llms.txt
+35 −4
https://api.powerstripsecurity.workers.dev/llms.txt
− > We've got your agent's back. Safe reading for AI agents: read a URL, or scan content you already have, for prompt injection. Strips hidden text, invisible characters and data-exfiltration links, flags instruction-override phrases in 13 languages, and returns the clean text wrapped as untrusted data. Deterministic, pay-per-call with x402 (USDC on Base). Your content is scanned in memory and never stored. Detection rates are published, measured on a held-out test set. Failed requests are never c− Both are paid per call in USDC on Base (eip155:8453) with x402 v2 (scheme "exact"). No account, no API key.− - Not charged when the page cannot be read: robots.txt disallows it, the site blocks it (login, CAPTCHA, 403, 429), it needs JavaScript, it is not HTML or text, or it is over 5 MB. Those return 422 with a reason.− For Claude Desktop, Claude Code, Cursor and other MCP clients: "npx -y power-strip-security-mcp" (https://www.npmjs.com/package/power-strip-security-mcp) with PSS_PRIVATE_KEY (a dedicated wallet with a little USDC on Base) and PSS_MAX_SPEND_USD (spending cap, default 1). Tools: read_url, scan_content.+ > We've got your agent's back. Safe reading for AI agents: read a URL, or scan content you already have, for prompt injection, audit MCP servers for tool poisoning before you connect, and audit agent skills (SKILL.md, AGENTS.md) before you install them. Strips hidden text, invisible characters and data-exfiltration links, flags instruction-override phrases in 13 languages, and returns the clean text wrapped as untrusted data. No LLM in the loop: HTML parsing and rules, so the same input always g+ Try it first, without a wallet: POST https://api.powerstripsecurity.workers.dev/v1/try with {"content": string, "format"?: "html"|"text"} (up to 8,000 characters, about 6 calls a minute per IP). Same response as /v1/scan, plus "free_try": true. Over MCP, check_prompt_injection called without payment does the same.+ The four endpoints below are paid per call in USDC on Base (eip155:8453) with x402 v2 (scheme "exact"). No account, no API key.+ First 10 calls per new wallet are on us (wallets that have never paid). Your agent still signs a normal x402 payment (the wallet needs the funds), but it is not settled. The response carries a free-call: N/10 header.+ - PDFs too (up to 200 pages): the text of every page, with text in tiny fonts (under 2 pt, the trick used in resumes and papers to hide instructions) removed and reported as tiny_text. The response adds "content_type": "pdf" and "pages". White-on-white text in a PDF is not detected.+ - Not charged when the page cannot be read: robots.txt disallows it, the site blocks it (login, CAPTCHA, 403, 429), it needs JavaScript, it is not HTML, text or PDF, the PDF is scanned (no text) or password protected, or it is over 5 MB. Those return 422 with a reason.+ ### POST https://api.powerstripsecurity.workers.dev/v1/mcp-audit — $0.01+ - Check an MCP server before your agent connects to it (tool poisoning, rug pulls). Read-only: it never calls a tool.+ - Body (JSON): {"url": "https://mcp.example.com/mcp"} for a remote Streamable HTTP server, or a pasted tools/list result {"tools": [...], "instructions"?, "prompts"?, "resources"?} for local or private ones. Optional "pinned": {"tool_name": "fingerprint"} from an earlier audit.+ - Scans server instructions, tool descriptions and titles, every string in the input schemas, prompts and resources: hidden instruction tags, secrecy and concealment, cross-tool shadowing, sensitive-file access (~/.ssh, mcp.json, wallets), data-collection and exfiltration parameters, pre-call hooks, base64 blobs, invisible characters and prompt-injection phrases.+ - Response: {"level": "none"|"low"|"medium"|"high", "findings": [{"type", "severity", "location", "snippet"}], "tools": [{"name", "level", "fingerprint", "parameters"}], "changes"?: {"changed", "added", "removed"}}.+ - Store the fingerprints and send them back as "pinned" next time: a tool that changed after you approved it is reported as "tool-changed" (high).+ - Not charged when the server cannot be audited (needs authentication, robots.txt, unreachable, not MCP). No credentials are ever sent: for a private server, paste its tools/list.+ ### POST https://api.powerstripsecurity.workers.dev/v1/skill-audit — $0.005+ - Check an agent skill (a SKILL.md folder with its scripts and references) or an instruction file (AGENTS.md, CLAUDE.md, .cursorrules, copilot-instructions.md) before an agent loads it. Cheap enough to run on every pull request.+ - Body (JSON): {"files": [{"path": "SKILL.md", "content": "..."}, ...]} (max 50 files, 256 KB in total) or {"url": "https://raw.githubusercontent.com/.../SKILL.md"} for one public text file. Optional "pinned": {"path": "fingerprint"} from an earlier audit.+ - Rules, after Snyk's ToxicSkills study: prompt injection, curl | bash and other remote execution, base64 and encoded commands, suspicious downloads and password-protected archives, credential access (~/.ssh, ~/.aws, browser cookies, wallets), exfiltration (sending files or the environment out, webhook drop points), hardcoded keys (masked in the response), remote instructions, persistence (cron, shell profiles, CLAUDE.md), disabling protections, crypto-wallet access, broad allowed-tools, binarie+ - Response: {"level": "none"|"low"|"medium"|"high", "findings": [{"type", "severity", "file", "line", "snippet", "note"?}], "files": [{"path", "kind", "level", "fingerprint"}], "skill": {"name", "description", "spec_valid", "allowed_tools"}, "changes"?}.+ - Calibrated on 643 installed skills from public marketplaces: none rated high. Commands inside code blocks count (agents run them); a well-known installer piped to a shell (brew, rustup, docker…) is medium, not high.+ - Not charged when the URL cannot be read. Nothing is executed and nothing is stored.+ ### GET or POST https://api.powerstripsecurity.workers.dev/v1/payment-check — $0.001+ - For x402 monitors, raters and directories: the cheapest way to verify that this service really settles payments, end to end, without paying for a scan.+ - No body needed. Response: {"ok": true, "check": "payment", "price_usd": 0.001, ...}, with the settlement (transaction, network, payer) in the PAYMENT-RESPONSE header.+ - Never uses the free calls and does not take credit keys: it always settles a real x402 payment.+ Pay on the first request (no 402 round trip): read the requirements once (one unpaid call, or the PAYMENT-REQUIRED header you already got), keep them, and send a fresh PAYMENT-SIGNATURE with each call. If a call still gets 402 (price changed, or settlement failed), nothing was charged: read the new header and sign again.+ ## Credit packs+ Credit packs: one x402 payment buys a key with prepaid balance in USD, valid 365 days, for any endpoint and any mix. POST /v1/credits/starter ($1 → $1.50 of calls), /v1/credits/combo ($3 → $5) or /v1/credits/pro ($10 → $15). Then send Authorization: Bearer <key> instead of paying per call: no per-call signature or settlement, so calls are faster. Each response carries credit-balance. GET /v1/credits shows the balance. The key is shown once and cannot be recovered. Packs never use the free calls.+ - POST /v1/credits/{pack} (pack = starter | combo | pro), paid with x402 → {"credit_key": "pss_…", "pack", "balance_usd", "expires_at", "note"}. The key is only active once the payment settles.+ - @x402/fetch and @x402/axios cap each payment at $1 by default (spendControls). To buy combo or pro, raise it for that call: spendControls: { maxAmountPerPayment: "$3" } or "$10".+ - Any endpoint with "Authorization: Bearer pss_…" → normal response plus a credit-balance header (USD). Failed calls (4xx/5xx) give the balance back.+ - Errors: 401 invalid-credit-key; 402 credit-exhausted or credit-expired (problem+json, no PAYMENT-REQUIRED header: buy a pack or drop the Authorization header to pay per call); 429 too-many-invalid-keys (repeated invalid keys from one IP); 503 credits-unavailable (nothing charged).+ - The key is an opaque secret, like a password: keep it out of URLs, logs and prompts. Only the server can issue valid keys; guessed or altered keys are rejected and rate-limited.+ - GET /v1/credits with the same header → {"pack", "balance_usd", "expires_at"}. Free.+ Remote, no install: https://api.powerstripsecurity.workers.dev/mcp (Streamable HTTP, stateless, JSON responses). Tools: read_url, check_prompt_injection, audit_mcp_server, audit_agent_skill. Listing tools is free, and so is check_prompt_injection on short text called without payment (the free try above); every other call is paid with x402 over MCP (x402 spec, transports-v2/mcp): an unpaid call returns isError with the PaymentRequired object in structuredContent; retry with the PaymentPayload in + Local, for Claude Desktop, Claude Code, Cursor and other MCP clients: "npx -y power-strip-security-mcp" (https://www.npmjs.com/package/power-strip-security-mcp), listed in the official MCP registry as io.github.AlbertBalestrini/power-strip-security, with PSS_PRIVATE_KEY (a dedicated wallet with a little USDC on Base) and PSS_MAX_SPEND_USD (spending cap, default 1). Same four tools as the remote server (version 0.2.0 or later).