614 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Read actual wallet balances for up to twenty supplied token addresses on one chain and prioritize their stored ChainK9 scan verdicts. Includes scan age/staleness and missing reports. Does not discover wallet assets, run...
On-chain contract risk score: detects upgradeable proxies and privileged functions from live bytecode. Use before trading/interacting with an unfamiliar contract.
Static security scan of an MCP manifest or tool list. Detects tool poisoning, hidden unicode instructions, prompt injection, data-exfiltration directives, dangerous capabilities, tool shadowing and post-approval rug-pull...
Vulnerability intelligence for a single CVE id. Fuses NVD (CVSS base score and vector, CWE, patch links), CISA KEV known-exploited status, EPSS exploitation probability and OSV.dev affected and fixed versions into one ci...
Pre-sign safety verdict for a raw EVM transaction. Decodes the calldata against a known-signature registry, shows known-pattern effects (approval delta, transfer target), dry-runs eth_call for revert, checks scam-blockli...
All institutional holders of one security in a quarter, by ticker or CUSIP, with concentration and quarter-over-quarter institutional flow. This reverse index is deferred on this deployment and returns availability statu...
Bridge exploit track record: for one bridge, its hack history (incidents, total USD lost, funds returned, worst technique); with no bridge, a ranked leaderboard of every bridge hack by USD lost. Sourced from DefiLlama's...
Install-safety preflight for one dependency BEFORE pip install / npm i. Returns a safe / caution / block verdict fusing existence, OSV malware flags, typosquat distance to a popular package, a known-hallucination corpus,...
Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-ent...
Static secret scan of a unified git-diff, scoring ONLY added lines. The low-false-positive pre-commit mode: a secret already present in unchanged or removed code is ignored, only newly introduced credentials are flagged....
Static misconfiguration scan of an infrastructure-as-code config: Terraform (plan JSON or HCL), Kubernetes / Helm, Dockerfile, docker-compose or CloudFormation. Detects public storage, open security groups, unencrypted d...
Static misconfiguration scan of a SINGLE infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose or CloudFormation). The lightweight per-resource form of /iac/scan: returns a verdict...
Static application-security scan of source code or a git-diff for CWE Top-25 logic bugs: SQL injection, XSS, command injection, code and template injection, SSRF, path traversal, insecure deserialization, weak crypto, in...
Static application-security scan of a single code blob for CWE Top-25 logic bugs (SQL injection, XSS, command injection, SSRF, path traversal, insecure deserialization, weak crypto and more). Pass the code and its langua...
Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissi...
Static security scan of a SINGLE CI/CD job or step snippet (GitHub Actions, GitLab CI or CircleCI). The lightweight per-object form of /ci/scan: returns a verdict (pass, caution, block), a risk score and findings with ru...
Standing-state audit of a wallet's live ERC-20 token approvals. Indexes every approval the address ever granted, filters to those still live on-chain, flags unlimited, stale, scam-listed and canonical spenders, estimates...
Standing-state audit of a wallet's live NFT operator approvals. Indexes every ApprovalForAll the address granted, filters to operators still live on-chain via isApprovedForAll, flags scam-listed, stale and canonical oper...
One merge-safety verdict for a public GitHub pull request. Fetches the PR diff and runs it through code, secret, CI/CD pipeline and dependency scanners, returning a single verdict (pass, caution, block), a risk score and...
Use when you only need a go/no-go before trading a Solana token, at the lowest price: SAFE/CAUTION/DANGER, 0-100 risk score and flags for one mint, read from chain state. Skip DANGER, reduce size on CAUTION. Query: ?addr...
Audit a public HTTPS x402 API without payment: HTTP 402 challenge metadata, Bazaar and well-known discovery, OpenAPI 3.1 operation schemas and payment declarations, redirects, latency, and security headers.
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...
DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, p...
HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HST...