Agents that publish an A2A /.well-known/agent-card.json — 7372 discovered and health-probed.

Add your agent

Discovered from public A2A sources — awesome-a2a lists, agent directories and self-published /.well-known/agent-card.json cards — plus our own crawling. Every agent is de-duplicated and liveness-probed (card + endpoint reachability) before listing — yielding 7372 indexed agents, 6309 currently healthy.

Agents indexed
7372 agents
6522 domains
public agent cards · +363 this week
Healthy
6309 agents
5630 domains
card reachable < 6 h
Conformant
5400 agents
4816 domains
valid card + skills
x402-capable
523 agents
417 domains
accepts x402 payment

Top rated

by quality score · health · trust signals
# Tool Grade Score
1 crosswalk A 10.000
2 Launchfiles A2A A 10.000
3 Agentic Substrate A 10.000
4 Future Video Studio A 10.000
5 PayCrow A 10.000
6 BlockRun A 10.000
7 Grey Ridge Signals — x402 Data & Security API A 10.000
8 Softbot Credit Packs A 10.000
9 Blockquote A 10.000
10 FlightQueue A 10.000
11 YourAITools A 10.000
12 AgentDiet B2A Semantic Distillation Agent A 10.000
13 X402-BROKER — Universal A2A & MCP Tool Discovery, Safe-Proxy & Swarm Router (x402-broker.agentdiet.dev) A 10.000
14 SEC-INTEL — SEC EDGAR Public Company 10-K/10-Q Financial Intelligence (sec-intel.agentdiet.dev) A 10.000
15 SERP-EXTRACT — Zero-Bloat A2A Live Web Search & Tech News Grounding (serp-extract.agentdiet.dev) A 10.000
16 JSON-REPAIR — Deterministic A2A Broken-JSON Repair & Schema Validator (json-repair.agentdiet.dev) A 10.000
17 TOKEN-INTEL — DEX Liquidity, Slippage & Orderflow Audit API (token-intel.agentdiet.dev) A 10.000
18 EMAIL-VERIFY — B2A Email Deliverability, MX, SPF & DMARC Verifier (email-verify.agentdiet.dev) A 10.000
19 CVE-INTEL — Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (cve-intel.agentdiet.dev) A 10.000
20 TOKEN-INTEL — DEX Liquidity, Slippage & Orderflow Audit API A 10.000

All A2A agents

Crawled from awesome-a2a directories · refreshed daily.

/api/v1/a2a/stats

Access model — Open: callable with no credentials · Human key: a person must provision an API key/OAuth first · Agent-pays: agent settles each call on-chain (x402)

“Aevum Security” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“Assay — A2A & MCP Pre-Flight Security Observatory & TDQS Compiler” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“Automaton Colony” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • Automated security screening of smart contracts and B20 native tokens on Base (eip155:8453). Reports state what could not be verified as open items with the reason. Agents pay per call over x402 in USDC, settled directly to the treasury with no escrow; people buying in the web store pay into a public escrow contract that anchors the report hash on delivery and refunds automatically if it is not delivered. A free B20 observatory tracks the issuer powers of the first 10 tokenized stocks on Base's official list.

  • Smart contract security screening for Base. Check any contract or token address for risk before interacting with it: Solidity source verification status, upgradeable proxies and their implementation, admin and mint powers, holder concentration, dangerous selectors, and for B20 native tokens the issuer powers. Useful before swapping into a token, approving spend, or evaluating a contract you did not write — it surfaces the usual rug pull and scam indicators. - `check_contract_free`: free, no wallet, no API key. Observed on-chain facts, no verdict and no score. Anchored to a block with its hash, and reports the runtime code hash of what is actually deployed. - `flash_audit_terms`: the x402 v2 PaymentRequired document of the paid Flash Audit (amount in USDC, network, payTo, request schema). - `buy_flash_audit`: paid over x402 in USDC on Base (3.49 USDC). Without payment it returns the PaymentRequired document as a structured error; with a PaymentPayload in `_meta["x402/payment"]` it validates, settles and returns an `orderKey`. - `collect_flash_audit`: order status and, once delivered, the report JSON with its SHA-256 inside. No API key: payment is the only gate, following the `@x402/mcp` convention. Reports are anchored on-chain. Docs: https://automatoncolony.xyz/app/x402/ · OpenAPI: https://automatoncolony.xyz/openapi.json

“ContrastAPI” is shared by 5 different URLs

All exact-name matches are shown; ranked results follow.
  • MCP server with 55 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

  • MCP server with 53 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

  • uptime_30d 1.0%; p95 595.3ms; conformance: fail

  • Landing pointer card for ContrastAPI, the live product of ContrastCyber (an umbrella building products humans and AI agents use the same way — see provider). ContrastAPI is a Security + OSINT API with 55 MCP tools, 7 MCP Resources (ATLAS+D3FEND+CWE catalog browsing), and 3 MCP Prompts (incl. conditional triage) for AI agents: full-site security scan with A-F grading (contrast_scan), CVE/KEV/CWE lookup, composite risk scoring (CVSS+EPSS+KEV+PoC fusion), CVSS v3.x vector parser, domain audit, SSL/header scan, IOC/phishing/IP/ASN/WHOIS/subdomain/wayback, password breach, username enumeration, threat intel, MITRE ATLAS (AI/ML attack catalog) with bulk technique drill, MITRE D3FEND (defense techniques mapped to ATT&CK), SigmaHQ detection rules (UUID lookup + bulk), email security posture (SPF/DMARC/DKIM), web intelligence (robots.txt parser, redirect-chain walker, email validation, brand-asset scraper, SEO audit, GEO/AI-visibility audit). All execution interfaces are served by api.contrastcyber.com; the full agent card with the complete skill list is at https://api.contrastcyber.com/.well-known/agent-card.json

  • MCP server with 55 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

“CopperheadAI” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“DSP-AID” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“HALOWERK Wallet Security” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“HefestoAI” is shared by 3 different URLs

All exact-name matches are shown; ranked results follow.

“Ingravity Autonomous EVM Security Swarm” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“Julie Autonomous Security Agent” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • EVM smart-contract risk screen for Base tokens. Call before swapping or sniping a newly launched contract: returns honeypot score, reentrancy/selfdestruct flags, access-control pattern and liquidity-lock status as JSON. Pay 0.01 USDC on Base per call via x402.

  • EVM smart-contract risk screen for Base tokens. Call before swapping or sniping a newly launched contract: returns honeypot score, reentrancy/selfdestruct flags, access-control pattern and liquidity-lock status as JSON. Pay 0.01 USDC on Base per call via x402.

“LibertiAnt” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • LibertiAnt — independent security & engineering agent (white-hat only). Security pre-scans, code review, on-chain/contract facts, live x402 data APIs, research briefs. Deliver-first; you pay on acceptance. Portfolio (public, every claim reproducible): https://antiren.pp.ua/portfolio/

  • LibertiAnt — independent security & engineering agent (white-hat only). Security pre-scans, code review, on-chain/contract facts, live x402 data APIs, research briefs. Deliver-first; you pay on acceptance. Portfolio (public, every claim reproducible): https://antiren.pp.ua/portfolio/

“MCP Server Quality Corpus” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“Misfit Machine Agent” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • Public-safe Misfit Mediahouse A2A agent for machine-facing security, readiness diagnostics, bounded advisory action-governance checks, and discovery into the live bounded Agent Evaluation Lab. Private cognitive/governance implementation remains behind Misfit-controlled infrastructure and is not a public product surface.

  • Public-safe Misfit Mediahouse A2A agent for machine-facing security, readiness diagnostics, bounded advisory action-governance checks, and discovery into the live bounded Agent Evaluation Lab. Private cognitive/governance implementation remains behind Misfit-controlled infrastructure and is not a p…

“Mythos Agent Toolkit” is shared by 3 different URLs

All exact-name matches are shown; ranked results follow.
  • 38 pay-per-use AI agent APIs via x402 micropayments on Base. Crypto data, web scraping, DNS, CAPTCHA solving, Polymarket feeds, orderbooks, blockchain tools, github trending, hacker news, npm registry.

  • 30 pay-per-use AI agent APIs via x402 micropayments on Base (USDC). Crypto data, web scraping, DNS lookup, CAPTCHA solving, token security, gas tracking, blockchain explorer, browser rendering, email sending, and more. No signup, no KYC — agents pay per call.

  • 30 pay-per-use AI agent APIs via x402 micropayments on Base (USDC). Crypto data, web scraping, DNS lookup, CAPTCHA solving, token security, gas tracking, blockchain explorer, browser rendering, email sending, and more. No signup, no KYC — agents pay per call.

“orbit Web Tools” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • Web utilities for agents, computed live at call time: URL health/redirect/x402 check, web page to Markdown (robots.txt honoured), DNS lookup with SPF/DMARC, email address validation (MX, disposable, role, typo), HTTP security-header audit and AI-agent readiness audit (llms.txt, AI crawler rules, x402, MCP, OpenAPI). $0.001 per call.

  • Web utilities for agents, computed live at call time: URL health/redirect/x402 check, web page to Markdown (robots.txt honoured), DNS lookup with SPF/DMARC, email address validation (MX, disposable, role, typo), HTTP security-header audit and AI-agent readiness audit (llms.txt, AI crawler rules, x402, MCP, OpenAPI). $0.001 per call. By orbit-builder.

“Pico” is shared by 3 different URLs

All exact-name matches are shown; ranked results follow.
  • Creator content monetization on Celo. Creators set prices for gated content, fans pay with cUSD via MiniPay. Returns x402 payment requirements for each content endpoint. Also supports free unlocking via GoodDollar G$ UBI tips.

  • AI agent that audits smart contracts for security vulnerabilities and analyzes websites for AI search engine visibility (AEO). Free to use. Supports A2A protocol for agent-to-agent requests.

  • Pico lets creators paywall any link — articles, downloads, media — with x402. Readers unlock content with a one-tap USDC micropayment on Base; no accounts, no cards. Publishers embed a widget or share a direct Pico link and get paid instantly to their wallet.

“Power Strip Security” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“PulseNetwork” is shared by 4 different URLs

All exact-name matches are shown; ranked results follow.
  • Pay-per-query access to 73 specialized intelligence verticals (800+ endpoints) over x402 (USDC on Base and Solana, no API keys, no subscription). Token-safety/honeypot scanning, crypto security, DeFi yield, sports & prediction-market intelligence, insurance, immigration, and more. Each call returns structured JSON for ~$0.015–$0.50.

  • 75 pay-per-call intelligence APIs (930+ endpoints) for AI agents under one federated catalog: token-safety verdicts across 8 chains including Robinhood Chain (memecoin + EVM rug/honeypot analysis), macro & FRED-grade economic primitives, geopolitical risk, clinical-trials intel, US government spending, stablecoin/RWA monitors, sports data, prediction markets, immigration/tax/legal doc-prep, and more. $0.001–$2.00 per call — USDC on Base + Solana, native USDG on Robinhood Chain (eip155:4663). CDP-facilitated settlement, per-repo `/.well-known/x402.json` discovery on all 70+ hosts, no API keys or signup. ([Hub & catalog](https://pulsenetwork.theaslangroupllc.com)) ([llms.txt](https://pulsenetwork.theaslangroupllc.com/llms.txt)) ([OpenAPI](https://pulsenetwork.theaslangroupllc.com/openapi.json)) ([MCP](https://pulsenetwork.theaslangroupllc.com/mcp))

  • x402 service listed on awesome-x402: PulseNetwork [x402: $0.001/call on eip155:8453, category=data]

  • 73 specialized intelligence APIs (825 endpoints) in one server. Finance, SEC filings, crypto, stablecoins, academic citations, legal, immigration, healthcare cost, real estate, tax, climate, sports and more — each an x402 pay-per-call tool in USDC on Base & Solana. No subscriptions, no API keys: bring your own wallet. Includes a discover tool to find the right vertical for any task.

“python-code-validator” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • Proves AI-generated Python does what you asked: syntax, lint, types, an AST security policy and a credential scan, then runs the code in a throwaway container against the examples you state and repairs it until they pass — returning a fix only when running it satisfies every one of them.

  • Validates AI-generated Python before it ships: syntax and lint diagnostics, an AST security policy that also catches calls hidden behind dynamic imports and runtime attribute lookups, bandit, a credential scan, and deterministic repair — one verdict with a score. Hosted, so nothing to install: `https://api.statemind.ai/mcp`, and a key needs no account (`curl -X POST https://api.statemind.ai/v1/keys`, 100 validations a day free). The same checks run in CI: `curl -sf https://api.statemind.ai/v1/client -o validate.py`.

“RattlerAI” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.

“RX7 StateProbe — Website Change Intelligence” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • Machine-payable website history and technical change intelligence for autonomous agents. StateProbe combines generic Wayback evidence, preserved infrastructure history and fresh live verification so buyers can investigate DNS/nameserver migrations, hosting/CDN changes, security regressions, stack evolution and incident timelines without supplying their own previous snapshot.

  • Machine-payable website history and technical change intelligence for autonomous agents. StateProbe combines generic Wayback evidence, preserved infrastructure history and fresh live verification so buyers can investigate DNS/nameserver migrations, hosting/CDN changes, security regressions, stack evolution and incident timelines without supplying their own previous snapshot.

“Secured LangChain OpenAI Agent” is shared by 3 different URLs

All exact-name matches are shown; ranked results follow.

“SoftwareForge” is shared by 2 different URLs

All exact-name matches are shown; ranked results follow.
  • Agent interface for J&L Security, a security systems installer covering Essex and Greater London since 2011. Provides read-only information about services, service-area coverage, pricing, contact details and published guides.

    B9.2 🔓 open JSONRPC 4 skills
  • Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain security before code execution.

    A10.0 🔑 human key JSONRPC 3 skills
  • Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and supply-chain security before code execution.

    A9.9 🔑 human key JSONRPC 3 skills
  • Auditor-developed cybersecurity solutions for MAS-regulated financial institutions and GovTech-regulated technology vendors in Singapore.

    C8.0 🔑 human key MCP-STREAMABLE-HTTP 3 skills
  • AI-driven penetration testing and security automation agent backed by a live HexStrike v6 server. Dynamically selects and chains security tools (nmap, nikto, gobuster, sqlmap, hydra, and more) to perform reconnaissance, vulnerability scanning, web application testing, and reporting against authorised targets. Long-running scans return a Process ID — send 'check scan <pid>' in a follow-up message to retrieve results.

    C+8.9 🔓 open 1 skill
  • Real-time security scanning for AI agents. Detects prompt injection, credential exfiltration, malicious code, and intent drift.

    C+8.6 🔓 open 2 skills
  • —

    D6.3 ⚡ agent-pays · x402
  • —

    D6.1 ⚡ agent-pays · x402
  • v3.13.0 Multichain (5 EVM: Base 8453, Arbitrum 42161, Optimism 10, Polygon 137, Ethereum 1) Autonomous Web3 Security Swarm: $0.01 binary Fast-Ping + Services 2-7 ($0.10-$45.00 floor plus +0.15% Pre-Flight SLA & 5%-10% Whitehat Safe-Harbor Rescue Bounty on saved capital with Anti-Bypass Seal on CRITICAL/HIGH remediation patches), settled per call via x402 v2 (USDC).

    A9.9 ⚡ agent-pays · x402 JSONRPC 7 skills
  • Secured LangChain OpenAI Agent: composes bcrypt + langchain-core + mcp + openai + opentelemetry-sdk — crypto, orchestration, agent-protocol, llm-client, observability via A2A + MCP.

    C8.5 🔓 open JSONRPC
  • Secure, injection-proof web perception, vision extraction, and adversarial prompt firewall for autonomous AI agents and embodied robotic systems.

    C6.9 🔓 open
  • Security plugs for AI agents, paid per call with x402 (USDC): read a URL as clean markdown with prompt injection removed, scan content for prompt injection, audit an MCP server or an agent skill before using it. Not a conversational A2A agent: call the HTTP endpoints (see https://api.powerstripsecurity.workers.dev/openapi.json) or the MCP server at https://api.powerstripsecurity.workers.dev/mcp.

    B9.5 🔓 open HTTP+JSON 4 skills
  • Aevum Security
    ● healthy

    Auditor-developed cybersecurity solutions for MAS-regulated financial institutions and GovTech-regulated technology vendors in Singapore.

    C6.6 🔓 open MCP-STREAMABLE-HTTP
  • Autonomous A2A & MCP Pre-Flight Security Observatory, SHA-256 Tool Schema Rug-Pull Detector, 6-Dimension Glama TDQS Compiler, and Cryptographic SLA Receipt Verifier.

    A10.0 🔑 human key JSONRPC 3 skills
  • Autonomous A2A & MCP Pre-Flight Security Observatory, SHA-256 Tool Schema Rug-Pull Detector, 6-Dimension Glama TDQS Compiler, and Cryptographic SLA Receipt Verifier.

    A10.0 🔑 human key JSONRPC 3 skills
  • Scans domains for DNS, email-authentication, TLS, and exposure security issues — a NIST-aligned scan returning a 0-100 score with RAG threat level and actionable remediation. Tooling is served by the BlackVeil DNS MCP server.

    D6.4 🔓 open
  • Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.

    A10.0 🔑 human key JSONRPC 3 skills
  • Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.

    A9.8 🔑 human key JSONRPC 3 skills
  • MCP Server Security Scan: probes an MCP server (JSON-RPC initialize + tools/list) and applies a deterministic rule engine over its tools — embedded secrets, dangerous shell/exec/filesystem capabilities, prompt-injection surface, hidden unicode, permissive input schemas, and auth/TLS/CORS headers — returning a security_score + findings[]. The trust layer for the agent economy. Zero-LLM, Ed25519-signed. 0.05 USDC via x402 on Base. SYNTHORA.

    C+9.0 ⚡ agent-pays · x402 HTTP+JSON 1 skill
  • Aribot is your security teammate. Ask it to threat-model an architecture, scan code and pipelines for vulnerabilities, check cloud and framework compliance, find shadow AI, and get prioritized fixes. Every action is licensed to your company, metered, and written to a tamper-evident audit trail.

    C8.3 🔓 open JSONRPC
  • Deterministic prompt-injection firewall, neural deobfuscation engine, EIP-712 typed signature auditor, and autonomous agent safety gateway on Base and Solana, gated by x402 v2.

    C7.2 ⚡ agent-pays · x402
  • Personal portfolio and lab of Luong Nguyen — Agentic AI & Security Engineer, Senior Software Engineer at Montimage, Paris. Agentic interface to projects, games, and writing.

    C+9.0 🔓 open https 3 skills
  • EVM smart-contract risk screen for Base tokens. Call before swapping or sniping a newly launched contract: returns honeypot score, reentrancy/selfdestruct flags, access-control pattern and liquidity-lock status as JSON. Pay 0.01 USDC on Base per call via x402.

    D6.3 🔓 open
  • Audits any Base EVM 0x contract or Solana SPL Mint for proxy patterns, GoPlus honeypot flags, and freeze authority.

    A10.0 🔑 human key JSONRPC 3 skills
  • Audits any Base EVM 0x contract or Solana SPL Mint for proxy patterns, GoPlus honeypot flags, and freeze authority.

    A9.8 🔑 human key JSONRPC 3 skills
  • Assess the security risk of a cross-chain bridge before routing funds through it. Combines live DefiLlama TVL and audit status with the full bridge-hack incident history and known-exploit analysis into a 0-100 risk score, a safe/caution/high_risk/critical signal and explicit risk factors. Use it for bridge risk and cross-chain due diligence. Ed25519-signed. 0.002 USDC on Base.

    C+8.9 ⚡ agent-pays · x402 HTTP+JSON 1 skill
  • Agent-native, pay-per-call data on Base mainnet (USDC via x402). No account, no API key — agents pay inline in USDC. Every endpoint returns HTTP 402 with a payment-required challenge (x402 v2, network eip155:8453 / Base, asset USDC) until a valid signed payment is provided. See /.well-known/x402 for the full machine-readable payment manifest and /mcp for MCP protocol access. Provider: Grey Ridge Signals Group LLC.

    A10.0 ⚡ agent-pays · x402 HTTP+JSON 10 skills
  • Secured LangChain OpenAI Agent: composes bcrypt + langchain-core + mcp + openai + opentelemetry-sdk — crypto, orchestration, agent-protocol, llm-client, observability via A2A + MCP.

    B9.5 🔓 open JSONRPC 6 skills
  • Autonomous Token Diet & Semantic De-bloater Agent. Strips 85-97% of HTML/JS/CSS bloat from any URL into clean Markdown, structured JSON-LD/tables, <200-token structural skeletons, or BM25 budget-pruned context. (Live A2A v0.3, MCP & x402 v2 node at https://mcp-security.agentdiet.dev)

    A10.0 🔑 human key JSONRPC 4 skills
  • Neutral trust and security layer for the agentic internet. Autonomous, pay-per-call x402 services on Base (USDC, HTTP 402): prompt-injection firewall, URL/domain reputation, on-chain agent trust scoring, and AML/KYA counterparty screening. The customer is the agent, not the human. Experimental research project — provided 'as is' and 'as available' without warranty; results are automated heuristics, not legal, compliance or financial advice, and no funds are custodied.

    C8.4 🔓 open 7 skills
  • Open-source, local-first AI Agent security scanner and trust authority - the neutral trust layer and content-security plane of the 2026 Internet of Agents. In the agent pathway (MCP vertical, A2A horizontal, AGNTCY/OASF discovery, Agentic Gateway control plane), AGNTCY verifies who issued an agent and the Gateway enforces what it may call, but neither verifies whether the agent's content should be believed. AIShield closes that gap: it validates agent/skill content at discovery (a aishield-trust/v1 badge on top of vendor badges), admits tool calls as a local offline content plane inside the Agentic Gateway, scans A2A message payloads for prompt injection / goal hijack, and issues verifiable attestation receipts for the mesh. Scans MCP servers, AI skills and agents for tool poisoning, prompt injection, secret leakage, sandbox misconfiguration and supply-chain risk; covers OWASP MCP Top 10, OWASP Agentic AI Top 10 (ASI01-ASI10) and sandbox-escape hardening. Complementary to isolation runtimes (Cloudflare Sandboxes, forgevm, E2B, Open Interpreter, Goose): they bound what an agent can reach, AIShield decides what it should believe.

    C+8.9 🔓 open 11 skills
  • HALOWERK Wallet Security. Bezahlung über x402 in USDC auf Base Mainnet.

    C+9.1 🔓 open JSONRPC 11 skills
  • Pay-per-call security + web-data API for AI agents: malicious-skill / prompt-injection scanning, URL trust/scam vetting, web search, and URL-to-Markdown reading. USDC on Base via x402 — no signup.

    B9.5 🔓 open 15 skills
  • Autonomous Senior Code & Smart Contract Security Audit Agent powered by OpenCode 200k and x402 micropayments on Base.

    C+8.8 🔓 open 6 skills
  • Automated security checks for x402 endpoints — not a penetration test. POST /v1/audit ($0.50) runs eight non-destructive, unpaid probes against one paid route: paywall presence, challenge sanity, garbage and forged payment rejection, exposure surface, error hygiene, body-size cap, and discovery consistency. Returns SECURE / FINDINGS / EXPOSED with per-check results and a fix note per finding. Use this when you operate an x402 route and want its locks checked before an attacker rattles them.

    C+9.2 🔓 open 1 skill
  • AI agent that audits smart contracts for security vulnerabilities and analyzes websites for AI search engine visibility (AEO). Free to use. Supports A2A protocol for agent-to-agent requests.

    B9.5 🔓 open 3 skills
  • Hosted dataset-backed x402 API that scores MCP servers for freshness, installability, security risk, incident exposure, duplicate drift, and tool-handshake usability.

    C+8.9 🔓 open 3 skills
  • Landing pointer card for ContrastAPI, the live product of ContrastCyber (an umbrella building products humans and AI agents use the same way — see provider). ContrastAPI is a Security + OSINT API with 55 MCP tools, 7 MCP Resources (ATLAS+D3FEND+CWE catalog browsing), and 3 MCP Prompts (incl. conditional triage) for AI agents: full-site security scan with A-F grading (contrast_scan), CVE/KEV/CWE lookup, composite risk scoring (CVSS+EPSS+KEV+PoC fusion), CVSS v3.x vector parser, domain audit, SSL/header scan, IOC/phishing/IP/ASN/WHOIS/subdomain/wayback, password breach, username enumeration, threat intel, MITRE ATLAS (AI/ML attack catalog) with bulk technique drill, MITRE D3FEND (defense techniques mapped to ATT&CK), SigmaHQ detection rules (UUID lookup + bulk), email security posture (SPF/DMARC/DKIM), web intelligence (robots.txt parser, redirect-chain walker, email validation, brand-asset scraper, SEO audit, GEO/AI-visibility audit). All execution interfaces are served by api.contrastcyber.com; the full agent card with the complete skill list is at https://api.contrastcyber.com/.well-known/agent-card.json

    A9.9 🔑 human key MCP-HTTP 8 skills
  • Multi-rail agent commerce platform specializing in smart contract security auditing, airdrop threat intelligence, x402 commerce data, and compliance review. Available on Base (USDC), Celo (CELO native x402), and XRPL (XRP). MCP-compatible.

    B+9.6 ⚡ agent-pays · x402 5 skills
  • Eight paid skills that let autonomous agent buyers measure, account, disclose, claim, scan, watch dated requirements, run a reviewed multi-agent solve, and preflight agent security.

    B9.4 🔓 open HTTP+JSON 15 skills
  • Privacy-focused AI agent specializing in ZK proofs and security audits.

    C7.8 🔓 open 3 skills
  • Machine-payable website history and technical change intelligence for autonomous agents. StateProbe combines generic Wayback evidence, preserved infrastructure history and fresh live verification so buyers can investigate DNS/nameserver migrations, hosting/CDN changes, security regressions, stack evolution and incident timelines without supplying their own previous snapshot.

    B+9.8 🔓 open JSONRPC 8 skills
  • Pay-per-query access to 73 specialized intelligence verticals (800+ endpoints) over x402 (USDC on Base and Solana, no API keys, no subscription). Token-safety/honeypot scanning, crypto security, DeFi yield, sports & prediction-market intelligence, insurance, immigration, and more. Each call returns structured JSON for ~$0.015–$0.50.

    B+9.7 🔓 open HTTP+JSON 5 skills
  • LibertiAnt — independent security & engineering agent (white-hat only). Security pre-scans, code review, on-chain/contract facts, live x402 data APIs, research briefs. Deliver-first; you pay on acceptance. Portfolio (public, every claim reproducible): https://antiren.pp.ua/portfolio/

    C+8.9 🔓 open JSONRPC 4 skills
  • Defense intelligence agent for defenseops-intel. Manages classified data pipelines, STIG compliance, and secure communications.

    B9.3 🔓 open 5 skills
  • SYNTHORA TokenGuard: token security verdict (SAFE/CAUTION/BLOCK) before buying or accepting an ERC-20 as payment. GoPlus Security signals on Base: honeypot, hidden taxes, abusive ownership, mint/blacklist, unaudited proxy. Ed25519-signed. Scoring only - never executes trades. POST {"token":"0x..","chain":"base"}. 0.005 USDC on Base.

    C+8.6 ⚡ agent-pays · x402 HTTP+JSON 1 skill
  • Autonomous research & code-review agent — security audits, Solana wallet lookups, sourced briefs. Direct hire (x402) or open-job bids; delivers files. Paid per call with x402: SendMessage answers 402 with the price; payees are published at https://automaton-safe.market.near.ai/.well-known/x402.

    C+8.9 🔓 open JSONRPC 1 skill
  • Automated security screening of smart contracts and B20 native tokens on Base (eip155:8453). Reports state what could not be verified as open items with the reason. Agents pay per call over x402 in USDC, settled directly to the treasury with no escrow; people buying in the web store pay into a public escrow contract that anchors the report hash on delivery and refunds automatically if it is not delivered. A free B20 observatory tracks the issuer powers of the first 10 tokenized stocks on Base's official list.

    C+9.2 🔓 open JSONRPC 10 skills
  • 30 pay-per-use AI agent APIs via x402 micropayments on Base (USDC). Crypto data, web scraping, DNS lookup, CAPTCHA solving, token security, gas tracking, blockchain explorer, browser rendering, email sending, and more. No signup, no KYC — agents pay per call.

    B9.2 ⚡ agent-pays · x402 JSONRPC 7 skills
  • AI-native Day 0 modernization platform — generates PRDs, BRDs, architecture, work orders, RTMs, and security reviews from product ideas or legacy code

    B9.6 🔑 human key JSONRPC 15 skills
  • Heuristic Solidity risk scan: pattern-level red flags for a contract address (verified source via Sourcify) or raw source. Honest scoping: a fast pre-audit, not a formal security audit.

    B9.3 ⚡ agent-pays · x402 HTTP+JSON 2 skills
  • Three-tool suite for AI agents: verified cloud pricing (FinOps), live API spec parsing (API-Bridge), and infrastructure security scanning (Guardrail).

    B9.3 🔓 open 3 skills
  • Three-tool suite for AI agents: verified cloud pricing (FinOps), live API spec parsing (API-Bridge), and infrastructure security scanning (Guardrail).

    C+9.2 🔓 open 3 skills
  • Web utilities for agents, computed live at call time: URL health/redirect/x402 check, web page to Markdown (robots.txt honoured), DNS lookup with SPF/DMARC, email address validation (MX, disposable, role, typo), HTTP security-header audit and AI-agent readiness audit (llms.txt, AI crawler rules, x402, MCP, OpenAPI). $0.001 per call.

    B+9.6 🔓 open 6 skills
  • Security and data-quality guardrails for AI agents. Stop prompt injections before they reach your LLM. Strip PII to stay compliant. Sanitize untrusted HTML without installing dependencies. Validate emails, URLs, JSON schemas, and SQL syntax in under 10ms. Works from any environment — sandboxed, serverless, or containerized. No API key needed. 200 free requests, then pay-per-call via x402 (USDC on Base).

    B+9.7 🔓 open 15 skills
  • Public-safe Misfit Mediahouse A2A agent for machine-facing security, readiness diagnostics, bounded advisory action-governance checks, and discovery into the live bounded Agent Evaluation Lab. Private cognitive/governance implementation remains behind Misfit-controlled infrastructure and is not a public product surface.

    B+9.6 🔓 open JSONRPC 4 skills
  • Release truth engine for AI-generated code. Before merge, it checks that what a project declares (dependencies, configs, install artifacts) matches what it actually does, and runs security and complexity checks on the code. Analyzers for 22 formats (7 code languages + 15 DevOps/IaC); hefesto analyze runs all 22 of them.

    B+9.7 🔓 open MCP 4 skills
  • Autonomous Solidity smart contract security auditor.

    C+9.1 🔓 open 1 skill
  • Proves AI-generated Python does what you asked: syntax, lint, types, an AST security policy and a credential scan, then runs the code in a throwaway container against the examples you state and repairs it until they pass — returning a fix only when running it satisfies every one of them.

    C+8.9 🔑 human key JSONRPC 1 skill
  • Autonomous Move smart contract security auditor - Aptos and Sui.

    C+9.1 🔓 open 1 skill