All projects on Base matching “security”

Domain & DNS intelligence — records, SSL certs, subdomain discovery.

Checks whether an npm, PyPI, or crates.io package is safe to install: confirms it exists, flags malicious or typosquatted/slopsquatted names, checks known CVEs (OSV.dev), and pulls its OpenSSF Scorecard. Returns an ALLOW/WARN/BLOCK verdict before your agent installs it.

Checks whether a token contract address is real, matches its claimed symbol, and whether its supply figures match an independent source (CoinGecko) — before trading, coding, or reporting against it. Catches hallucinated/wrong addresses, address-poisoning impersonation, and tokenomics hallucination.

Crypto sanctions screening API (OFAC). Sanctions screen for one crypto address, for agents and apps that send payments: exact match against all 1050 digital currency addresses in the official US Treasury OFAC SDN list (EVM case-insensitive). Returns sanctioned true/false, matching SDN entity, programs and list date, a chain guess and checksum validity, plus the list date. Informational, not legal

Payment-Injection Screen by Agentropolis: send text your agent is about to act on (tool result, web page, email, file). Flags payment-looking instructions: pay/transfer requests, fake licence or refundable fees, swapped wallets, token approvals, seed-phrase asks, hidden text. Returns clean/caution/likely_payment_injection with evidence. Advisory only.

Website audit for AI agents: one URL in, one structured JSON report out, 69 checks with stable issue codes and exact fixes.

WalletTriage — real-time wallet risk check: dangerous ERC20 approvals cross-referenced with a live exploit threat feed. Returns risk_score (0-100), risk_level and actionable findings.

Invisible bot protection. Score form submissions 0-100 based on behavioral signals. No CAPTCHAs.

EVM wallet risk scoring — transaction patterns, exposure analysis, suspicious activity

Agent Reputation Check by Agentropolis: give a payTo and/or an agent / A2A / MCP URL. Returns owner, verified domain, real outside buyer history, wash flags and trust score from Agentropolis. Says when coverage is limited. Deterministic, no LLM.

MCP Server Scan by Agentropolis: scan a live remote MCP server URL (or pasted tools/list) before your agent connects. Reads initialize + tools/list only, never calls a tool. Flags poisoned or hidden tool instructions (IMPORTANT tags, conceal-from-user, secret or side-channel asks, invisible Unicode, tool shadowing, payment injection). Fingerprints every tool (sha256) and diffs vs your last scan to

DeepCounterfeit pre-buy check for 8QtbrC9d3BezyCwzBFUQbNsWJGte7ckrZ7HWcn81pump (risk signals, informational only, not financial advice)

Token safety scanner for Base (JSON body): 0-100 safety score, risk band, and red flags for any Base token contract.

Is this API safe to pay? Audit any x402 merchant or paid endpoint BEFORE you send money. Answers whether a service is trustworthy, whether it is a scam or dead, and whether it will actually deliver. Probes the live endpoint for a valid HTTP 402 challenge, detects price drift between the advertised price and the real challenge price, pulls settlement history and unique-buyer counts, and verifies on

Email authentication check for a domain: SPF, DMARC policy and common DKIM selectors, with findings and a verdict.

OpenAI-compatible LLM Chat Completions Gateway ($0.002 USDC/call). Drop-in replacement for /v1/chat/completions — change base_url to https://agent-kiosk.vercel.app/v1 and pay per request in Base USDC via x402 with zero account or API key setup.

Crypto Fear and Greed index - is the crowd greedy or fearful right now, and what is the 30-day trend. ALIAS PATH of /api/crypto-fear-greed, published with the EXACT slug the router's winning row publishes (fear_greed_index, with the underscore). MEASURED DEMAND: this slug scores 30 slug points and takes the top visible slot on the buyer's 'fear greed index' query. via x402

Onchain risk assessment for one token on one chain (Base, Ethereum, BSC, Polygon, Arbitrum, Solana and others): a single risk score from 0 to 100 with a severity level, explicit risk flags such as honeypot, high transfer tax, proxy contract, concentrated holders or thin liquidity, plus current price, total liquidity, holder count, buy and sell tax percentages, owner and creator addresses, the five

Use this before adding or upgrading an npm dependency (OpenZeppelin, solmate, hardhat…), or to triage a lockfile: GitHub/OSV advisories affecting a whole package-lock.json or yarn.lock (or up to 100 listed packages) at their exact pinned versions. Instant, per request.

Offline pre-sign check (no RPC, fast): decodes a transaction, EIP-712 typed data (Permit, Permit2, EIP-3009), an EIP-7702 authorization or an x402 402 + payment payload and returns SAFE/CAUTION/DANGER, every risk flag with its reason, decoded args, counterparties, x402 payment-vs-402 match and OFAC SDN screening. Use /v1/check for on-chain facts and simulation.

DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, partial pct), a DKIM selector probe, CAA, and whether the zone is DNSSEC-signed. Read entirely over DNS-over-HTTPS, so nothing is sent to the target host. Every finding carries a st

On-chain contract risk score: detects upgradeable proxies and privileged functions from live bytecode. Use before trading/interacting with an unfamiliar contract.

Web content extraction: fetch any public URL and get clean readable text, title, meta description, OpenGraph data, headings, links and word count as JSON. Built for AI agents that need web page content without HTML noise.

x402 preflight: before your agent signs a payment, fetch a paywalled URL's 402 and lint it. Parses v1 bodies and v2 PAYMENT-REQUIRED headers, then checks each accepts[] option: known network, canonical USDC, EIP-712 domain (extra.name/version) that a signature will verify against, EIP-55 payTo, zero/contract payTo, amount sanity, timeout, testnet, resource-host mismatch. Returns ok/warn/block per

Your rank and percentile by settled calls across the ranked market, plus your per-buyer economics against the market medians.

ERC-20 token safety pre-check from on-chain data only (Base, Ethereum, Arbitrum, Optimism, Polygon, BSC): name/symbol/decimals/supply, owner and whether renounced, EIP-1967/minimal proxy detection, and a bytecode scan (incl. implementation) for mint, blacklist, adjustable-fee, max-tx, trading-switch and pause functions, with flags and a risk level. Run before swapping into an unknown token. $0.005

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoi

Attention index for any word/entity fusing Wikipedia readership (Wikimedia pageviews, resolved word->article and disambiguated by real traffic) with the global news stream (GDELT coverage volume). Returns a 0-100 index, WoW/MoM deltas, datestamped spikes and a trend in one call. An attention/curiosity index over Wikipedia and world news — not Google Trends / Google search interest.

HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HSTS/CSP/X-Content-Type-Options, expiring cert, weak TLS, CORS wildcard, insecure cookies, version disclosure, slow p95, redirect loops). Private, loopback and link-local targets are

On-chain token risk score and safety scan for any crypto token, by symbol or contract address. Returns 8 weighted dimensions — holder concentration, top-1 holder identity, holder income share vs protocol revenue, price percentile over 366 days, P/TVL and P/S, supply integrity and mint/freeze authority, DEX+CEX exit liquidity, and multi-wallet clustering / wash-trading detection — each with its raw