Security & trust

Bulk security headers check: up to 20 urls in one call, processed concurrently, results returned in input order with a per-item error field and a count of failures. Same answer per item as the single /http-headers endpoint (HTTP security headers check for a website). Batch enrichment for agents that hold a list. $0.01 per batch.

Prepare an inspectable context-selection evidence pack from caller-supplied documents and labelled spans. Combines budget comparisons, retention checks and policy-bound receipts. Verification concerns the declared workflow, not factual truth, answer quality or legal compliance.

Agent-readiness audit of a website: AI bots allowed in robots.txt? main content extractable? llms.txt, sitemap, structured data, OpenAPI/MCP/x402? Score 0-100 with a fix list.

Verify a paper citation by DOI, arXiv id or title (Crossref, OpenAlex, arXiv): exists? title/year/authors match? retracted?

Give a claim and a source URL; get the exact sentence that supports it, or a NUMBER_MISMATCH flag when the source says the same thing with different numbers.

Know Your Business verification: company registration, sanctions screening, VAT/VIES, and domain analysis in one call.

Full entity trust check across multiple verification layers: KVK/CBE registry, OpenSanctions, country risk (CPI/FATF), domain WHOIS, IBAN validation and EU VAT/VIES. Returns trust score 0-100 with cluster and recommendation.

Quick risk score (0-100) for entity name + country. Lightweight check without full data source scan.

Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.

Business Frameworks business-frameworks/risk/band/[email protected] — Risk below $5M: the chance of survival. Call when an agent needs how risk behaves at this revenue scale, for a business it is running or advising. Returns 350 tokens of original synthesis with public citations and child handles; free layer at /catalogue.

Business Frameworks business-frameworks/risk/decide/[email protected] — Limit concentration. Call when an agent operating a business (launch to ~$50M revenue) must decide on risk and wants the rule, the inputs it needs, the action and the check. Returns 220 tokens of original synthesis with public citations and child handles; free layer at /catalogue.

Business Frameworks business-frameworks/risk/decide/[email protected] — Set the hurdle rate. Call when an agent operating a business (launch to ~$50M revenue) must decide on risk and wants the rule, the inputs it needs, the action and the check. Returns 220 tokens of original synthesis with public citations and child handles; free layer at /catalogue.

Business Frameworks — Limit concentration, applied to the caller's own numbers. Send the largest customer's and supplier's shares and the owner-only functions; get which dependencies are priced risks and what to do first. Deterministic (the node's rule, no model); returns the worked decision plus the node text and its public citations. Schema at GET /apply/risk/decide/concentration.

Counterparty check before paying a platform or crypto provider: French AMF blacklists, ESMA MiCA register (authorised and non-compliant CASPs), sanctions lists (EU, UN Security Council, US OFAC SDN). Official public data, refreshed daily.

Check a SHA-256 against a Securaw/TimeChain2 event. Reports registry checks and direct-file Bitcoin proof separately, with downloadable proof when available. Missing events and mismatches are billable results. Pending/unavailable is NOT Bitcoin confirmed. Legacy receipts without direct-file proofs are explicitly identified. No arbitrary-chain verification. Idempotency-Key required.

Verify a CryptoVar Black-Scholes VaR artifact by replaying its parameters, result and audit proof. 0.10 USDC. Returns valid true/false and the expected SHA-256 proof. An invalid artifact is a completed verification, not a service failure. CryptoVar artifacts only; no certification of model assumptions or future losses. Automatic delivery, 30-minute SLA. Idempotency-Key required.

The newest npm security advisories as machine-readable JSON: severity, CVSS score and vector, CWEs, affected packages, vulnerable ranges and first patched version. Merged from two GitHub Advisory Database orderings, most recently published and most recently revised, so a newly assigned CVSS or a widened vulnerable range reaches you even when the advisory is months old. Add ?since=<ISO-8601> for only what changed; an empty delta is refused free, so polling costs nothing until there is news.

WCAG accessibility audit of a public URL using headless Chromium and axe-core: violation/pass/incomplete counts by impact, per-rule detail, and a 0-100 score.

Install-safety signals for an npm or PyPI package: registry metadata, install-script usage, OSV advisories, typosquat risk, and a 0-100 trust score.

x402 seller trust check before you pay: probes the live 402, reads USDC inflow to payTo on Base, counts payers and flags self-dealing (operator paying itself) - verdict green/yellow/red with reasons and the window it could read

Instant technical audit of ONE page: OnPage score, meta, timings and failed checks — no crawl, seconds instead of minutes

Full AI search visibility audit — AEO/GEO/SEO 4-layer strategy, AI inclusion check, schema gaps, llms.txt review, P1/P2/P3 roadmap. 2.50 USDC.

ICS malware encyclopedia. Pass ?name=PIPEDREAM. Returns capabilities, targeted OT protocols, attributed actor, affected vendors, detection signatures, and MITRE ATT&CK ICS techniques. Covers PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY.

OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500&sector=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat actors. Optional firmware param enables firmware-specific CVE matching. Cached 1 hour.

DDG agent-payable service request

DDG agent-payable service request

DDG agent-payable service request

Vendor security & privacy profile from a domain: claimed certifications (SOC 2, ISO 27001…), AI training on customer data (with quote), subprocessors, DPA, data residency, security features and a transparency score.

Sanctions screening (AML/KYC) against three official lists in one call: EU (Commission FSF), UN Security Council and UK (HM Treasury OFSI) - 12,000+ entities, 50,000+ name variants, re-indexed daily, fuzzy matching. Each hit states its list, programme, reference and the list date. The signed response includes a versioned compliance workflow, an exact counterparty follow-up URL when safe, and a daily recheck-not-before time. Optional lists=eu,un,uk.

DDG agent-payable service request