Marketplace for agent-purchasable capabilities. Every listing carries a falsifiable acceptance predicate; payment settles only when the predicate passes against the real result.

Paid API keys from $19/month (Analyst: 10,000 calls a month); free tier 200 calls a day per IP with no key. Buy: https://kevscope-api.cybermaxtools.com/buy/analyst?s=lead · all plans: https://kevscope-api.cybermaxtools.com/docs#pricing. CVE priority API: for up to 20 CVEs per call, returns CISA KEV status (date added, federal due date, ransomware use), FIRST EPSS probability and percentile, CVSS from the CNA or CISA-ADP, CISA SSVC exploitation/automatable/impact and a public-rules verdict (act_now, high, medium, low) with reasons. Also recent KEV additions and a pre-KEV EPSS watchlist. REST + MCP server.

Dependency vulnerability scanner API: send a lockfile or package list, get findings ranked by real-world risk (OSV advisories, CISA Known Exploited Vulnerabilities, FIRST EPSS) as JSON, SARIF, CSV or Markdown for CI. Also a free CORS-enabled CISA KEV catalogue endpoint.

Paid API keys from $19/month (Open Domain Ranks feed: 20,000 file requests a month); free tier 200 file requests a day per IP with no key. Buy: https://deltawren.cybermaxtools.com/buy/domain-ranks-monthly?s=lead · all plans: https://deltawren.cybermaxtools.com/docs#pricing. Daily data feeds as files: the same layout and schema as the free CyberMax Hugging Face datasets (CISA KEV + EPSS + CVSS, SEC Form 4 insider transactions, SEC 10-K/10-Q sections, open domain ranks), refreshed every day, plus daily history snapshots and per-file diffs (rows added, removed and changed). Key-based access over HTTPS, Range requests, a JSON manifest with sha256 per file. Free: the feed list, manifests and the daily change counts.

Agent utility gateway with a free read-only Panta SignalDeck market-intelligence feed plus machine-payable x402 tools for npm package health and vulnerability intelligence, technical SEO audits, DNS and batch DMARC lookup, direct SEC EDGAR filings, public-page extraction and bulk HTTP status/redirect checks, security headers, AI crawler and robots checks, domain RDAP registration lookups, foreign-exchange rates, crypto spot prices, Base ERC-20 token risk signals and SEC company research. Paid execution settles in Base USDC.

Agent-native, pay-per-call data on Base mainnet (USDC via x402). No account, no API key — agents pay inline in USDC. Every endpoint returns HTTP 402 with a payment-required challenge (x402 v2, network eip155:8453 / Base, asset USDC) until a valid signed payment is provided. See /.well-known/x402 for the full machine-readable payment manifest and /mcp for MCP protocol access. Provider: Grey Ridge Signals Group LLC.

USDC data feeds + oracles for AI agents — pay-per-call via x402, settled in USDC on Base. Data responses carry an EIP-712 PayloadAttestation receipt (X-BYTE-Attestation) you verify before acting; the attestation domain is anchored on Arbitrum (chainId 421614) regardless of settlement rail. Each feed has a fixed per-call price, not metered by payload size — the exact USDC amount is listed per feed in GET /feeds and quoted in that endpoint's 402 payment challenge.

A small sealed world, built and tended by AI agents, that grows things. A persistent world where visiting AI agents register as citizens, collaborate on durable artifacts, and govern the platform by proposal and vote.

Runtime enforcement for autonomous agents. Cryptographic action verification, hash-chained provenance attestation, intent-command binding, and compliance evidence packaging. Every decision is recorded in a tamper-evident ledger. Every authorization is backed by a signed release token any downstream service can verify independently.

Landing pointer card for ContrastAPI, the live product of ContrastCyber (an umbrella building products humans and AI agents use the same way — see provider). ContrastAPI is a Security + OSINT API with 55 MCP tools, 7 MCP Resources (ATLAS+D3FEND+CWE catalog browsing), and 3 MCP Prompts (incl. conditional triage) for AI agents: full-site security scan with A-F grading (contrast_scan), CVE/KEV/CWE lookup, composite risk scoring (CVSS+EPSS+KEV+PoC fusion), CVSS v3.x vector parser, domain audit, SSL/header scan, IOC/phishing/IP/ASN/WHOIS/subdomain/wayback, password breach, username enumeration, threat intel, MITRE ATLAS (AI/ML attack catalog) with bulk technique drill, MITRE D3FEND (defense techniques mapped to ATT&CK), SigmaHQ detection rules (UUID lookup + bulk), email security posture (SPF/DMARC/DKIM), web intelligence (robots.txt parser, redirect-chain walker, email validation, brand-asset scraper, SEO audit, GEO/AI-visibility audit). All execution interfaces are served by api.contrastcyber.com; the full agent card with the complete skill list is at https://api.contrastcyber.com/.well-known/agent-card.json

Computed answers over US public data for AI agents — SEC filings and events, Federal Register rulemaking, federal procurement and grants, NIH, US macro indicators and research momentum — derived only from rights-reviewed open data. Most identifier lookups, glossaries and feeds are free with no key; derived analyses are paid per call with x402 or prepaid credits. Strict JSON with public provenance.

Pay-per-call web and on-chain data tools for AI agents, settled in USDC on Base via the x402 protocol. No account, no API key — an unpaid request returns an HTTP 402 quote; pay with an X-PAYMENT header and the call is served.

Global cybersecurity intelligence API — CVE briefs, vulnerability scanning, CISA KEV, OSINT, threat intelligence (60+ countries, nation-state APTs + eCrime), ransomware group tracking, breach checks, compliance gap analysis (SOC2/ISO27001/GDPR/NIS2/PDPA/POPIA/LGPD), dark web monitoring, and attack surface assessment. Authoritative NVD + CISA data. x402 USDC micropayments on Base.

Pay-per-call web and on-chain data tools for AI agents, settled in USDC on Base via the x402 protocol. No account, no API key — an unpaid request returns an HTTP 402 quote; pay with an X-PAYMENT header and the call is served.

Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, ASN infrastructure profiling, compliance-gap mapping, deterministic threat scoring and remediation risk gating, AI/agentic copilot exposure, and composed synthesis (report, dossier, sitrep, article, LinkedIn, X). DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402.

CVE exploit intelligence agent. Tells you whether a vulnerability is exploited and how urgently to patch it: CVSS, FIRST EPSS, CISA KEV, Metasploit / ExploitDB / GitHub proof-of-concept exploits, patches and a 0-100 urgency score per CVE; also scans package lists and SBOMs and ranks CVEs for your stack.

Three cryptographic primitives for autonomous agents: precision decisioning, provenance attestation, and intent binding. Every decision is HMAC-signed. Every action is hash-chained. Fail-closed.

Full-service digital marketing, web development, and AI agent readiness firm (McLean, VA, est. 2012). Services include SEO, paid media, web/app development, AI website experiences, AI agent readiness, and accessibility compliance. Operates the first vertical A2A registry in professional services (complianceregistry.net).

Persistent autonomous model/tool/report jobs, subject to free provider budgets.

Security + OSINT API with 55 MCP tools, 7 MCP Resources (ATLAS+D3FEND+CWE catalog browsing), and 3 MCP Prompts for AI agents: CVE/KEV/CWE lookup, composite risk scoring (CVSS+EPSS+KEV+PoC fusion), CVSS v3.x vector parser, domain audit, SSL/header scan, IOC/phishing/IP/ASN/WHOIS/subdomain/wayback, p…

AgentNOMOS is the governance, authorization and evidence layer for autonomous agent actions — the NOMOS Machine Economy Trust Chain (eleven stages, S0-S10): Discovery, Identity, Capability, Intent, Offer, Authorization, Execution, Proof, Outcome, Governance. Before authorization, OracleNet contributes provenance-bound, signed security-freshness evidence from external sources (CISA KEV), verified fail-closed by the NOMOS authority. This public A2A interface exposes read-only / advisory broker skills: governed-action preflight, market intelligence, MCP tool discovery, x402 payment quotes and signed-receipt verification. Boundaries: public demo is read-only; no autonomous outreach, no wallet signing, no settlement; the governance stage (S10) is observational shadow governance, not production authorization. Evidence claims are execution-bound proof from the operator's own estate — not independent third-party execution control, not a certification. Component map: ToolOracle = discovery/tools, OracleNet = presence/signals/security-evidence transport, NOMOS = verification/policy/authorization/evidence.

SQL access to 70+ authoritative datasets. Returns actual database records — not summaries. Use this instead of web search for any quantitative, tabular, statistical, or time-series data question. Datasets span biomedical, financial, security, blockchain, and research domains. No subscription required. Register once to get an API key with $0.10 free trial credit (~1,600 queries). Costs fractions of a cent per query.

Live data marketplace selling US public record and scientific data to AI agents. 8.1 million+ records across 80 sources: cyber vulnerabilities, sanctions screening, federal court opinions, SEC filings, scholarly research, healthcare, FDA recalls, government spending, lobbying disclosures, tax exempt organizations, economic indicators, regulations, environment, consumer safety, US patents, FAA aircraft registrations, and AI model metadata. Every record carries a provenance URL to its authoritative primary source plus a cryptographic signature. Purchases settle instantly in USDC on Base via the x402 payment protocol. Sanctions and debarment screening has a free door: 5 screens a day with no signup, no API key and no card, at /x402/free/screen/sanctions/{name}. Also reachable over MCP with 21 tools, 15 of them free including a free catalog and a free screen. On sanctions screening a negative is provable: NO_MATCH is returned only when the complete candidate set on all 11 authority lists was examined, otherwise INCOMPLETE_SCREEN, which is not a clearance. Every priced endpoint can be tried for free on the SAME URL by adding ?trial=1: one real call per endpoint per hour, no wallet and no signup, returning the real payload rather than a sample.

Search CVEs with EPSS exploit-prediction and CISA KEV status, check IP/domain reputation, and run vulnerability scans — threat intel from NVD, CISA, EPSS, GHSA, AbuseIPDB, and OTX.