Egress Audit

Last 30 days

Uptime

100%

Response time

240 ms typical, 682 ms slowest 5%

Last check

7 min ago

Next check

in 23 min

How to call it

# See the payment challenge (nothing is charged)
curl -i -X GET "https://mini-tollbooth.onrender.com/egress-audit?log=%5B%7B%22url%22%3A%22https%3A%2F%2Fapi.example.com%2Fx%22%2C%22method%22%3A%22POST%22%2C%22body_snippet%22%3A%22...%22%7D%5D&manifest=%7B%22endpoints%22%3A%5B%22api.example.com%22%5D%7D"

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fmini-tollbooth.onrender.com%2Fegress-audit
const res = await pay("https://mini-tollbooth.onrender.com/egress-audit?log=%5B%7B%22url%22%3A%22https%3A%2F%2Fapi.example.com%2Fx%22%2C%22method%22%3A%22POST%22%2C%22body_snippet%22%3A%22...%22%7D%5D&manifest=%7B%22endpoints%22%3A%5B%22api.example.com%22%5D%7D");
console.log(await res.json());

Example input

{
  "log": "[{\"url\":\"https://api.example.com/x\",\"method\":\"POST\",\"body_snippet\":\"...\"}]",
  "manifest": "{\"endpoints\":[\"api.example.com\"]}"
}

Example output

{
  "description": "NOT AN AUDIT — heuristic egress screen: paste your agent's outbound request log (JSON: url, method, body_snippet) plus an optional declared-endpoint manifest, and get flagged workspace-content and secret leaks to unvetted endpoints plus declared-vs-actual endpoint analysis. Verdict: EXFILTRATION_RISK, REVIEW, or CLEAN ($0.10).",
  "findings": [
    {
      "detail": "…",
      "request_index": 3,
      "type": "undeclared-endpoint",
      "url_host": "webhook.example.net"
    }
  ],
  "lane": "/egress-audit",
  "requests_analyzed": 12,
  "summary": "…",
  "undeclared_endpoints": [
    "webhook.example.net"
  ],
  "verdict": "REVIEW"
}

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks