Security & trust

Uptime and price-honesty oracle for x402: trust status, attestations, USDC history.

Shopify product discovery and x402-paid offer verification for AI agents.

Paid Base USDC lending decisions and rate-risk alerts, plus free risk and routing tools.

Preflight x402 payment compatibility with structured risk evidence and remediation guidance.

IntegrityPhase webhook verification checks HMAC, format and freshness, issuing a signed proof for audit documentation. Share and verify it without the source secret. Example: B2B order acceptance; not proof of fulfilment. Registered IntegrityPhase HMAC sources; PL/CZ/FR legal entities; EUR 100-200 events outside critical processes. Pay USDC on Base via module .3 or Bazaar proxy. Onboarding, quote and recovery require IntegrityPhase MCP: https://api.integrityphase.com/mcp.

Check any x402 endpoint before paying, without paying: price in USD per network, asset (flags anything that is not official USDC), pay-to address and whether it is a contract, authorization timeout, Bazaar metadata, and risk alerts with a clear verdict.

+47 more from Vextorium

Is this EU VAT number valid? Live VIES check against the European Commission's official VAT Information Exchange System — validate a European VAT id, verify a business tax id before invoicing, confirm B2B reverse-charge / zero-rating eligibility. Returns the registered trader name and address where the member state discloses them. Deterministic: no LLM. Distinguishes a genuinely invalid number from a member state whose system is merely offline, which VIES itself does not do cleanly.

AQL PropertyCheck full report for one City of Gold Coast or Brisbane City address: the property and what surrounds it, with a source and status on every fact. Coverage is checked before any charge. Not a valuation.

Legal Entity Identifier lookup from the GLEIF golden copy, searchable by NAME - knowing the LEI already is the hard part. Returns records[] with lei, legalName, status, jurisdiction, legalAddress and a lapsed flag; LAPSED and RETIRED entities are returned, not hidden - a filtered record and no record look identical. Requires ?q=<legal name, max 200> or ?lei=<20 chars>. Errors: 400 missing_query|bad_lei, 404 no_match, 502 lei_unavailable. Sanctions screening is /sanctions.

Know Your Merchant (KYM) trust score: pass a merchant domain and get a deterministic 0-100 trust score with a band (high/medium/low/very_low/avoid) and human-readable reasons. Live signals: domain age from the RDAP registry of record, malware/phishing blocklist verdict via Cloudflare Security DNS, TLS certificate health, mail capability, and refund/privacy/contact page presence. The merchant-side check an agent runs BEFORE committing funds — the complement to know-your-agent.

CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachable" — never a false not-found.

Daily Sato Score history for one Sato Hub listing: score, tier components, GitHub stars, status and verification state per day, with the dates the score moved (genuine changes vs our own method revisions marked). Captured daily since 2026-06-12; not reconstructable. The current catalog and the daily score line stay free. Priced per daily point returned: $0.005 for up to 90 days, +$0.001 per day beyond.

Independently verify an agent's output before you pay: an invoice or any deliverable, checked against your JSON Schema and rules like sums matching totals. Pass/fail, % passed, fix hints and a signed receipt. $0.02 USDC, no signup, x402 v2.

+1 more from Agent Output Verifier

Geopolitical Business Risk Context. Synthesises cross-domain stress evidence into transparent risk transmission, downside and resilience context. Purpose: Surface material risk drivers, transmission paths and invalidation conditions without false precision. 15-minute freshness target; missing evidence is reported explicitly rather than invented.

+3 more from Edge Agents AI

Every OFAC SDN/Consolidated addition, removal and record change observed in the rolling log, newest first, with the coverage start date so an empty answer is unambiguous

+1 more from OFAC Sanctions Name Screen

Passive HTTP security header review for an authorized external target (no exploitation; platform hosts blocked)

Swartzpath — legal OA path to the paper (Unpaywall/OpenAlex). Not Sci-Hub. Closed stays closed.

+3 more from Trust Index

Same lookup as /lookup/{agentId} — this route exists to measure willingness-to-pay and x402 Bazaar discoverability, not because the result is different or better paid.

Seller reputation by payTo address: how many endpoints it serves, how many are live, price range, clone-farm and quote-only flags, and on-chain activity on Base (settlements and unique payers over 30 days, last settlement time).

Pre-sign risk verdict plus a plain-language explanation in Dutch or English

MioDio Meridian ERC-4626 vault risk card - share price, drawdown, APY estimate, and withdrawable liquidity for one vault (~$0.04 USDC Exact on Base). MioDio x402 DeFi.

Did this USDC transfer settle to the expected address and amount? $0.001.

GenTech Labs x402 - Security

Should an agent pay this x402 endpoint? One live probe of its payment challenge plus its settled-call and unique-payer history, price consistency and domain reputation, returned as ok / caution / avoid with reasons. Use before paying an unfamiliar x402 endpoint.

BitBooth Webhook Signature Verify: pay 0.005 USDC, verify a webhook signature against the provider's canonical HMAC scheme. Supports stripe, github, vercel, cdp, slack, and generic HMAC-SHA256. Constant-time compare, clock-skew tolerance on timestamp-bearing providers (Stripe / Slack / CDP). Stateless — caller supplies their secret in the request body, we never store it.

Live on-chain checks of a Morpho (MetaMorpho) vault on Base: official-factory verification, USDC peg 0.98-1.02 (Chainlink, fresh), governance (curator/owner/guardian/timelock/fee), share price, idle USDC, deposit status. One block (number+hash). Verdict SEM_ALERTAS/ATENCAO/ALTO_RISCO. Does NOT analyze underlying markets (collateral, LLTV, caps). Not charged when unverified or incomplete.

Pre-payment safety check for any x402 endpoint. Use when your agent is about to pay an x402 URL it has not paid before, found it in a catalog, or the price or payee looks unfamiliar. Sends one unpaid probe (never pays or signs) and returns safe_to_pay, confidence 0-1, reasons, and checks: live 402 challenge, USDC asset, price and payTo vs the Coinbase Bazaar listing, latency, 30-day paying wallets. Costs less than one bad payment.

Does this x402 endpoint really deliver? x402 Doctor buys it once with the example input its own listing declares (at most $0.1, USDC on Base), checks the answer against the declared output schema and measures the charge on chain. Answers with a job id at once; the result is public, usually within 30 minutes. For sellers who want proof, and buyers before a big order.

ALICE V0 — Security Scanner: OWASP Top 10, CVE check, dependency audit, vulnerability assessment