Every agent-payable API.

AI tweet drafting: generate, refine, and score tweet text in a 3-step flow.

Assesses how much a general-purpose AI agent (not a specialized ICS tool) lowers the barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 water-utility precedent, not governance thresholds. Distinct from /ot/ai-exposure (vendor's own AI copilot). Input: vendor (required); product, internet_facing, auth_type, segmented (all optional; unknown caps tier at informational). DeepSeek-synthesized, ICD-203 language.

AI code review. Returns issues with severity, line numbers, fix suggestions. Focus on security, performance, readability, or bugs.

[3-LEG] AI tool and MCP chain, one tool (?entity=mammoth-ai): leading decay warnings, release cadence stalling and docs going dark -> current live or dead status from real DNS and GitHub checks -> realized lifecycle from launch to death with days alive (confirmation gate). A sequential chain, not one reading - confidence = how many legs are lit, in order. Sources: DNS, GitHub, package registries. Descriptive only, never a forecast or advice. No data -> 422 no_charge, not billed.

AMM price impact in bps for a swap input against reserves. Call when pre-trade impact checks for pool size vs order size. Returns impact bps and mid vs execution as deterministic JSON for $0.001 USDC via x402 on Base. First-party local math only—no RPC, live market feed, API keys, storage, or mediagen. Advisory only; the caller owns capital, risk, and production controls.

Decision procedure and verification schema for accepting a cryptographically signed AP2 payment mandate before settlement. Checks signature validity, nonce uniqueness, mandate scope against requested amount, expiry and session freshness, delegation chain depth, and parent agent authority. Returns PASS/FAIL with explicit rejection reasons for each gate.

Resolve 29 common ERC-20, ERC-165, ERC-721, ERC-1155, ERC-2612, and ERC-3009 selectors without a network lookup, or strictly decode arbitrary Ethereum or EVM calldata using a supplied Solidity signature.

Remove duplicate CSV, TSV, JSON, JSON Lines, or YAML records using selected identity fields and report the removed count.

Inspect Base transaction status and receipt evidence in one call, including success, revert, or pending state, confirmations, actual gas fee, recognized calldata, bounded ERC-20-shaped transfers, and official Base USDC recognition for payment confirmation.

Resolve an exact SEC company name, ticker, or CIK, then bundle recent filing signals, normalized issuer-reported XBRL facts, and Form 4 insider transactions into one bounded public-company evidence report with explicit section coverage and official-source provenance.

Scan source code or configuration text for leaked API keys, tokens, and credentials without returning secret values.

Compare two texts and return structured line additions, removals, and a unified diff.

Validate and normalize an Ethereum or EVM wallet address, distinguish valid, absent, or invalid ERC-55 checksum casing, and identify the zero address without a network request.

Deterministically detect and redact PII and personal data in supplied text with overlap-safe matching for emails, phone numbers, validated IPv4 and IPv6 addresses, Luhn-valid payment cards, valid-checksum IBANs, and structurally valid US Social Security numbers.

Extract webpage metadata from one public URL: page title, meta description, canonical URL, headings, hreflang, icons, feeds, Open Graph, Twitter Cards, and JSON-LD Schema.org types, with redirect and response provenance plus privacy-safe, publisher-asserted Organization facts with field evidence.

Validate EIP-712 typed structured data and derive its domain separator, message hash, and signing digest.

Estimate gas for one Base mainnet transaction context at a resolved block, add a bounded caller-selected buffer, and preserve RPC rejection evidence without signing or broadcasting.

Repair caller-supplied malformed JSON by safely removing an outer Markdown fence, comments, single-quoted strings, unquoted identifier keys, Python literals, and trailing commas, with transformation hashes and strict rejection of duplicate keys or non-finite numbers.

Extract and classify links from one public page or safely crawl up to 10 same-origin pages into an agent-ready site map with page provenance, depth limits, and robots.txt enforcement.

Fetch and normalize public RSS or Atom feeds into stable structured JSON entries for agents and research workflows.

Get and inspect one historical Base mainnet block by exact number or a latest, safe, or finalized tag, returning its header timestamp, transaction count, gas use, base and blob fees, state and receipt roots, confirmations, and head-distance evidence.

Clean CSV, TSV, JSON, JSON Lines, or YAML records with collision-safe header normalization, deterministic integrity hashes, and exact transformation counts.

Check a public domain's email authentication and anti-spoofing posture using MX, SPF, DMARC, caller-selected DKIM, MTA-STS, TLS-RPT, and BIMI DNS evidence.

Query validated eth_getLogs events from one Base mainnet contract using a required event signature and optional indexed topic filters across a bounded resolved block range.

Convert caller-supplied CSV, TSV, JSON, JSON Lines (NDJSON), or YAML with optional root preservation, deterministic integrity hashes, JSON-encoded nested tabular cells, and explicit rejection of ambiguous duplicate keys or non-finite numbers.

Retrieve newest-first incoming and outgoing Circle USDC Transfer events for one address across a validated, bounded Base mainnet block range.

Check one Base mainnet wallet or contract for ETH and official USDC balances, transaction nonce, and contract-bytecode evidence at a single resolved block.

Check a public page for deterministic HTML accessibility problems and return actionable WCAG-oriented findings.

Inspect a domain's robots.txt crawl rules and XML sitemap health, availability, and URL count.

Look up a public company by ticker or CIK, normalize recent SEC filings, and flag deterministic events such as late filings, amendments, auditor changes, non-reliance, control changes, or bankruptcy disclosures.

Assess a business domain using website quality, SEO, security, accessibility, performance, DNS, TLS, RDAP, and optional public GLEIF LEI entity candidates.

Validate JSON data against a bounded JSON Schema Draft 2020-12 contract for nested objects, arrays, required properties, types, enums, formats, lengths, patterns, and numeric bounds; return deterministic instance and schema JSON Pointers, explicit error truncation, input hashes, and no remote reference resolution.

Convert and extract a public website URL into clean Markdown or readable text plus bounded structured links, canonical and heading signals, Schema.org types, redirect evidence, content hashes, and response provenance for RAG, research, or agent context.

Audit on-page technical SEO, score a public URL, and return prioritized, actionable issues for search optimization.

Classify software dependency licenses and flag packages that need commercial or legal review.

Probe a public endpoint without paying, grade its x402 v2 challenge, check exact-host x402-list presence and traction, and optionally rank licensed market matches with buyer-concentration caveats.

Search one organization independently across official GLEIF legal-entity, USAspending prime-contract, SEC filing-activity, and OFAC Entity records, returning bounded evidence and source-specific coverage without asserting identity, linkage, risk, or compliance.

Run a comprehensive website audit combining SEO, security, accessibility, and performance scores with prioritized fixes.

Retrieve recent SEC Form 4 officer, director, and 10% beneficial-owner trades for a ticker or CIK, including purchases, sales, awards, exercises, tax withholding, prices, holdings, 10b5-1 context, derivatives, and filing footnotes.

Validate and audit an OpenAPI document for missing operation IDs, descriptions, responses, and consistency problems.

Audit exact Python/PyPI, npm, Go, Maven, NuGet, crates.io, or RubyGems dependencies against OSV and return affected packages and vulnerabilities.

Compare JSON or YAML deterministically and return source hashes plus machine-readable additions, removals, and replacements by path with explicit truncation evidence.

Extract clean text and metadata from supplied PDF, DOCX, HTML, Markdown, CSV, JSON, YAML, or plain-text documents.

Normalize caller-supplied CSV, TSV, JSON, JSON Lines, or YAML to deterministic JSON, infer a Draft 2020-12 schema from that normalized value, and validate one future JSON value in a single x402 call.

Search public USAspending prime federal procurement awards by recipient company or organization name, UEI, or legacy DUNS, returning bounded contract values, agencies, performance dates, descriptions, official award links, and explicit interpretation limits.

Scan a public website for TLS and browser security header weaknesses and return a security score with fixes.

Compare caller-supplied before and after source snapshots without execution or network access, returning source fingerprints, syntax regressions, structural deltas, function-level changes, and bounded review findings.

Investigate a domain using parallel DNS, TLS certificate, RDAP (the standards-based successor to WHOIS), DNSSEC, SPF, and DMARC signals with factual findings and source provenance.

Measure caller-supplied source code with Python AST analysis or a deterministic lexical fallback, including per-function complexity, a SHA-256 fingerprint, density ratios, syntax status, and actionable maintainability signals without retaining or forwarding the code.

Search newest U.S. Federal Register document metadata by topic, agency, type, and publication date, returning bounded regulatory notices, rules, proposed rules, presidential documents, and links to FederalRegister.gov and official govinfo.gov PDFs.