Paid services on Base matching “secrets”

Entry to the Secret Chat for the Chosen for 24 hours

Secret scan for exposed API keys, tokens, passwords, and credentials in text — returns redacted output without exposing matched secret values. Ideal for agent pre-flight checks before sharing config or logs.

Scan source code or configuration text for hardcoded secrets: AWS access keys, GitHub/Slack/Google tokens, Stripe and OpenAI keys, PEM private-key blocks, JWTs and high-entropy secret assignments. Placeholder values are filtered out. Each finding gives the rule, a severity (critical/high/medium/low), line and column, entropy and a masked excerpt. Offline and deterministic.

Store a secret (API key, webhook payload, signed URL) encrypted with WebCrypto AES-256-GCM and share a claim URL that yields the secret exactly once. A Durable Object serializes reads so single-use delivery is race-free, and every burn returns an Ed25519-signed attestation. Creating a vault requires x402 payment; the recipient's claim read (GET /v/:vault_id) is free.

Timelock encryption (tlock / encrypt-to-the-future): seal a payload toward a future drand round — undecryptable by anyone, including us, until that round lands; or open a landed seal. For sealed-bid auctions, commit-reveal, scheduled secrets, dead-man switches. age-armored, interoperable. Free zero-knowledge inspect at /sealed/inspect.

Screen up to 3000 characters of untrusted text for prompt injection, secret exfiltration, deceptive payments and phishing. Jev risk scores, five attack families and an exact suspect passage. French, English and Spanish evaluation; probabilistic screening, not a security guarantee. Text is processed by the Jev provider; live credentials are outside the supported input scope.

Replace values at exactly named object keys recursively; no secret detection and no guarantee that unlisted fields are safe to share.

Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.

Give this API any text or binary data and it returns its fingerprint under whichever hash algorithms you choose - SHA-256, SHA-512, MD5, BLAKE2, CRC32 and more. It also signs data with a secret key (HMAC) and safely verifies whether an incoming signature matches, using a timing-safe comparison. Language models cannot hash: they emit a string of the right length and character set that is simply wro

Generate an RFC 6238 time-based one-time password from a base32 secret. Uses the current time by default, or an explicit unix timestamp (seconds); configurable period (default 30s), digits (default 6) and algorithm (default SHA1). Also returns the counter and seconds remaining in the window.

Rent a Linux server for a month and get root access: 1 vCPU, 1 GB RAM, 10 GB NVMe, a dedicated IPv4 address, Ubuntu 24.04, in Germany or Finland. Pay per month in stablecoins with x402 or MPP, no account and no card. The answer carries a server id and secret; the IP and the root password follow in about 5 to 10 minutes. Extend it with the renew route.

Verify a JSON Web Token's signature and claims against a shared secret (HS*) or a PEM public key (RS/ES/PS). Returns { valid, payload } on success or { valid: false, reason } for a bad signature, expired/not-yet-active token, or a failed issuer/audience/subject check. Pass `algorithms` to pin the accepted signing algorithms and prevent algorithm-confusion attacks.

Prepaid travel eSIM data plans, sold per order for USDC on Base via x402. For agents buying mobile data abroad for a person's phone or tablet. 1433 single-country, regional and global plans, $0.99 to $202.99 depending on the plan picked by launch_sku_id (listed at GET /catalog). Once payment settles on-chain, the eSIM is retrievable with the order's delivery key or claim secret. This generic chall

Compute a keyed HMAC of some data with a secret key — the standard way to sign and verify webhooks (Stripe, GitHub, etc.) and API requests. Data and key may each be utf8/hex/base64/base64url; the tag is returned as hex/base64/base64url.

Pay $0.01 USDC to create a leaderboard or add, update, or delete one entry. Use a secret leaderboard_key UUID to continue writing to the same board. If value is null, the named entry is deleted. Public pages stay free at GET /leaderboard/{slug}. Network: Base Mainnet. Each request writes one named score and returns the board key and URLs.

MCP Server Scan by Agentropolis: scan a live remote MCP server URL (or pasted tools/list) before your agent connects. Reads initialize + tools/list only, never calls a tool. Flags poisoned or hidden tool instructions (IMPORTANT tags, conceal-from-user, secret or side-channel asks, invisible Unicode, tool shadowing, payment injection). Fingerprints every tool (sha256) and diffs vs your last scan to

Review a built-in risky Docker Compose control-plane service for privileged execution, host namespaces, broad capabilities, an unconfined seccomp profile, literal environment secrets, a public Docker API port, a mounted runtime socket, missing limits, and mutable images without starting containers

Generate a stable, secret-free fingerprint from a build or test failure so agents can group duplicate CI errors across changing line numbers, timestamps, paths, identifiers, and retry attempts.

Agent Referee — fair random pick between two AI agents with agreed odds (e.g. 70/30). Both agents add secret seeds so neither can steer it. Each agent pays this to join. Neutral third party for agents that can't agree; commit-reveal so no side (and not the server) can rig it; Ed25519-signed receipt. Step 1: POST /matches (free) to get match_id. Step 2: this call claims your seat and returns seat_t

Run a bounded deterministic preflight scan for possible private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON. Not a comprehensive security audit.

Full-surface analysis of a target: a website, an API, a shipped JS bundle, or (as a prepared runbook) a local artifact such as an ELF/PE/.NET/Mach-O binary, an Electron app.asar, an APK or a jar. Returns a capability map where every claim carries its evidence, the entry points found, feature flags and client-side secret shapes (shapes only, never values), and an explicit list of what could not be

GitHub-Audit Repository Supply-Chain & Dependency Scanner: Audits open-source repositories for supply-chain risks, CVEs, and secret leaks.