Security & trust

Call when an agent needs a security-header audit (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy) with a 0–100 score for a public URL. Use it before sending users to a site. SSRF-safe. Send JSON {"url":"https://example.com/"}. Exact $0.004 USDC on Base. Try unpaid POST /v1/sandbox/security-headers first.

minia2a service: x402-email-verify

Normalize and compare multiple x402 quotes

Enforce recurring period budgets

Stop repeated execution nodes and step overruns

Identify changed manifest fields and hashes

Validate and sign a portable event hash chain

Fetches https://domain/.well-known/nostr.json with the name query parameter and reads the mapping the domain publishes. The answer states the resolved public key in hex and as npub, the relay hints the document lists for that key, and the HTTP status and final URL after redirects, so a redirect to a login page is distinguishable from a genuine answer. Given an expected public key, the comparison is made and the result is reported as an explicit match or mismatch rather than left to the caller.

Scan any OpenClaw SKILL.md for malware, prompt injection, exfiltration, and 37 other threat patterns. Returns risk score 0-100 and detailed findings.

Calculate a composite Anti-Money Laundering (AML) risk score for a person or company. Aggregates sanctions screening, PEP status, and jurisdiction risk into a single 0-100 risk score with risk level classification.

Validate an NPI number (checksum) and enrich via the CMS NPPES registry

Full wallet risk profile in one call: behavior classification + credit score (0-100) + labeled-counterparty exposure (last N days, default 7). Returns verdict (low_risk/medium_risk/high_risk/flagged), risk_score, primary_tag, red_flags (zero-history, sanctioned/mixer/scam), plus identity/credit/exposure detail. Replaces classify+score+exposure in one paid call. For AI agent due diligence and payment-routing risk gating. Accepts payment on Base or Solana — either network works.

Your agent found a prospect's email — is it real? Deliverability check, DNS, and domain reputation in one call.

Look up known vulnerabilities for a package+version via OSV API. Supports npm, PyPI, Maven, Go, Cargo, NuGet. Returns CVEs with severity and fix versions.

Generate production nginx server blocks with SSL, proxy_pass, WebSocket support, security headers, gzip, rate limiting.

Email security posture: SPF/DKIM/DMARC presence and parsed policy. Detects missing or misconfigured email authentication. Use ?domain=example.com. Built for email deliverability and phishing prevention. Accepts payment on Base or Solana — either network works.

Verify an email address. Uses one verifier credit on all attempted verifications.

Comprehensive domain reputation report combining RDAP (modern WHOIS), DNS records, email security (SPF/DKIM/DMARC), SSL certificate inspection, and domain age. Returns risk_summary (low/medium/high) and specific risk_reasons. Use ?domain=example.com. Built for fraud detection, marketing list verification, KYA workflows, and security agents. Accepts payment on Base or Solana — either network works.

Validate a DEA number format and checksum

Audit agent wallet — structured USDC spend summary from public ledger

Verify a Brazilian investment fund by CNPJ against the official CVM registry: is it registered, is it operating, who is the manager (gestor) and administrator, its class and ANBIMA classification, plus the latest daily NAV, net assets and shareholder count. The instant check against fake-fund and Ponzi schemes marketed as investment funds. Free sample, no payment: https://api.brazilayer.com/v1/fundos/amostra

Analyze raw HTML you provide and get structured SEO data as JSON: title, meta description, canonical, H1-H6 outline, links, JSON-LD blocks and structural checks (single H1, heading order, duplicates, JSON-LD validity). Use it to audit a page before publishing. No URL fetching, no JavaScript execution. Max 64 KiB of HTML.

Per-entity report built from one real check's signals: identity, sanctions and PEP screening, domain signals, trust score (risk.trust_score, 0-100, 100 = best), correlations with the caller's earlier reports, sources and an evidence hash. A source that did not answer is shown unavailable, never clean.

Reputation scoring with linear trust decay: after its first week a score loses 2-5 points a week by risk cluster (none for a sanctions-flagged entity), plus a bonus of up to 5 points for repeat verifications.

MCP tool: quick risk score for entity name + country pair.

Sanctions screen of a company or person name against the OFAC SDN, EU and UN sanctions lists, held locally and refreshed daily. Returns each matched entry: list, entry id, matched name, programmes, countries, listing date and match score. Exact normalised or word-order-insensitive name match only; a name match is not a determination.

Before onboarding or a payment run: screen up to 500 IBANs in one call for sanctioned banks (BIC) and high-risk jurisdictions against the official OFAC, EU, UN and FATF lists, for KYB/AML compliance

Check budget and approve/deny AI agent spending with x402 payment verification

Analyze raw HTML you provide and get structured SEO data as JSON: title, meta description, canonical, H1-H6 outline, links, JSON-LD blocks and structural checks (single H1, heading order, duplicates, JSON-LD validity). Use it to audit a page before publishing. No URL fetching, no JavaScript execution. Max 64 KiB of HTML.

Domain security check: SSL certificate, DMARC/SPF, DNSSEC, security headers and blocklist status with a score