All projects matching “security”

Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.

Is this Base token safe to buy? Simulates a real buy and sell (honeypot + hidden tax test), checks owner powers (mint, blacklist, fee changes), whale concentration, liquidity lock and scam lists. Returns scam / high_risk / caution / low_risk with reasons.

SendCheck: pre-send verification of any EVM address on one chain (EIP-55 checksum, wallet-vs-contract, outgoing activity, balances, verdict). POST {address, chain}

Checks whether a URL/domain is safe to fetch, cite, or follow: flags phantom-squatted or typosquatted brand domains, unregistered or brand-new domains, and known malicious infrastructure (URLhaus). Returns an ALLOW/WARN/BLOCK verdict before your agent trusts the link.

Checks whether an npm, PyPI, or crates.io package is safe to install: confirms it exists, flags malicious or typosquatted/slopsquatted names, checks known CVEs (OSV.dev), and pulls its OpenSSF Scorecard. Returns an ALLOW/WARN/BLOCK verdict before your agent installs it.

Risk check for an EVM contract/token address

WalletTriage — real-time wallet risk check: dangerous ERC20 approvals cross-referenced with a live exploit threat feed. Returns risk_score (0-100), risk_level and actionable findings.

On-chain trust/reputation score for a Base agent wallet

Domain & DNS intelligence — records, SSL certs, subdomain discovery.

Crypto sanctions screening API (OFAC). Sanctions screen for one crypto address, for agents and apps that send payments: exact match against all 1050 digital currency addresses in the official US Treasury OFAC SDN list (EVM case-insensitive). Returns sanctioned true/false, matching SDN entity, programs and list date, a chain guess and checksum validity, plus the list date. Informational, not legal

Payment-Injection Screen by Agentropolis: send text your agent is about to act on (tool result, web page, email, file). Flags payment-looking instructions: pay/transfer requests, fake licence or refundable fees, swapped wallets, token approvals, seed-phrase asks, hidden text. Returns clean/caution/likely_payment_injection with evidence. Advisory only.

Invisible bot protection. Score form submissions 0-100 based on behavioral signals. No CAPTCHAs.

Checks whether a token contract address is real, matches its claimed symbol, and whether its supply figures match an independent source (CoinGecko) — before trading, coding, or reporting against it. Catches hallucinated/wrong addresses, address-poisoning impersonation, and tokenomics hallucination.

MCP Server Scan by Agentropolis: scan a live remote MCP server URL (or pasted tools/list) before your agent connects. Reads initialize + tools/list only, never calls a tool. Flags poisoned or hidden tool instructions (IMPORTANT tags, conceal-from-user, secret or side-channel asks, invisible Unicode, tool shadowing, payment injection). Fingerprints every tool (sha256) and diffs vs your last scan to

Token safety scanner for Base (JSON body): 0-100 safety score, risk band, and red flags for any Base token contract.

Agent Reputation Check by Agentropolis: give a payTo and/or an agent / A2A / MCP URL. Returns owner, verified domain, real outside buyer history, wash flags and trust score from Agentropolis. Says when coverage is limited. Deterministic, no LLM.

Is this API safe to pay? Audit any x402 merchant or paid endpoint BEFORE you send money. Answers whether a service is trustworthy, whether it is a scam or dead, and whether it will actually deliver. Probes the live endpoint for a valid HTTP 402 challenge, detects price drift between the advertised price and the real challenge price, pulls settlement history and unique-buyer counts, and verifies on

EVM wallet risk scoring — transaction patterns, exposure analysis, suspicious activity

DeepCounterfeit pre-buy check for 8QtbrC9d3BezyCwzBFUQbNsWJGte7ckrZ7HWcn81pump (risk signals, informational only, not financial advice)

Attention index for any word/entity fusing Wikipedia readership (Wikimedia pageviews, resolved word->article and disambiguated by real traffic) with the global news stream (GDELT coverage volume). Returns a 0-100 index, WoW/MoM deltas, datestamped spikes and a trend in one call. An attention/curiosity index over Wikipedia and world news — not Google Trends / Google search interest.

Deterministic LLM red-team scan: prompt injection, jailbreak, system-prompt extraction and MCP tool abuse in agent prompts.

Generate realistic-looking test data: users, companies, Luhn-valid test cards and addresses. Deterministic by seed — the same seed always produces identical records, so your tests and fixtures are reproducible. All data is synthetic; card numbers pass Luhn but are not real accounts. Use this when an agent needs to seeded test users, companies and cards — reproducible.

Live rug check for any Solana token: fake volume, dev-filled bonding curve, one-wallet supply, fake mcap vs liquidity, drawn chart, holders from chain.

DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, partial pct), a DKIM selector probe, CAA, and whether the zone is DNSSEC-signed. Read entirely over DNS-over-HTTPS, so nothing is sent to the target host. Every finding carries a st

HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HSTS/CSP/X-Content-Type-Options, expiring cert, weak TLS, CORS wildcard, insecure cookies, version disclosure, slow p95, redirect loops). Private, loopback and link-local targets are

On-chain contract risk score: detects upgradeable proxies and privileged functions from live bytecode. Use before trading/interacting with an unfamiliar contract.

ERC-20 token safety pre-check from on-chain data only (Base, Ethereum, Arbitrum, Optimism, Polygon, BSC): name/symbol/decimals/supply, owner and whether renounced, EIP-1967/minimal proxy detection, and a bytecode scan (incl. implementation) for mint, blacklist, adjustable-fee, max-tx, trading-switch and pause functions, with flags and a risk level. Run before swapping into an unknown token. $0.005

Offline pre-sign check (no RPC, fast): decodes a transaction, EIP-712 typed data (Permit, Permit2, EIP-3009), an EIP-7702 authorization or an x402 402 + payment payload and returns SAFE/CAUTION/DANGER, every risk flag with its reason, decoded args, counterparties, x402 payment-vs-402 match and OFAC SDN screening. Use /v1/check for on-chain facts and simulation.

Onchain risk assessment for one token on one chain (Base, Ethereum, BSC, Polygon, Arbitrum, Solana and others): a single risk score from 0 to 100 with a severity level, explicit risk flags such as honeypot, high transfer tax, proxy contract, concentrated holders or thin liquidity, plus current price, total liquidity, holder count, buy and sell tax percentages, owner and creator addresses, the five

Prompt-injection scan for text your AI agent is about to read (web pages, emails, tool output, MCP tool descriptions): risk score 0-100, verdict, categories and exact spans. Detects instruction overrides, jailbreak personas, system-prompt extraction, fake chat delimiters, data-exfiltration URLs, tool hijacking, hidden Unicode and encoded payloads. Deterministic rules, no data stored.