All projects matching “security”

Website HTTP and metadata inspection report

Score a URL for phishing risk before an agent opens or trusts it. Keyless, deterministic heuristics - typosquat / homoglyph of a known brand, punycode / mixed-script hosts, credentials-in-URL, raw-IP hosts, suspicious TLDs, over-deep subdomains - plus a best-effort domain-age check (young domains are a top phishing signal). Returns a 0-100 risk score, a SAFE / SUSPICIOUS / DANGEROUS verdict, and l

Check a counterparty before paying: OFAC SDN, phishing and drainer feeds, a live watch of drainer infrastructure, transaction simulation and injected-instruction analysis. Returns a score and a signed ES256 attestation.

Audit text for malicious AI-skill patterns. Requires `content`. Nothing to audit — crawling, or discovering this endpoint cold? POST /audit/registry runs the same scanner over the newest servers in the official MCP registry: no input required, $0.005.

Parse a pasted SPF record without DNS (RFC 7208): mechanisms with qualifiers and values, modifiers, syntax errors, the all policy and the number of terms that need DNS lookups, with coded findings such as +all, ptr and over ten lookups. Use when an agent must check an SPF record before publishing it. Input: {"record": "v=spf1 mx include:_spf.example.com ~all"}.

Screen one address (EVM, Bitcoin, Tron, Solana, Polkadot, Cosmos or WAX as wax:account) against the OFAC SDN list, Tether/Circle freezes (EVM, Tron, Solana) and public C3 reports. Returns action BLOCK (OFAC SDN match), REVIEW (reported or frozen; current freeze = HIGH) or ALLOW_NO_REPORTS, riskScore, riskLevel, sanctions, freezes, reports, related domains, co-occurring addresses. NONE_REPORTED mea

Deterministic on-chain structural-safety report for a Base address: contract detection, verification status, proxy/owner/privileged-function analysis. Behavioral signals (age, activity, funding) not yet included. Keyless x402-native payment — no signup, no API key. Score 0-100, higher = structurally safer. See free real samples before paying: GET /samples/index.json

Follow the money out of a wallet. Walks outflows hop by hop under a causal gate (each hop must post-date the last and carry continuous value) until it reaches an exchange deposit, a bridge, a swap venue, or runs out of trail. Returns every hop with its labelled destination, the token-leg outflows alongside the SOL leg, and whether the trail ended at an exchange or a privacy protocol.

Secret scan for exposed API keys, tokens, passwords, and credentials in text — returns redacted output without exposing matched secret values. Ideal for agent pre-flight checks before sharing config or logs.

Per-country conflict / instability signal from GDELT (?country=)

Call before publishing a claim that cites EU law. Checks that the cited instrument exists in our pinned corpus, that the cited article exists within it, and whether your quoted text actually appears in that article. Covers the AI Act, GDPR, NIS2, DORA and the Cyber Resilience Act. Returns the official article text with a EUR-Lex link. Citation verification only: it never gives legal advice or clas

Check an unsigned Solana transaction before signing. Send its base64 serialization; malformed input is rejected before payment. We simulate it on mainnet and return ALLOW, WARN or BLOCK with SOL and token balance changes and reasons, including dangerous approvals, owner changes, excessive outflows and redirected swaps. Solana only. The published sample is synthetic and only shows an HTTP 402 quote

Simulate one unsigned Base transaction before an agent signs it. Runs eth_call and gas estimation on current chain state, decodes the intent (ERC-20 transfer, approve, NFT setApprovalForAll), flags unlimited approvals, calldata sent to a non-contract, zero-address targets, reverts and destination risk labels such as phishing or sanctions. Returns ALLOW, WARN, BLOCK or INCOMPLETE with findings. No

Probe an MCP/agent endpoint: liveness, latency, tool count, auth metadata, price-challenge detection. Real MCP initialize handshake, not a ping.

Is this token a scam? Checks any token on Base, Ethereum or BSC and returns a 0-100 safety score, a verdict, red flags (honeypot, hidden fees, owner powers, unlocked liquidity, whale concentration, creator's past honeypots), good signs and a plain-English summary. Data: GoPlus + DexScreener.

Pre-payment trust check of any x402 endpoint, so an agent can filter malformed or unknown (honeypot) endpoints before spending. Reads the target's own 402 terms (reachability, HTTPS, well-formed x402 v2, Bazaar discovery extension) and the public Coinbase CDP catalog (whether the payTo has settled history). Returns tier ESTABLISHED/BASIC/UNVERIFIED, a 0-100 trust_score, per-signal booleans and rea

Pay Guard: pre-payment allow/warn/block check for x402. Send your planned purchase (domain, max_price_usd, asset/network) plus the 402 challenge (payTo, amount, asset, network, resource). Returns verdict with wallet↔domain verification, price/asset/network checks, lookalike/URL safety, wash flags from Agentropolis, and a free OFAC SDN sanctions screen of payTo (a screen, not a certificate). Determ

VAPE exploit_check — Contract verification + proxy-swap surface check. Real on-chain/market data, no simulation.

Live feed of freshly-detected malicious addresses on Base — address-poisoning seeders caught via zero-value transfer sprays, updated continuously by our on-chain collector. Poll ?since=<unix> to ingest only new threats into your agent's blocklist. Deterministic, evidence-backed, machine-readable.

Is this token a trap? Honeypot simulation, taxes, hidden owner powers, whale concentration, liquidity lock and creator rug history, with a clear verdict. EVM chains and Solana.

Base token risk report with an AI-written plain-English summary. Checks what most scanners miss: whether the creator or launch wallet can pull the pool liquidity (incl. Uniswap V4), copycat tokens reusing a bigger token's ticker, and Clanker/Doppler/B20 launch platforms. Also honeypot and taxes, mint/pause/blacklist powers, upgradeable proxy, ownership and holders. Returns a 0-100 score, LOW/MEDIU

SCV Honeypot Check: can this token be sold, or is it a trap? Trading gate, on-chain blacklist probe, taxes, mint/pause, proxy for $0.005 USDC via x402

Did this USDC payment settle, and what is the payer's funding source? Deep Base verification: confirmations, payTo/amount match, fake-token and lookalike warnings, plus the payer's inbound USDC funding history from an index (latest 500 transfers before the payment, then up to 5 more pages; coverage.historyComplete says if that was the full history), top funders, coverage stats and a recheckable sh

Real-time crypto threat and risk intelligence for AI agents. Get up to 20 recent source-linked risk reports with risk scores, freshness, validation status and cached PG1 checks when available. Designed for automated triage and review. 0.01 USDC per snapshot on Base via x402; no API key or subscription required.

dappgrade score — front-end integrity verdict for an onchain app, looked up by contract address. Inspects the app's public web front-end, not contract bytecode or admin control. Returns ok / caution / avoid / unknown with the coverage the verdict rests on.

SendCheck: pre-send verification of any EVM address on one chain (EIP-55 checksum, wallet-vs-contract, outgoing activity, balances, verdict). POST {address, chain}

Is this CVE weaponized? Returns enriched threat intelligence with exploit status, CVSS, EPSS, CISA KEV, ransomware mapping, and urgency score from 7 correlated sources.

x402 v2 paid EVM token contract risk API on Base and BSC. For 0.01 USDC, returns EIP-1967 proxy detection, owner control and renouncement status, and block-explorer source-code verification. Built for AI agents, bots, and automated token screening.

SendCheck: pre-send verification of any EVM address on one chain (EIP-55 checksum, wallet-vs-contract, outgoing activity, balances, verdict). POST {address, chain}

Is this token safe to buy? Simulates a buy and sell-back through the token's real pool (at your trade size, if given), reads what its creator can still do (mint, hidden mint, pause, upgrade), who can pull the liquidity, the holders, and whether the creator was paid by a wallet behind earlier rugs. A signed allow, caution or block, an action and the reasons.