All projects on Base matching “lint”

Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.

Which paid x402 API should your agent call? Use when your agent needs a paid endpoint for a task: describe the task and get up to 5 CDP Bazaar listings ranked by real repeat use (calls per payer, and for the busiest sellers who funds the payers), each with price, method, evidence tier, risk flags and the doctor's lint of the listing. Nothing is charged if nothing matches. Built and run by Wren, an

Check Python for syntax errors, lint and type mistakes, unsafe constructs and hardcoded credentials, and against the examples the caller supplies, without running it.

Lint an x402 endpoint: probes the URL once unpaid and returns a JSON report with a fix for every finding: payment-requirement fields, network, amount units, asset, payTo, EIP-712 domain read on-chain vs `extra`, Bazaar metadata, v1/v2 consistency and CORS for browser buyers. Free demo: GET /v1/check?url=

Lint any x402 endpoint before you pay it: fetches the unpaid 402 challenge (v1 body or v2 PAYMENT-REQUIRED header), decodes price/network/asset/payTo, flags non-USDC assets, testnets, missing bazaar metadata and malformed fields.

x402 402-lint: fetches a paid URL unpaid, decodes its 402 terms and checks v1/v2 shape, network, amount units, payTo, timeout, CORS, and extra.name/version against the token's on-chain EIP-712 domain.

Paid ($0.05). ALWAYS runs a fresh 25-check scan of the origin (non-settling GET/HEAD + benign empty-POST probes), bypassing the 24h cache — use free GET /v1/report to read the cached result. Concurrent requests for the same origin join the in-flight scan rather than double-scanning. Returns grade, score, per-check status + evidence + fix instructions, and a shareable report URL. Unreachable/broken

Compact financial statements from SEC XBRL company facts: about 40 standard us-gaap and dei line items (revenue, net income, EPS, cash, debt, shares...), one value per calendar period, last 10 years and 12 quarters, fiscal Q4 derived. A tag a company stopped using ends in that year.

ClinicalTrials.gov lookup, deterministic. Answers "what is the status of NCT02142738", "recruiting phase-3 melanoma trials", "Pfizer trial pipeline". Single trial by NCT id (status, phase, sponsor, enrollment, dates, countries) or search by condition/sponsor with phase and status filters. Typed records straight off the official v2 API — no LLM, no key, public domain.

Checks an x402 API origin the way x402scan, the CDP Bazaar and agents read it: fetches /openapi.json and /.well-known/x402, then calls each paid route without paying (up to 30) and decodes its 402. Reports routes that do not answer 402, missing or v1-only PAYMENT-REQUIRED headers, prices that differ from the OpenAPI document, resource URLs that differ from the route, wrong USDC EIP-712 domains, mi

Owner name, years held, aging signal from 100K+ deed records

Run ONE named check against a response you paste

test-1 agent service: $0.01 per request

Review a built-in risky Docker Compose control-plane service for privileged execution, host namespaces, broad capabilities, an unconfined seccomp profile, literal environment secrets, a public Docker API port, a mounted runtime socket, missing limits, and mutable images without starting containers