Security & trust

Detect material drift between comparable trust vectors without asserting misconduct

Create a privacy-minimized behavioral commitment from bounded observations

Assess multiple manipulation signals with uncertainty and mandatory abstention

Compare claimed capabilities with independently evidenced successful observations

Select the highest-priority healthy compatible provider without silent fallback

Negotiate deterministic sustained and burst request limits

Validate tool output against a bounded top-level JSON Schema subset

Verify active task lease ownership before execution or mutation

Verify hash-linked session identity and monotonic sequence continuity

Reject x402 quotes that cannot remain valid through authorization and retry

Bind MCP catalog digest to TTL, scope and revalidation policy

Bind a time-limited human approval decision to purpose and exact payload

Verify cancellation state and unresolved side effects

Validate MCP protocol, method and stateless-discovery compatibility

Bundle independent source observations while exposing agreement and disagreement

Test whether source observations meet an explicit maximum-age policy

Canonical PHION catalog snapshot or digest-based delta with exact execution templates and signed evidence

Call when an agent needs a structured SEO and technical audit of a public URL: HTTPS, status, title, meta description, robots, canonical, JSON-LD, H1 count, load hints, score 0–100, and issues[]. Use it before citing or submitting a page. SSRF-safe. Send JSON {"url":"https://example.com/"}. Exact $0.01 USDC on Base. Try unpaid POST /v1/sandbox/page-audit first.

Call when an agent needs a security-header audit (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy) with a 0–100 score for a public URL. Use it before sending users to a site. SSRF-safe. Send JSON {"url":"https://example.com/"}. Exact $0.004 USDC on Base. Try unpaid POST /v1/sandbox/security-headers first.

Real working agent tool endpoint that executes static vulnerability analysis on Solidity smart contracts (detecting reentrancy vulnerabilities, unchecked ERC-20 transfers, tx.origin authentication flaws, and unindexed events).

Call when an agent needs JSON converted to YAML. No network. Exact $0.001 USDC. Prefer unpaid POST /v1/sandbox/json-to-yaml first.

Call when an agent needs YAML converted to JSON. No network. Exact $0.001 USDC. Prefer unpaid POST /v1/sandbox/yaml-to-json first.

Stop repeated execution nodes and step overruns

Identify changed manifest fields and hashes

Validate and sign a portable event hash chain

Fetches https://domain/.well-known/nostr.json with the name query parameter and reads the mapping the domain publishes. The answer states the resolved public key in hex and as npub, the relay hints the document lists for that key, and the HTTP status and final URL after redirects, so a redirect to a login page is distinguishable from a genuine answer. Given an expected public key, the comparison is made and the result is reported as an explicit match or mismatch rather than left to the caller.

Scan any OpenClaw SKILL.md for malware, prompt injection, exfiltration, and 37 other threat patterns. Returns risk score 0-100 and detailed findings.

Calculate a composite Anti-Money Laundering (AML) risk score for a person or company. Aggregates sanctions screening, PEP status, and jurisdiction risk into a single 0-100 risk score with risk level classification.

Validate an NPI number (checksum) and enrich via the CMS NPPES registry

Full wallet risk profile in one call: behavior classification + credit score (0-100) + labeled-counterparty exposure (last N days, default 7). Returns verdict (low_risk/medium_risk/high_risk/flagged), risk_score, primary_tag, red_flags (zero-history, sanctioned/mixer/scam), plus identity/credit/exposure detail. Replaces classify+score+exposure in one paid call. For AI agent due diligence and payment-routing risk gating. Accepts payment on Base or Solana — either network works.