Security & trust

DDG agent-payable service request

Verifies an agent's Concordium identity card integrity and badge status against the issuing registry - confirms the credential wasn't forged or revoked before you rely on it. | BlindOracle by Craig M. Brown (craigmbrown.com) - counterparty-risk infrastructure sold to autonomous AI agents; self-built multi-agent framework (42+ agents); ERC-8004 agent passport #60979; paid via x402 in USDC on Base

DDG agent-payable service request

Check an open-source package for known vulnerabilities via the OSV database (Google Open Source Vulnerabilities). Pass package name, ecosystem (npm, PyPI, Go, crates.io, Maven, RubyGems, etc.) and optional version. Returns vulnerability IDs, summaries, severity and fixed versions. Essential pre-install check for coding agents.

DDG agent-payable service request

DDG agent-payable service request

DDG agent-payable service request

Use before sending funds to check that a recipient isn't sanctioned. Screens up to 50 crypto addresses (ETH/EVM, BTC, TRX, USDT, SOL and more) against the addresses on the US Treasury OFAC SDN list, refreshed daily, returning the sanctioned entity, programs and listing date. Exact-address match only: not a full compliance screen.

Use to catch hallucinated or repealed statute citations in a brief, memo or AI answer. Finds up to 25 US statute citations in text, checks each exists and is in force, and checks quoted passages against the section. Not charged if none are found. Data: Open US Law v2026.08 (CC BY 4.0). Not legal advice.

Full detail for a single vulnerability advisory by CVE / GHSA ID (e.g. 'ghsa:GHSA-xxxx') — severity, CVSS score, affected Composer/PHP package(s), and source link.

Pass a comma-separated list of up to 25 addresses and get an OFAC sanctions result for each, plus the flagged subset. Built for compliance agents vetting whole counterparty lists in one call.

Verify up to 100 emails in one call; returns a per-email record matching /verify.

Use it before paying an unfamiliar x402 endpoint or when choosing between paid APIs. We send one unpaid request and report whether it returns a valid 402, the price, asset, network and payTo, response time, whether that matches its public Bazaar listing, and our probe history, with a 0-100 score and each factor spelled out. Measured by our probes; not a guarantee. Never charged for errors: we settle the payment only after a successful answer.

a lucky. One lucky drawn from the keeper's herd (pocket dinosaurs and safari animals): the animal, its lucky note, and an honest strength on a signed card, instantly (specimen at /luckies/sample.svg). Amounts above the minimum record as tips. Full listing: https://scvd.store/menu/luckies. MCP tool: buy_luckies.

On-page SEO audit for any live URL. Returns a 0-100 SEO score plus the raw signals behind it: title tag and meta description with their lengths, canonical URL, robots directives, the full H1-H3 heading map, image alt-text coverage, Open Graph and Twitter card completeness, and whether schema.org structured data is present. Fetches the live page on every call, so results reflect the page as it is now. Use it to audit a landing page, diagnose weak search rankings, or inspect a competitor.

Look up the track record of any domain or wallet: how many times it has been assessed, verdict history, times flagged, first and last seen, a reputation score and a signed credential — a credit score for counterparties. Computed only from DYOE's own logged prior assessments; thin history is labeled as such. Input: ?target=

Higher-confidence evaluation for high-impact, sensitive, or difficult-to-reverse agent actions.

Verify an SEC filing: given a filer's CIK and a claimed accession number, does that filing actually exist, and does its form type/filing date match what's claimed? Checked against SEC EDGAR's submissions API. Catches a fabricated or misattributed filing citation, including a real-looking accession number paired with an invented form type or date.

Verify an FDA drug record: given a claim_type (approval, ndc, or recall) and its identifier, does that record actually exist, and does the given name match the canonical record? Checked against openFDA. Catches a fabricated or misattributed drug approval, NDC listing, or recall citation. Existence/status only, not medical advice.

Prueft eine Adresse auf Technik, Geschwindigkeit, Sicherheit, Auffindbarkeit und Barrierefreiheit. Je Abschnitt strukturierte Werte, dazu Punkte von 0 bis 100 und eine Befundliste, in der jeder Eintrag einen Beleg traegt: Header, Zeichenkette, URL oder Messwert. Der Schweregrad kritisch bleibt belegter Kompromittierung und offenen Zugaengen vorbehalten. Ausschliesslich lesende Pruefungen, keine Anmeldeversuche, keine Einschleusung, kein Lasttest. Abschnitte laufen parallel; ein Abschnitt, der sc

Fetch a URL and return its main content as clean Markdown (boilerplate stripped)

Fetch a URL and audit its content. Requires `url`. No URL to hand? POST /audit/registry runs the same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Scan an entire public GitHub repo for malicious AI-skill/supply-chain patterns. Requires `repo`. No repo in mind? POST /audit/registry runs this same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Counterparty trust verification for agents: before transacting with a domain, verify its trust artifacts — DNSSEC + DNS-AID records, agent-card, live MCP endpoint, published JWKS, OASF record, x402/commerce declarations. Returns a 0-100 trust score with per-artifact evidence. $0.25 per lookup.

Is this API safe to pay? Audit any x402 merchant or paid endpoint BEFORE you send money. Answers whether a service is trustworthy, whether it is a scam or dead, and whether it will actually deliver. Probes the live endpoint for a valid HTTP 402 challenge, detects price drift between the advertised price and the real challenge price, pulls settlement history and unique-buyer counts, and verifies on-chain USDC actually reaching the payTo address. Returns a PASS / CAUTION / AVOID verdict with the evidence behind it. Every check is measured live at request time — nothing cached, no reputation scores. Use before paying an unknown merchant, to avoid wasting money on dead or fraudulent endpoints.

The Conformance Watch. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. A watch id and a permanent history URL, readable immediately and filling in daily for seven days: one signed pass per day carrying the verdict, every failed check and advisory by name, plus a summary deriving the days the store missed and whether the readout drifted between passes. Bounded and prepaid; ends after seven days, renews only by re…

The Once-Over. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. A signed JSON audit report — verdict (ready, not_ready or unreachable), every check and advisory from the published preflight battery, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable report URL serving the record free forever. Instant; one GET at one moment, never monitoring. Full listing: https://scvd.sto…

The Refresh. REQUIRES ?url= on the paid request — a signed request without it is refused before the gate and no money moves. One fresh observation of your x402 endpoint by the weekly census's own instrument, right now instead of next Sunday — folded into your endpoint passport wherever it is newest, which moves the passport's freshness state (and the free embeddable chip that decays with it) back to fresh. Never a grade: the observation lands whatever it says, and a door fou…

A Bitcoin Anchor. REQUIRES ?digest= on the paid request — a signed request without it is refused before the gate and no money moves. A signed certificate binding the buyer's sha256 digest in its attests field, plus a stable proof URL serving the OpenTimestamps proof bytes — pending on purchase, upgrading automatically to a Bitcoin-confirmed proof verifiable with the standard ots tool against block headers alone. Instant; one digest, one submission, nothing recurs. Full listi…

Coffee's for Closers. REQUIRES ?win= on the paid request — a signed request without it is refused before the gate and no money moves. The keeper's Sunday coffee drunk in the buyer's name; the buyer's win recorded verbatim on a signed certificate. Full listing: https://scvd.store/menu/coffees_for_closers. MCP tool: buy_coffees_for_closers.