=, optional ?network=mainnet|testnet) plus whether it is a verified token contract STB recognises. The same screen that gates every send in the STB wallet.

Prioritize up to 50 CVEs in one request using FIRST EPSS, CISA KEV, and known ransomware signals. Returns deterministic risk scores, urgency tiers, exploitation signals, vendor/product context, and remediation metadata as machine-readable JSON. Built for security automation and AI agents. No account or API key required. $0.01 per successful request via x402. Invalid input, no-signal results, and temporary resource failures do not settle.

Livecheck Confirm - independent side-effect verification (actor != verifier). POST /v1/confirm with {url, intent} (+ optional claim). Returns confirmed|failed|unknown; thank-you fluff alone never confirmed - durable ref/id required. Intents: lead_submit $0.10, listing_published $0.10. order_placed is POST /v1/confirm/order ($0.25). Signed receipts + GET /stats. Same origin as Livecheck verify ($0.01). Not Trust Oracle / L3.

Raw vs cooked weight and cost per portion: what brisket yields after trim and cook loss, from head chef Cristopher's verified ranges. Send ingredient, weight bought, price paid, optional portions; get usable and cooked weight (best/mid/worst), cost per kg and per portion, with workings. Also whole salmon, pumpkin, onion, soft herbs (trim only); others 404 with suggestions. Refused, never guessed: allergen, curing and preserving terms. Only a 200 answer is charged; refusals and 404s are free.

Validate an EU VAT number offline: country prefix, national format, and the published check-digit algorithm for the 8 countries that have one (BE, DE, FR, IT, LU, NL, PL, PT). The response says which of the two you got — checksumChecked distinguishes a verified number from a format-only pass, because they are not the same strength of answer. Registration is deliberately NOT claimed: only VIES can say whether a number is registered, and this endpoint does not call it.

Offline Issuer Identification Number check: accepts 6–8 digits only (refuses anything that looks like a full PAN), returns Visa/Mastercard/Amex/Discover/JCB/UnionPay/Maestro when the prefix is known. Not a live BIN registry lookup.

Validate a SEPA Creditor Identifier offline: country, check digits (mod-97), business code and national id. Catches mistyped creditor ids before a mandate setup. Structure only — not a scheme-manager registration proof.

Offline tax/customs id formats: EORI, US EIN/SSN, UK NINO, AU ABN (checksum), TR VKN/TCKN (checksum), CA BN. kind= selects the scheme. A well-formed id is not proof of registration.

Heuristic URL risk: scheme, IP hosts, deep subdomains, credential-themed labels, sensitive paths/params, optional brand= lookalike. Returns reasons + GO/HOLD/STOP. Not a malware or Safe Browsing scan.

Guess UPS / FedEx / USPS / DHL / DPD / TNT / TR carriers from tracking-number shape and return a carrier tracking URL. Live parcel status is NOT fetched — pattern detection only.

Clearsigned — the trust layer with no stake in the outcome. Submit {claim, evidence[]}, receive an Ed25519-SIGNED, evidence-bearing receipt (verify offline against GET /pubkey; every receipt is chained in the public ledger at GET /ledger/verify). Flat price, verdict-independent; refunds only for failure to deliver. Current mode is honestly labeled in each receipt.

MIDAX402: Evidence+ x402 intelligence with expanded corpus retrieval, local risk brief, contradiction scan and concrete action plan. We do not grade our own answer: the verdict is answered or needs_more_data (grounded in the corpus or not); evidence_grade (thin/moderate/broad) grades that evidence, auditable via retrieved_corpus_ids. confidence_score is DEPRECATED, still served as a band projection.

Verify a BlindOracle receipt against the parts a buyer cannot check alone: is the proof_id really in BlindOracle's append-only proof rail, does its payload still hash to the stored row, and does the row's HMAC-SHA256 verify against the signing key. Also recomputes content_... | BlindOracle by Craig M. Brown (craigmbrown.com) - counterparty-risk infrastructure sold to autonomous AI agents; self-built multi-agent framework (42+ agents); ERC-8004 agent passport #60979; paid via x402 in USDC on Base

Returns current market risk state, per-symbol signal streaks, and active cooldown timers — use it as a pre-trade risk gate before acting on any signal. Typical agent tasks: check if BTC or ETH is in cooldown before a trading agent acts, confirm signal streak length for momentum context, gate an autonomous workflow on risk state, or add a safety check ahead of a decision call. Fresh continuously, USDC on Base mainnet via x402.

Signed, ledger-derived trust evidence about a NAMED BlindOracle agent (pass the agent name or erc8004 id as `subject`): passport status, audit-report count (ProofOfAuditReport 30105), dispute record, settlement-proof attestations, and revocation flags - each field read fro... | BlindOracle by Craig M. Brown (craigmbrown.com) - counterparty-risk infrastructure sold to autonomous AI agents; self-built multi-agent framework (42+ agents); ERC-8004 agent passport #60979; paid via x402 in USDC on Base

Check whether email addresses are real and safe to send to. Verifies up to 25 addresses per call: syntax, domain MX/A record (including null-MX), disposable-domain, role-account, free-provider and typo checks. Does not perform SMTP/mailbox verification.

Real-time at-risk DeFi borrowers across Aave V3, Morpho, Comet, Euler V2, Fluid, Moonwell, Spark on 11 EVM chains. Returns health factor, collateral, debt, and protocol. Updated every 5 minutes from the liquita liquidation engine.

Verifiable timestamp (trustless proof-of-existence / freshness proof): bind a hash to a drand round for an anti-backdating receipt — proves data existed no earlier than a public instant, with no trusted timestamp authority. Privacy: stamp an opaque sha256 digest.

Recover who signed a message (ecrecover, EIP-191 personal_sign). For EIP-712 typed data use POST /verify/sig. Every answer signed.

Verify whether a supplied public source page currently supports one atomic factual claim. Returns supported, contradicted, or insufficient-evidence plus source snippets, or explicit blocked/unreachable/unsupported states. Not a general fact checker or web search.

AI-stack CVE intelligence. Filters fresh security disclosures to vendors and products in the AI inference, agent framework, training, vector DB, model gateway, and MCP tool layers. Each paper carries a tf_ai_category tag and a severity_rank, sorted with exploited-in-wild and critical-severity first. 99.8% of underlying data is from GitHub Security Advisories (CC BY 4.0).

WhiteMagic continuity-receipt verification: POST a signed receipt bundle and receive a verdict (TRUSTED / PROVISIONAL / INSUFFICIENT_EVIDENCE / UNTRUSTED) with coded errors and an optional signed verification receipt. Verification is stateless, offline-verifiable, and fail-closed; keyless /health, /info, /revocations and GET /anchors remain free.

Scans untrusted text, HTML, email, document text, API responses, and tool outputs for prompt injection, credential theft, data exfiltration, tool manipulation, and other instructions that could compromise an autonomous AI agent. Returns a machine-readable risk assessment and sanitized plain text when possible. Scan untrusted content before adding it to context, following its instructions, or acting on it.

Agent Tool Security Preflight — AI & Agents