Bot Bazaar

Did a USDC payment land on Base? Give a transaction hash; get success or reverted, block number and time, confirmations, the tx sender/recipient, and every Base USDC Transfer in it (from, to, amount). Read from Base RPC; final receipts are cached.

Due-diligence lookup on an x402 seller before paying it: checks that the seller's x402 endpoint answers 402 with a matching Base USDC payTo, and returns the payout wallet's funder and age, Bot Bazaar reputation, count of distinct on-chain payers (withheld for the operator's own wallets), and an OFAC SDN address screen. Query by payTo wallet or endpoint URL.

Profile a Base wallet before paying or trusting it: first funder and first-seen time (wallet age), outgoing tx count, contract or EOA, an OFAC SDN address screen, and whether it is a Bot Bazaar seller payout wallet. No balances.

Downloadable cleaned JSON + CSV dataset of verified Base USDC x402 endpoints and MCP servers (category, service_name, url, method, price_usdc, network, asset, pay_to, has_bazaar_schema, mcp_endpoint, last_verified). Excludes operator/house financial figures.

Check a domain's agent and x402 discovery readiness: probes /.well-known/x402, /llms.txt, and /mcp over HTTPS and reports status codes, latency, discovered x402 resource count, whether /llms.txt is present, and whether /mcp is detected.

Check an x402 endpoint without paying it: one unpaid GET, then whether it returns a valid 402, x402 v1/v2 support, each payment option (network, asset, price, payTo, timeout, EIP-3009 domain), latency, and resource/Bazaar-metadata quality checks.

Compute required sample size per variant for 80% power and alpha=0.05 given baseline conversion rate and relative MDE.

Check hex calldata for 4-byte selector + 32-byte ABI word alignment and compute total calldata byte length.

Verify AEAD cipher mode (AES-256-GCM), 96-bit IV length, and per-key message volume against NIST SP 800-38D birthday bounds.

Validate an A2A /.well-known/agent-card.json specification (agent_name, https url, semver version, skills list) for agent discovery.

Compute the 5-factor Altman Z-Score and classify solvency into Safe, Grey, or Distress zones.

Compute Uniswap v2 constant-product swap output, effective price, fee deduction, and price impact percentage.

Generate and validate prefixed, CRC32-checksummed API token formats compatible with automated secret-scanning rules.

Validate event-driven AsyncAPI schemas for idempotency keys, dead-letter queues, and version compatibility.

Validate security audit log schemas for actor/action/resource fields and cryptographic hash-chain (prev_hash/entry_hash) integrity.

Compute posterior conversion means and Bayesian probability that Variant B outperforms Variant A.

Lint an x402 endpoint URL for Coinbase CDP Bazaar discovery readiness without paying it: checks HTTP 402, x402 v2 PAYMENT-REQUIRED header, Base USDC option, >=1000 atomic minimum, EIP-3009 extra.name/version, and extensions.bazaar schema.

Test a series of ledger figures against Benford's Law expected leading-digit frequency (30.1% for digit 1).

Compute theoretical European Call/Put option prices and Delta, Gamma, and Vega via Black-Scholes-Merton.

Compute approximate Yield to Maturity, Macaulay Duration, and Modified Duration for a fixed-coupon bond.

Compare canonical rollup bridge vs fast intent bridge fees and finality times for a Base USDC transfer.

Compute David Sacks Burn Multiple (Net Burn / Net New ARR) and remaining cash runway in months.

Compute CAGR percentage and Rule-of-72 capital doubling time from starting value, ending value, and years.

Validate CAIP-2 network identifiers (eip155:8453, base, eip155:84532) and USDC asset contract addresses for x402 v2 facilitator compatibility.

Decode raw EVM hex calldata for standard ERC-20 transfers, approvals, and balance lookups into human-readable parameters.

Check California privacy compliance for Sec-GPC: 1 browser signal handling and 45-day DSAR response SLA.

Compute network address, broadcast address, netmask, total IPs, and usable host count for any IPv4 CIDR block.

Check edge worker bundle size, subrequest count per invocation, and CPU time against platform limits.

Analyze M1, M3, M6, and M12 cohort retention percentages to detect asymptotic product-market-fit flattening.

Self-serve CPSC eFiling (16 CFR 1110 7-element CPC/GCC bulk-upload CSV template + ACE Reference PGA broker sheet) & EU GPSR (Regulation (EU) 2023/988 Articles 9/16/19 Amazon Manage Your Compliance CSV + checklist) SKU compliance template pack (.zip + JSON). Also available at alias /v1/x402/sku-compliance-templates. Templates and schema linting only — not legal advice.

Inspect a Base address for contract bytecode and proxy patterns: EOA vs contract, runtime bytecode byte length, EIP-1967 implementation/beacon/admin storage slots, EIP-1167 minimal proxy target, outgoing tx count, and an OFAC SDN screen.

Audit Set-Cookie attributes for Secure, HttpOnly, SameSite, and RFC 6265bis __Host- prefix compliance.

Lint CORS response headers to ensure browser/agent x402 clients can send PAYMENT-SIGNATURE and read PAYMENT-REQUIRED / PAYMENT-RESPONSE.

Simulate browser CORS OPTIONS preflight resolution for custom x402 headers (PAYMENT-SIGNATURE, X-PAYMENT).

Validate a CPSC CPC/GCC certificate row or CSV against all 7 statutory elements under 16 CFR 1110 / CPSA Section 14(a) eFiling (product ID, safety rule citations, US importer/manufacturer certifier, records custodian contact, manufacture date/place, test date/place, and CPSC-accepted third-party lab or determination). Supports GET query params and POST JSON/CSV. Templates & schema linting only — not legal advice.

Compute the exact deterministic EVM contract address deployed via CREATE2 from deployer address, 32-byte salt, and initCodeHash.

Validate a 5-field cron schedule expression and timezone, classifying execution cadence and field breakdown.

Compute realized capital gain/loss across FIFO, LIFO, and HIFO accounting methods for digital asset disposals.

Lint a Content-Security-Policy header string for unsafe-eval, wildcard script sources, and default-src restrictions.

Validate a CSV header list and sample row for column count parity, duplicate column names, and snake_case naming.

Compute exact CVSS v3.1 Base Score (0.0-10.0) and severity rating from a CVSS v3.1 vector string.

Verify data lifecycle schedules balancing GDPR 90-day IP log minimization with IRS 7-year financial ledger retention.

Verify domain DMARC policy (p=reject or quarantine pct=100) and SVG Tiny PS requirements for BIMI inbox logos.

Validate SPF and DMARC TXT records for RFC 7208 10-DNS-lookup limits and p=reject/quarantine spoofing protection.

Lint Dockerfile settings (pinned non-latest base image tag, slim/distroless image, non-root USER, pip --no-cache-dir).

Decompose Return on Equity into net profit margin, asset turnover, and financial leverage multiplier.

Verify cross-platform formatting rules (indent_style, indent_size, LF line endings, UTF-8 charset).

Calculate recommended EIP-1559 maxFeePerGas (2 * baseFee + maxPriorityFeePerGas) for reliable Base L2 inclusion.

Compute the canonical EIP-191 Ethereum Signed Message Keccak-256 digest and byte length for wallet signature verification.

Validate EIP-3009 TransferWithAuthorization domain parameters (name, version, chainId, verifyingContract, nonce) for Base USDC and compute canonical EIP-712 typeHashes.

Calculate EIP-4844 blob gas consumption (131,072 gas per blob) and L1 data posting cost in ETH and USD.

Convert and validate an EVM address against strict EIP-55 Keccak-256 mixed-case checksum rules, detecting case mismatches and burn addresses.

Compute the exact Keccak-256 EIP712Domain typeHash and domainSeparator for Base USDC or any custom EIP-712 contract domain.

Compute Simple Moving Average, 2-sigma Bollinger Bands, and Relative Strength Index (RSI) from a price series.

Evaluate an ERC-20 token allowance amount and spender for unlimited-approval exposure compared with zero-allowance EIP-3009 authorizations.

Validate ERC-4337 UserOperation gas fields (callGasLimit, verificationGasLimit, preVerificationGas) for bundler acceptance.

Evaluate an x402 route configuration (method, price_usdc, network, extensions.bazaar) against Coinbase CDP Bazaar and autonomous crawler rules.

Calculate optimal Uvicorn worker count, keep-alive timeout, and concurrency limits for a given container RAM budget.

Evaluate token float-to-FDV ratio and monthly unlock supply overhang as a percentage of circulating market cap.

Validate file upload handling controls (magic-byte sniffing, randomized storage keys, Content-Disposition: attachment).

Calculate minimum gross arbitrage spread in bps required to cover flashloan fee, dual DEX swap fees, and L2 gas cost.

Validate Fly.io machine sizing (shared-cpu-1x 256MB), auto_stop_machines, and monthly always-on vs idle spend against a $15 budget guard.

Reconcile gross on-chain USDC receipts against house self-test wash exclusions to compute net Schedule C gross receipts.

Trace a Base wallet's origin: first funder address, earliest incoming funding transaction hash, first-seen timestamp and wallet age in days, whether the first funder is a contract or EOA, and an OFAC SDN screen on both addresses. No balances.

Evaluate 3 cross-exchange rates and per-leg taker fees in bps to detect net profitable triangular arbitrage cycles.

Score an AI agent architecture for untrusted tool-result fencing, human approval gates on external sends, and secret isolation.

Compute monthly principal + interest payment, total lifetime interest, and first-month interest breakdown.

Calculate peak-to-trough Maximum Drawdown % and the asymmetric percentage gain required to recover peak equity.

Validate an MCP server tool definition (tool_name, description, transport, protocol_version 2025-06-18) for Streamable HTTP MCP compatibility.

Estimate the LLM prompt token footprint consumed by an MCP server's tools/list schemas.

Compute and verify a sorted-pair Keccak-256 Merkle tree root from leaf and sibling hashes (OpenZeppelin MerkleProof format).

Score a DEX trade for MEV sandwich vulnerability from trade size vs pool TVL and slippage tolerance in bps.

Estimate intrinsic gas saved by batching multiple eth_call or on-chain reads via canonical Base Multicall3.

Evaluate a Safe/multisig threshold (M-of-N signers and hardware signer count) for single-point-of-failure and fault-tolerance resilience.

Calculate Net Revenue Retention (NRR %) and Gross Revenue Retention (GRR %) from starting ARR, expansion, contraction, and churn.

Validate Nginx server configuration for server_tokens off, modern TLSv1.2/TLSv1.3 protocols, and HSTS headers.

Compute composite NIST Cybersecurity Framework 2.0 maturity tier across Govern, Identify, Protect, Detect, Respond, and Recover.

Validate a 32-byte hex EIP-3009 authorization nonce for bit entropy, sequential/zero-padding traps, and replay safety.

Compute Net Present Value and Internal Rate of Return (IRR %) for a comma-separated series of periodic cashflows.

Compute and verify the exact RFC 7636 S256 base64url code_challenge from an OAuth 2.1 PKCE code_verifier.

Screen up to 10 comma-separated EVM addresses on Base against the daily OFAC SDN sanctions list in a single call.

Standalone OFAC SDN digital-currency sanctions address screen for an EVM address on Base (0x + 40 hex). Screens against the daily OFAC SDN ETH/EVM address list and returns match status, matched addresses, list size, and last-refreshed timestamp.

Validate OIDC /.well-known/openid-configuration metadata for HTTPS issuer, JWKS URI, and asymmetric signing algorithms.

Lint an OpenAPI operation (operation_id, HTTP method, path, HTTP 402 response definition) for AI agent tool-calling and x402 readiness.

Validate W3C Trace Context traceparent headers (version-traceId-parentId-flags) and extract sampling decision.

Verify oracle price feed freshness against heartbeat threshold and L2 sequencer uptime feed status.

Compute mid-price, volume-weighted micro-price, bid-ask spread in bps, and L1 orderbook imbalance ratio.

Evaluate an API endpoint against OWASP API Top 10 controls (BOLA, BOPLA field allowlisting, rate limiting, and SSRF protection).

Check Node.js dependency hygiene for lockfile pinning, postinstall script safety, and engines version constraints.

Calculate Shannon/combinatorial bit entropy from secret length and character pool size against NIST SP 800-63B guidelines.

Inspect and validate x402 v2 payment parameters (amount_atomic in micro-USDC vs USD, Base network, EIP-55 payTo checksum, 1000-atomic minimum).

Determine applicable PCI-DSS v4.0 Self-Assessment Questionnaire tier (SAQ A, SAQ A-EP, or SAQ D) from payment checkout architecture.

Validate Permit2 signature parameters for bounded expiration window and non-infinite token approval amounts.

Convert 8-hour perpetual funding rate in bps to daily carry cost in USD and annualized APR percentage.

Scan a text snippet for email addresses, phone numbers, and 64-hex tokens, returning findings and a cleanly redacted string.

Recommend optimal composite B-tree index column ordering (equality predicates first, then sort/range columns) and CREATE INDEX DDL.

Analyze an x402 endpoint category against empirical Base USDC crawler telemetry ($0.01 auto-buy ceiling, indexing cost, break-even sweeps).

Validate Prometheus alert rules for non-zero 'for' duration, severity labels, and runbook URL annotations.

Validate Python pyproject.toml configuration for PEP 517 build-system, requires-python bounds, and reproducible lockfiles.

Estimate Self-Employment tax (15.3%) and quarterly IRS safe-harbor estimated tax installments.

Evaluate read/write per-minute rate limits and HTTP 429 Retry-After header configuration for public agent APIs.

Check login redirect_uri / next parameters against protocol-relative //evil.com, backslash, and @ open-redirect bypasses.

Evaluate Redis maxmemory eviction policy and TTL jitter settings to prevent cache stampedes and OOM errors.

Evaluate smart contract call flow pattern for Checks-Effects-Interactions (CEI) and nonReentrant guard compliance.

Evaluate automated dependency update policies for grouped minor updates, lockfile maintenance, and PR rate limits.

Combined Base wallet & x402 seller risk bundle in a single call: OFAC SDN sanctions screen (wallet, funder, proxy targets), first-funder trace & wallet age, contract/EIP-1967/EIP-1167 proxy inspection, Bot Bazaar seller profile, and a composite 0-100 risk_score + risk_breakdown.

Validate robots.txt rules (User-agent, Allow root, Disallow admin paths, HTTPS Sitemap XML) for search and AI agent crawlers.

Validate JSON-RPC batch size and method list and flag when eth_call batches should be consolidated into Multicall3.

Validate cryptographic signing/encryption key algorithms (Ed25519, secp256k1, P-256, RSA-3072+) against NIST 2030 strength standards.

Calculate SaaS Magic Number from quarterly net new ARR divided by prior-quarter sales & marketing spend.

Calculate SaaS Quick Ratio ((New + Expansion MRR) / (Churned + Contraction MRR)) to benchmark growth durability.

Compute SaaS Rule of 40 score from YoY ARR growth rate and Free Cash Flow / EBITDA margin percentage.

Validate Software Bill of Materials (SBOM) metadata for CycloneDX/SPDX format, specVersion, purl identifiers, and SHA-256 hashes.

Validate an x402 payment ledger row (tx_hash, payer_wallet, amount_usdc, is_house wash-trade exclusion, net_taxable_usdc). Not tax advice.

Audit a comma-separated list of environment variable names to flag secret/key/token variables that must stay out of public config files.

Audit HSTS, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers and compute an A-to-C security posture grade.

Identify 4-byte EVM function selectors (transfer, approve, transferWithAuthorization, balanceOf) or compute selector from an ABI signature.

Compare two Semantic Versioning strings (current vs target) and classify major breaking, minor compatible, or patch upgrades.

Self-contained 'x402 + MCP Server in a Box' FastAPI starter kit (JSON files dict + base64 .zip archive): Base USDC x402 v2 verification with extensions.bazaar schema, pre-settlement OFAC SDN screener, Streamable HTTP MCP server skeleton, and IRS Schedule C tax CSV logger.

Look up a Base wallet's native USDC and ETH balances at the latest block, plus account nonce (outgoing tx count) and contract/EOA status. Balances for the board operator's own (house) wallets are withheld.

Estimate Base L2 gas costs in ETH and USD for common token operations vs zero-gas facilitator-settled x402 EIP-3009 transfers.

Compute safe transaction gasLimit from eth_estimateGas and maximum gas forwarded to subcalls under EIP-150.

Verify data processor readiness across signed Article 28 DPA, EU Standard Contractual Clauses, subprocessor list, and 72h breach SLA.

Validate a git commit subject against Conventional Commits 1.0 and determine the corresponding SemVer version bump.

Audit GitHub Actions workflows against mutable branch refs, excessive GITHUB_TOKEN permissions, and pull_request_target hazards.

Compute worst-case node amplification count (page_limit ^ nesting_depth) for GraphQL DoS rate limiting.

Evaluate GraphQL server configuration for query depth limits, production introspection disablement, and bounded pagination.

Check Protobuf v3 schema definitions for zero UNSPECIFIED enum entries and reserved deleted field numbers.

Verify dataset de-identification rules across the 18 HIPAA Safe Harbor identifiers (names, year-only dates, 3-digit ZIP, SSN/MRN).

Audit password KDF settings against OWASP 2026 minimums (Argon2id or PBKDF2-HMAC-SHA256 >= 600,000 iterations + 16-byte salt).

Audit Cache-Control directives to ensure paid or authenticated API responses cannot be cached by shared CDNs/proxies.

Calculate liquidity provider impermanent loss % for a given token price ratio change and net return after fee yield.

Classify operational or security incidents into SEV-1 through SEV-3 tiers with response SLA minutes and paging requirements.

Check coverage across ISO 27001:2022 Annex A control clauses (A.5 Organizational, A.6 People, A.7 Physical, A.8 Technological).

Parse an ISO-8601 timestamp and normalize it to both UTC (Z) and America/Los_Angeles (PT) with unix epoch seconds.

Validate a JSON Schema object definition (type, properties, required subset, additionalProperties=false) for LLM structured output compatibility.

Validate JWT signing algorithm (EdDSA/ES256 vs alg:none), issuer/subject presence, and short-lived expiration window.

Validate Kubernetes Deployment pod security context (runAsNonRoot, readOnlyRootFilesystem), probes, and resource limits.

Compute full-Kelly, half-Kelly, and quarter-Kelly position allocation percentages from win probability and payoff ratio.

Calculate Aave/Compound lending health factor and collateral drawdown safety buffer from collateral, debt, and liquidation threshold.

Compute exact asset USD liquidation price and percentage drop buffer given collateral units, debt, and liquidation threshold.

Lint an /llms.txt agent documentation structure (H1 title, blockquote summary, H2 sections, context window budget).

Compute annualized excess return, Sharpe ratio, and Sortino downside-risk ratio.

Validate a sitemap.xml <url> entry (HTTPS canonical loc, ISO-8601 lastmod date, changefreq, priority 0.0-1.0).

Recommend optimal swap slippage tolerance in basis points based on asset daily volatility and trade size % of pool.

Compute monthly allowed downtime in minutes and failed request budget from an SLO target percentage and traffic volume.

Map technical controls (MFA, peer review, encryption at rest, audit logging) to SOC 2 Common Criteria CC6, CC7, and CC8.

Check an SPDX license identifier (MIT, Apache-2.0, BSD-3-Clause, GPL-3.0-only, UNLICENSED) for commercial use and copyleft obligations.

Scan query text for common SQL injection (UNION SELECT, tautologies) and Cross-Site Scripting (<script>, event handlers) patterns.

Recommend optimal SQLite PRAGMA settings (journal_mode=WAL, synchronous=NORMAL, busy_timeout) for concurrent web servers.

Check message queue consumer visibility timeout (6x max processing time) and maxReceiveCount DLQ threshold.

Compute W3C Subresource Integrity base64 sha256 and sha384 attributes for static JS/CSS content.

Check a target URL against Server-Side Request Forgery vectors including RFC1918 private IPs, loopback, and 169.254.169.254 IMDS.

Convert nominal staking APR to effective compounded APY after validator commission and compounding frequency.

Compute the exact EVM storage slot hash keccak256(abi.encode(key, slot)) for a Solidity mapping entry.

Evaluate CNAME target domains and NXDOMAIN status for dangling cloud resource subdomain takeover risks.

Audit systemd .service unit settings for NoNewPrivileges, PrivateTmp, and ProtectSystem=strict isolation.

Check Terraform infrastructure settings for least-privilege CIDR blocks, storage encryption at rest, and pinned provider versions.

Audit smart contract TimelockController minDelay hours and proposer/executor role separation.

Audit a TLS cipher suite string for AEAD (GCM/ChaCha20-Poly1305) support and absence of legacy RC4/3DES/NULL ciphers.

Convert token amounts between human decimal strings and exact atomic integer units across 6, 8, or 18 decimals.

Check a Base token contract address for native Circle USDC vs bridged USDbC status, decimals, and EIP-3009 v2 signing readiness.

Compute vested vs locked token supply and unlock percentage at a given elapsed month along a cliff + linear vesting schedule.

Validate Time-Based One-Time Password (TOTP) digits, 30-second step period, and HMAC algorithm for authenticator app compatibility.

Convert token price to Uniswap v3 tick index, tickSpacing-aligned tick, and Q64.96 sqrtPriceX96 integer.

Compute customer Lifetime Value (LTV), LTV:CAC ratio, and gross-margin-adjusted CAC payback months.

Validate a UUID or ULID identifier string and extract its format, version, variant, and canonical representation.

Calculate 1-day and 10-day 95% and 99% Parametric Value-at-Risk in USD from portfolio value and daily volatility.

Calculate Volume-Weighted Average Price (VWAP), Time-Weighted Average Price (TWAP), and arrival shortfall in bps.

Calculate corporate WACC % from cost of equity, pre-tax cost of debt, corporate tax rate, and capital structure weights.

Score an AI agent wallet setup across hot/cold separation, per-call spending caps, pre-settlement OFAC screening, and Schedule C tax logging.

Validate WebAuthn Relying Party ID, HTTPS origin alignment, and userVerification policy for passkey authentication.

Compute and verify a timestamped HMAC-SHA256 webhook signature (timestamp.payload) for constant-time webhook authentication.

Calculate x402 route indexing self-test cost, revenue per full crawler sweep, and monthly net USDC return.

Detect anomalous data points in a numeric series using both Z-score thresholds and Tukey 1.5x IQR fences.

Certify an x402 seller domain & endpoint across 8 technical readiness & compliance checks (HTTPS, eip155:8453 Base USDC, OFAC SDN screen, HEAD->402, extensions.bazaar schema, dual-facilitator redundancy) and mint a live embeddable SVG shield at /badge/{domain}.svg.

OpenAI-compatible deterministic security, DeFi, compliance, DevOps, and FinOps auditor chat completion endpoint ($0.01 USDC or 10,000 micro-credits via X-Bazaar-Key / Authorization: Bearer bz_live_...). Also mounted at /v1/chat/completions.

Mint a prepaid X-Bazaar-Key trial API key ($0.05 USDC -> 60,000 micro-credits = 6x $0.01 calls, +20% bonus). Use X-Bazaar-Key or Authorization: Bearer bz_live_... across all 190+ Bot Bazaar endpoints, /v1/chat/completions, and /mcp with zero per-call signing latency.

Clanker v4 Anti-Sniper & Pool Configuration Linter: validates Clanker v4 deployment JSON (100% caller-owned rewards.recipients summing to 10000 bps in Paired asset, platform_lp_share_bps: 0, anti-sniper decaying fee bounds, vault lockup >= 7d, and OFAC SDN screen on all addresses). Also available at alias /v1/x402/defi/clanker-v4-config-builder.

Uniswap v4 Hook-Delta & Permission Bitflag Diagnostic Linter: decodes all 14 Uniswap v4 hook address permission flags (beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta, liquidity gates) and fee caps. Non-custodial diagnostic only; 0 bps fees. Also available at alias /v1/x402/defi/uniswap-v4-hook-inspector.

Pre-Flight Base Swap Heuristic & Unsigned Calldata Linter: screens token/router/hook addresses against OFAC SDN, checks Uniswap v4 hook-delta flags and slippage bounds, and formats an unsigned ERC-20 approve + swap transaction template (integrator_fee_bps: 0, never signs or broadcasts). Also available at aliases /v1/x402/defi/pre-flight-swap-audit and /v1/swap/build-quote.

Live Base mainnet block gas & EIP-4844 blob fee oracle (60s TTL cache) computing real-time L2 execution vs zero-gas EIP-3009 settlement costs.

Real-time Base L2 block utilization, gas congestion tier, and Base USDC EIP-3009 settlement finality pulse.

Timestamped, SHA-256-fingerprinted OFAC SDN ruleset attestation (active list count, digest, refresh timestamp) plus live EVM address screening.

Anonymized x402 ecosystem telemetry feed reporting active buyer archetypes, auto-pay price ceilings ($0.01 vs $0.05), and facilitator split (CDP vs PayAI).

Pure Read-Only NegRisk / Dutch-Book Probability-Sum & Fee-Drag Calculator: computes complete-set probability sum, overround/underround in bps, fee drag, and net edge per share set from caller-supplied outcome prices (zero external API calls, zero order routing).

Composite 6-check autonomous agent readiness audit chaining A2A agent-card.json, MCP manifest, MCP token budget, llms.txt, OpenAPI tool lint, and prompt-injection fencing.

Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10.

Composite 6-check DevOps infrastructure audit chaining Dockerfile, fly.toml cost guard, Kubernetes pod security, Terraform HCL, Nginx TLS, and GitHub Actions pinning.

Composite 6-check crypto compliance & tax audit chaining OFAC batch screening, Schedule C row lint, Form 1099-DA reconciliation, FIFO/HIFO cost basis, and quarterly safe harbor.

Composite 6-check DeFi execution audit chaining AMM slippage, MEV sandwich risk, flashloan breakeven, oracle staleness, liquidation distance, and lending health factor.

Composite 6-check domain deliverability & trust audit chaining SPF/DMARC lookup limits, BIMI readiness, TLS cipher suite, robots.txt, sitemap.xml, and webhook HMAC.

Composite 6-check privacy governance audit chaining GDPR Art. 28 DPA, CCPA Sec-GPC, PII redaction, 90-day IP retention, hash-chained audit logs, and HIPAA Safe Harbor.

Composite 7-check SaaS financial scorecard chaining LTV:CAC, Rule of 40, Burn Multiple, Quick Ratio, NRR/GRR, Magic Number, and Altman Z-Score.

Composite 7-check smart contract & EVM security audit chaining reentrancy, selector lookup, ABI size, ERC-20 allowance risk, ERC-4337 userop, CREATE2, and Permit2 checks.

Composite 6-check supply-chain audit chaining CycloneDX SBOM, package.json, pyproject.toml, Renovate/Dependabot, env secret-leak scan, and SemVer compatibility.

Composite 7-check web security audit chaining CSP, CORS preflight, HTTP security headers, cookie flags, open-redirect, file-upload, and SSRF validation.

Composite 6-check x402 merchant launch audit chaining EIP-3009 params, EIP-712 domain separator, CDP + PayAI facilitator compatibility, CAIP-2 network check, and pricing advisor.