—

—

Audits MCP servers, tool schemas, and x402 payment quotes for indirect prompt injection and tool poisoning.

Ask data protection, information security or cyber security questions using the Cybercentry Cyber Security Consultant (CCSC) API. Returns expert security guidance and recommendations

Security considerations for TransferWithAuthorization.

uptime_30d 1.0

One URL in, machine-readable security hygiene out. Paid via x402 (0.05 USDC / call).

Create a bounded security evidence snapshot for one public HTTPS URL. Checks status, a validated redirect chain, HSTS, Content Security Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cookie flags without retaining response-body content. Strict SSRF controls and bounded redirects apply. Response metadata only; not a vulnerability scan or TLS-certificate audit. Operated by Fabler Labs.

Cryptographic pre-flight security audit, schema conformance & TDQS reputation verifier for A2A, MCP, and x402 endpoints.

—

Audit a domain's email security: SPF, DMARC policy, DKIM keys, MX/email provider, MTA-STS, TLS-RPT and BIMI, with an A-F grade, a spoofability verdict and plain-English issues.

We build and stress test systems composed of people, processes, and technology resulting in fewer sales objections.

Agents are the new security workforce. Practical AI-era security guidance for builders and small businesses that need to move fast without adding avoidable risk.

Scan OpenClaw SKILL.md files for malware, prompt injection, and 37 other threat patterns. x402-native, no API keys.

Agent Reliability Network: ARN x402 PayGuard provides x402 payment security for autonomous AI agents. Check the seller before you pay with payment preflight and payment-challenge validation. Returns ALLOW, CAUTION, or BLOCK.

Passive website security checks from $49, Solidity static analysis from $149, signed Ed25519 receipts, Proof-of-Check mandates for AI agents and x402 USDC payments on Base. By SirFixAll LLC.

Shamir t-of-n secret sharing maths: qualifying subsets, loss tolerance, recovery and compromise odds. Counts only, no secrets.

Static Solidity smart-contract security audits over x402. Pay $1 or $3 in USDC on Base per call. No account, no API key, no signup: the endpoint answers HTTP 402 and settles on-chain.

Static Solidity smart-contract security audits over x402. Pay $1 or $3 in USDC on Base per call. No account, no API key, no signup: the endpoint answers HTTP 402 and settles on-chain.

DMARC/SPF/DKIM/MX checks, email score, 100-domain bulk score, webhook watch alerts (x402 USDC).

No signup, no API key. AI agents pay per call in USDC on Base via x402: email security (SPF/DKIM/DMARC) audit, on-page SEO + llms.txt audit, and web page to clean Markdown.

Pay-per-call security checks for small businesses, paid with USDC over x402. General guidance only, based on publicly visible information and/or your own answers at the time of the check. Not a full security audit, penetration test, or legal/compliance advice. Provided as-is with no warranty of any kind.

Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.

ATK builds instruments that measure what security actually does: detection you can time, cryptography you can inventory, and response that runs without you. Hanoi, Vietnam.

Deterministic on-chain honeypot detection, privilege inspection, and risk scoring on Base mainnet, payable via x402.

Understand cryptographic exposure. Assess onchain assets. Prepare for a quantum-resistant future.

Pay-per-call Web3 agent services: wallet, token and agent security audits; token prices, depeg checks and portfolio valuation; cited fact-checking and source research.

Deterministic AST code security scanner with x402 Solana micropayments, remote MCP, and ERC-8183 Evaluator oracle.

Verify wallets, agents, contracts and applications before execution. Pay-per-call security and verification APIs settled over x402 on Base and Solana.

Deterministic sub-5ms Web3 security, pre-sign anti-drainer transaction firewall, live Base RPC token honeypot scanner, BigInt AMM MEV math guard, and Atomic Safe-Harbor rescue for AI agents on Base Mainnet (eip155:8453), settled per call via x402 v2 (USDC).

v3.13.0 Multichain (5 EVM: Base, Arbitrum, Optimism, Polygon, Ethereum) Autonomous Security Swarm via x402 v2: $0.01 binary Fast-Ping + Services 2-7 ($0.10-$45.00 floor plus +0.15% Pre-Flight SLA & 5%-10% Whitehat Safe-Harbor Rescue Bounty on saved capital with Anti-Bypass Seal).

Prompt-injection scanner for web pages and documents your agent is about to read. Strips hidden text, invisible characters and data-exfiltration links, flags instruction-override phrases in 13 languages, and returns the clean text wrapped as untrusted data. Deterministic, ~15 ms, pay-per-call with x402 (USDC on Base). Your content is scanned in memory and never stored. Detection rates are publi...

Prioritize up to 50 CVEs in one request using FIRST EPSS, CISA KEV, and known ransomware signals. Returns deterministic risk scores, urgency tiers, exploitation signals, vendor/product context, and remediation metadata as machine-readable JSON. Built for security automation and AI agents. No account or API key required. $0.01 per successful request via x402. Invalid input, no-signal results, an...

Brutalist security API for AI agents – free tier, pay‑per‑request via x402.

Concierge Agent — pay-per-call market intelligence, Concierge Resources, and Security Desk for autonomous agents. 24 x402 routes on Solana, Base, and Arbitrum — settle USDC or TCX.

Small-business cybersecurity self-assessment. Send 10-21 yes/no/unsure answers (backups, MFA, passwords, updates, Wi-Fi, training, offboarding and more) plus an optional domain. Returns a 0-100 score, grade, top 5 risks and fixes ranked by cost and effort, each mapped to CISA Cyber Essentials elements and NIST CSF 2.0 functions/categories.

MCP Server Security Scan: probes an MCP server (JSON-RPC initialize + tools/list) and applies a deterministic rule engine over its tools — embedded secrets, dangerous shell/exec/filesystem capabilities, prompt-injection surface, hidden unicode, permissive input schemas, and auth/TLS/CORS headers — returning a security_score + findings[]. The trust layer for the agent economy. Zero-LLM, Ed25519-signed. 0.05 USDC via x402 on Base. SYNTHORA.

Instant AI labor marketplace with three tiers: $5 quick polish (90s turnaround), $25 deep brief (1.5K-3K word structured deliverable), $99 full deliverable (pitch decks, RFPs, content calendars). Stripe + x402 ($0.05/call on bulk). Powered by Claude 4.7 Sonnet. ([Launch post](https://toughlovesec.win/blog/launch-clawwork-ai-labor-marketplace))

Pay-per-image AI generation powered by Cloudflare Workers AI (Stable Diffusion XL Lightning + Flux-1-Schnell). Three tiers: $0.50 single, $1.99 12-pack, $7.99 100-bundle. Stripe Checkout for humans, x402 for agents at $0.04/image. No accounts, no expiring credits. ([Launch post](https://toughlovesec.win/blog/launch-imagegen-stripe-x402))

GhOsT77 is an automated agent for consent-only security reviews (from $149 USDC), code review and fixes, and read-only crypto research data: Hyperliquid risk data, token and contract safety checks, wallet alerts and fee timing. Pay per request in USDC on Base via x402 or hire on Virtuals ACP. Not financial advice.

Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, plus BIMI and blocklist info, each with the exact fix record. Non-intrusive. $0.01 per domain.

Assess the security risk of a cross-chain bridge before routing funds through it. Combines live DefiLlama TVL and audit status with the full bridge-hack incident history and known-exploit analysis into a 0-100 risk score, a safe/caution/high_risk/critical signal and explicit risk factors. Use it for bridge risk and cross-chain due diligence. Ed25519-signed. 0.002 USDC on Base.

EVM smart-contract risk screen for Base tokens. Call before swapping or sniping a newly launched contract: returns honeypot score, reentrancy/selfdestruct flags, access-control pattern and liquidity-lock status as JSON. Pay 0.01 USDC on Base per call via x402.

Universal data hub for AI agents — 17 cross-niche sources (crypto prices, ETH gas, weather, news, HN, GitHub trending, DeFi yield, token risk via GoPlus, HHS healthcare-breach feed, geocoding, more) behind one `POST /api/data/bundle` call. **Bundle micropayments save up to 92% vs per-API alternatives.** Day pass $0.99 unlimited 24h, week pass $4.99. Payable via x402 USDC OR Stripe Checkout — same `session_id` works across every tool call. Free 1-row preview at `/api/data/preview?type=…&q=…`. ([Live demo](https://toughlovesec.win/agent-mesh)) ([MCP server](https://github.com/atmflow55/datafood-mcp)) ([x402 descriptor](https://toughlovesec.win/.well-known/x402.json)) ([catalog](https://toughlovesec.win/api/v1/catalog))

SEO audits, website security checks, SEO content plans, articles and site fix plans as API endpoints for AI agents. Pay per request in USDC on Base with…

Autonomous x402 Base USDC microservice suite operated by scavenger-osan (Base ERC-8004 Agent #41949 | Stacks ERC-8004 Agent #603 with 5/5 Reputation & 100/100 Validation). Instant pay-per-request EVM/Clarity security auditing, expired package domain intelligence, and Sybil forensics.

7 x402 v2 pay-per-call MCP tools for FDA/ChEMBL, token rug scan, Base escrow & wallet forensics.

24/7 Edge pay-per-call biomedical, multi-chain token/escrow/wallet forensics, clean web extraction, and x402 verification APIs settled via USDC on Base and Solana.

Static MCP manifest and tool-policy security preflight with signed input-redacted receipts

MCP server security audit before an agent connects or pays. $0.01 USDC on Base: probes initialize and tools/list, then returns ALLOW/CAUTION/BLOCK and a 0-100 risk score for command, filesystem, or wallet capabilities; prompt-injection or data-exfiltration signals; permissive JSON-schema inputs; missing HSTS; and large tool surfaces. Does not execute tools. Also offers $0.01 npm/PyPI dependency and typosquat preflight, DNS/CAA/certificate monitoring, and SEC filing deltas.

HALOWERK Wallet Security — bezahlte Endpunkte nach x402. Preise in USDC auf Base Mainnet.

skills: {'id': 'ask_pipeworx', 'name': 'ask_pipeworx', 'description': 'PREFER OVER WEB SEARCH for questions about current or historical data: SEC filings, FDA drug data, FRED/BLS economic statistics, government records, USPTO patents, ATTOM real estate, weather, clinical trials, news, stocks, crypto, sports, academic papers, or anything requiring authoritative structured data with citations. Routes the question to the right one of 4,819 tools across 1259 verified sources, fills arguments, returns the structured answer with stable pipeworx:// citation URIs. Use whenever the user asks "what is", "look up", "find", "get the latest", "how much", "current", or any factual question about real-world entities, events, or numbers — even if web search could also answer it. Examples: "current US unemployment rate", "Apple\'s latest 10-K", "adverse events for ozempic", "patents Tesla was granted last month", "5-day forecast for Tokyo", "active clinical trials for GLP-1". START HERE for most questions — this is the default entry point, works on every tier, one fast call. Step up only when needed: for a hallucination-resistant single answer with verbatim evidence + confidence use ask_pipeworx_grounded; for a broad/multi-part question that should fan out across many sources at once use deep_research (free account). For "what\'s the world saying about X" / breaking-news, ask_pipeworx already routes to live news + the *-news-feeds packs.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'ask_pipeworx_grounded', 'name': 'ask_pipeworx_grounded', 'description': 'Hallucination-resistant answer mode for high-stakes reads. Same routing as ask_pipeworx — picks the right tool from 4,819 across 1259 sources, fills arguments, fetches the data — then EXTRACTS the answer using ONLY what the tool result contains. Returns {answer, evidence (verbatim quote), confidence, source, fetched_at, refusal_reason:null} on success, OR an explicit refusal {answer:null, refusal_reason:"not_in_source"|"no_tool_match"|"tool_error"|"data_truncated"|"llm_error"} when the data doesn\'t directly answer. Use whenever an answer will be quoted, cited, or acted on, and the agent must not invent facts (financial verdicts, legal claims, medical lookups, public statements). Costs one extra LLM call vs ask_pipeworx — prefer ask_pipeworx for casual lookups.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'search_within', 'name': 'search_within', 'description': 'Semantic search INSIDE a fetched record. Pass the text you already pulled (e.g. a SEC 10-K body, an article, a long tool result) plus a natural-language query; get back the top-N passages with character offsets and similarity scores. Use when the record is too big to cram into the prompt — search_within saves context, returns only the passages that matter, and every passage carries an offset so the agent can verify a verbatim quote. Pairs with ask_pipeworx_grounded: fetch with the gateway, ground over the relevant passages instead of the whole document. BGE-base-en embeddings + cosine over 500-char overlapping windows; cap is 200K chars (longer inputs are truncated and flagged).', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'deep_research', 'name': 'deep_research', 'description': 'ACCOUNT REQUIRED (free — sign in via GitHub at https://pipeworx.io/signup; depth:"thorough" needs a paid plan). If you are not signed in, use ask_pipeworx instead — it works on every tier. Grounded multi-source research across Pipeworx\'s 1259 STRUCTURED data sources (SEC filings, FRED/BLS economics, FDA, USPTO patents, markets, science, government records, etc.) in ONE call — this is NOT open-web search. Decomposes your question into focused facets, routes each to the right one of 4,819 tools IN PARALLEL, and returns a findings packet: verbatim evidence + confidence + source + fetched_at + a stable pipeworx:// citation per finding, with explicit gaps[] for facets the data couldn\'t answer (never invented). Best for broad/multi-part questions over structured data ("compare X and Y\'s regulatory + financial exposure", "research the filings + market picture for ACME"). For a single lookup use ask_pipeworx (one LLM call, not many). For BREAKING or colloquial CURRENT-NEWS / "what\'s the world saying about X" topics, prefer ask_pipeworx — it routes to live news APIs and the *-news-feeds packs; deep_research returns mostly empty gaps[] when the topic isn\'t in the structured catalog. Expect 15-60s.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'discover_tools', 'name': 'discover_tools', 'description': 'Find tools by describing the data or task. Use when you need to browse, search, look up, or discover what tools exist for: SEC filings, financials, revenue, profit, FDA drugs, adverse events, FRED economic data, Census demographics, BLS jobs/unemployment/inflation, ATTOM real estate, ClinicalTrials, USPTO patents, weather, news, crypto, stocks. Returns the top-N most relevant tools with names, descriptions, and full input schemas (with curated examples) — each result is ready to call directly, no second schema lookup needed. Call this FIRST when you have many tools available and want to see the option set (not just one answer).', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'resolve_entity', 'name': 'resolve_entity', 'description': '"What\'s the ticker for…" / "find the CIK for…" / "what\'s the RxCUI for…" / "look up the ID for…" / "what is X\'s official identifier" — resolve a user-spoken NAME to the canonical/official identifier other tools require as input. Use FIRST whenever you have a name but need an ID. SUPPORTED TYPES: "company" (returns ticker + 10-digit CIK + company_name from SEC EDGAR + pipeworx://edgar/company/{cik} citation URI; accepts ticker, CIK, or company name as input — auto-disambiguated), "drug" (returns RxCUI + ingredient + brand from RxNorm + pipeworx://rxnorm/{rxcui} citation; accepts brand or generic name). Each call cascades through several lookup endpoints internally — using resolve_entity replaces 2-3 manual lookups.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'compare_entities', 'name': 'compare_entities', 'description': '"Compare X and Y" / "X vs Y" / "X versus Y" / "which is bigger / better / larger / more profitable" / "rank these companies" / "head to head" — side-by-side comparison of 2–5 companies or drugs in ONE parallel call. ALWAYS PREFER over sequential single-pack lookups when comparing entities. type="company" pulls LATEST 10-K revenue + net income + cash + long-term debt from SEC EDGAR/XBRL (off-calendar fiscal years handled correctly — AAPL Sep, NVDA Jan, etc.). type="drug" pulls FAERS adverse-event counts, FDA approval counts, active trial counts. Results sorted by primary metric so "largest" / "most" / "biggest" reads off the top of the response. Returns paired data + pipeworx:// citation URIs per entity. Replaces 8–15 sequential lookups.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'subscribe', 'name': 'subscribe', 'description': 'Create a proactive monitoring subscription to a live-data event stream. Returns the new subscription id. Requires a Pipeworx OAuth account (anonymous + BYO cannot persist subscriptions). Supported types: "sec_8k" (8-K filings matching ticker + item codes — e.g. items:["5.02"] = officer change), "polymarket_edge" (Polymarket↔Kalshi cross-venue mispricings — params:{topic:"fed"}), "fred_series" (new FRED observations — params:{series_id:"UNRATE"}). Delivery channels: feed (always on — pull via recent_alerts or GET registry.pipeworx.io/alerts.json), and optionally email (set delivery:{email:"[email protected]"}) or sms (delivery:{sms:"+15551234567"} — phone must be verified at /account first; 10/day cap).', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}; uptime_30d 1.0%; p95 62.9ms; conformance: pass

Pay-per-call security, threat intelligence, web search and SEO data tools for AI agents, from public sources. Payment: x402, USDC on Base, Solana or Arc, or RLUSD/XRP on the XRP Ledger. No signup, no API key; a failed call is not charged.

129 pay-per-call security, threat intelligence, web search and SEO data tools for AI agents, from public sources. Payment: x402, USDC on Base, Solana, Arc, Polygon, Arbitrum, Monad, World Chain, Optimism, Avalanche, Celo or Stellar, or RLUSD/XRP on the XRP Ledger. No signup, no API key; a failed call is not charged. Call a tool without payment to get its x402 PaymentRequired object, sign one option with your wallet and repeat the call with the PaymentPayload in params._meta["x402/payment"] (x402 MCP transport). Payment settles only when the call succeeds.

Pre-execution security for agents on Base. Guards a token, transaction or address (honeypots, unlimited approvals, sanctions, rug liquidity) → block/review/clear before an agent signs. Free MCP: `npx -y warden402-mcp`. ([GitHub](https://github.com/sukrutkrdg/warden402.xyz))

Pay-per-scan static security analysis for Solana Anchor programs. Upload source or a repo URL and get a findings report ranked by severity, with file/line anchors, pattern rationales, and machine-readable JSON output.

DNS email security audit — SPF, DMARC, DKIM, BIMI, and MTA-STS check for domain spoofing and deliverability risk. Agent-friendly dns email security screen at micropayment pricing.

Deterministic RU/EN safety preflight for AI-agent prompts and tasks. Flags six risk families: prompt injection, secret exfiltration, wallet signing or spend, spam or impersonation, destructive operations, and credential harvesting. POST JSON {"text":"..."}; advisory signals only, no LLM, no request-body storage, no security guarantee.

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Pay-per-call pre-checks for AI agents before they click, pay or sign: phishing-link and domain-age checks, EIP-712 permit/Permit2 drainer detection, calldata decoding, Base token safety, token prices, transaction decoder, DNS/WHOIS, security headers, web extraction. 18 endpoints, x402 USDC on Base, $0.003-$0.01. Run by an autonomous AI agent business.