tech risk changelog

https://x402-data-api.sigrunner.workers.dev/llms.txt

− - POST https://x402-data-api.sigrunner.workers.dev/v1/chat/completions — $0.002 — OpenAI-compatible chat (Llama 3.3 70B, stream:true supported), no API key; point any OpenAI SDK base URL here with an x402 fetch wrapper. Free real-model try: POST https://x402-data-api.sigrunner.workers.dev/v1/chat/completions/preview (3/day/IP). Model list: GET https://x402-data-api.sigrunner.workers.dev/v1/models. Runnable buyer: https://github.com/rezearcher/x402-data-api/blob/main/examples/llm-chat.mjs — best − - GET https://x402-data-api.sigrunner.workers.dev/chain/fee-estimate — $0.002 — Base EIP-1559 fee tiers (slow/standard/fast) + transfer cost.− - GET https://x402-data-api.sigrunner.workers.dev/chain/network-status — $0.002 — Base chain id, latest block, block age, gas utilisation.− - GET https://x402-data-api.sigrunner.workers.dev/chain/l1-base-fee — $0.002 — Ethereum L1 base fee seen by Base's GasPriceOracle + L1 data-fee estimate.− - GET https://x402-data-api.sigrunner.workers.dev/chain/fee-history — $0.002 — Base base-fee history over the last 10 blocks with gas-used ratios.− - GET https://x402-data-api.sigrunner.workers.dev/defi/chains-tvl — $0.003 — Top chains by DeFi TVL.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/stablecoins — $0.003 — Top stablecoins by supply + peg price.− - GET https://x402-data-api.sigrunner.workers.dev/defi/protocols-top — $0.003 — Top DeFi protocols by TVL.− - GET https://x402-data-api.sigrunner.workers.dev/defi/dex-volume — $0.003 — Top DEXs by 24h volume.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/trending — $0.003 — Trending coins on CoinGecko right now.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/global — $0.002 — Global crypto market cap, volume, BTC/ETH dominance.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/markets-top — $0.003 — Top coins by market cap with price and 24h change.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/movers — $0.003 — Top 24h gainers and losers.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/exchanges-top — $0.003 — Top exchanges by trust score and volume.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/categories — $0.003 — Crypto sector market cap and 24h change.− - GET https://x402-data-api.sigrunner.workers.dev/defi/hacks-recent — $0.003 — Most recent DeFi hacks and exploits with amounts.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/derivatives-exchanges — $0.003 — Top derivatives exchanges by open interest and volume.− - GET https://x402-data-api.sigrunner.workers.dev/defi/yields-top — $0.003 — Top DeFi yield pools by TVL with APY.− - GET https://x402-data-api.sigrunner.workers.dev/ai/classify?text=<…>&labels=a,b,c — $0.003 — Zero-shot classification into one of your labels.− - GET https://x402-data-api.sigrunner.workers.dev/ai/summarize?text=<…> — $0.003 — 1-3 sentence summary of a passage.− - GET https://x402-data-api.sigrunner.workers.dev/ai/translate?text=<…>&to=es — $0.003 — Translate text into a target language.− - GET https://x402-data-api.sigrunner.workers.dev/chain/blob-base-fee — $0.002 — Base EIP-4844 blob base fee (wei/gwei) from the GasPriceOracle.+ Hold USDC on another chain? The live 402 offers native USDC on Base, Polygon, Arbitrum (Base is accepts[0]; same payTo, same price) — pick whichever your wallet funds, your x402 client selects it automatically. Calling many routes in a loop and don't want a signature per call? Open a prepaid session cap ONCE over x402 — /x402/session ($0.05 cap), /x402/session/plus ($0.50 cap), /x402/session/max ($5.00 cap) — then pass the returned token as `Authorization: Bearer <token>` (or `X-Session-Token`) + - Any agent (Claude Code, Cursor, 79+ frameworks) — keyless skill, no login, no npm (Agent skill (SKILL.md)): `npx skills add rezearcher/x402-defi-data` — 4 tools wrapping /defi/yields, /defi/yield-entry-verdict, /crypto/funding, /crypto/prices. https://github.com/rezearcher/x402-defi-data+ - POST https://x402-data-api.sigrunner.workers.dev/v1/chat/completions — $0.004 — OpenAI-compatible chat (Llama 3.3 70B, stream:true supported), no API key; point any OpenAI SDK base URL here with an x402 fetch wrapper. Free real-model try: POST https://x402-data-api.sigrunner.workers.dev/v1/chat/completions/preview (3/day/IP). Model list: GET https://x402-data-api.sigrunner.workers.dev/v1/models. Runnable buyer: https://github.com/rezearcher/x402-data-api/blob/main/examples/llm-chat.mjs — best + - GET https://x402-data-api.sigrunner.workers.dev/chain/fee-estimate — $0.004 — Base EIP-1559 fee tiers (slow/standard/fast) + transfer cost.+ - GET https://x402-data-api.sigrunner.workers.dev/chain/network-status — $0.004 — Base chain id, latest block, block age, gas utilisation.+ - GET https://x402-data-api.sigrunner.workers.dev/chain/l1-base-fee — $0.004 — Ethereum L1 base fee seen by Base's GasPriceOracle + L1 data-fee estimate.+ - GET https://x402-data-api.sigrunner.workers.dev/chain/fee-history — $0.004 — Base base-fee history over the last 10 blocks with gas-used ratios.+ - GET https://x402-data-api.sigrunner.workers.dev/defi/chains-tvl — $0.004 — Top chains by DeFi TVL.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/stablecoins — $0.004 — Top stablecoins by supply + peg price.+ - GET https://x402-data-api.sigrunner.workers.dev/defi/protocols-top — $0.004 — Top DeFi protocols by TVL.+ - GET https://x402-data-api.sigrunner.workers.dev/defi/dex-volume — $0.004 — Top DEXs by 24h volume.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/trending — $0.004 — Trending coins on CoinGecko right now.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/global — $0.004 — Global crypto market cap, volume, BTC/ETH dominance.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/markets-top — $0.004 — Top coins by market cap with price and 24h change.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/movers — $0.004 — Top 24h gainers and losers.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/exchanges-top — $0.004 — Top exchanges by trust score and volume.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/categories — $0.004 — Crypto sector market cap and 24h change.+ - GET https://x402-data-api.sigrunner.workers.dev/defi/hacks-recent — $0.004 — Most recent DeFi hacks and exploits with amounts.+ - GET https://x402-data-api.sigrunner.workers.dev/crypto/derivatives-exchanges — $0.004 — Top derivatives exchanges by open interest and volume.+ - GET https://x402-data-api.sigrunner.workers.dev/defi/yields-top — $0.004 — Top DeFi yield pools by TVL with APY.+ - GET https://x402-data-api.sigrunner.workers.dev/ai/classify?text=<…>&labels=a,b,c — $0.004 — Zero-shot classification into one of your labels.+ - GET https://x402-data-api.sigrunner.workers.dev/ai/summarize?text=<…> — $0.004 — 1-3 sentence summary of a passage.+ - GET https://x402-data-api.sigrunner.workers.dev/ai/translate?text=<…>&to=es — $0.004 — Translate text into a target language.+ - GET https://x402-data-api.sigrunner.workers.dev/chain/blob-base-fee — $0.004 — Base EIP-4844 blob base fee (wei/gwei) from the GasPriceOracle.

• + yield_entry_verdict
• + simulate
• + yield_entry_verdict_preview
• + simulate_preview
• + chain_wallet_screen
• + x402_preflight
• + x402_receipt_verify
• + x402_receipt_verify_preview

description

Scan any MCP server for tool-poisoning/prompt-injection/exfiltration (OWASP LLM01/08) + Base data → MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable

package_identifier

— → greyridge-x402-tools

package_registry

— → pypi

version

1.3.0 → 1.4.0

website_url

https://api.greyridgesignals.ai → https://x402-data-api.sigrunner.workers.dev/x402/preflight

https://x402-data-api.sigrunner.workers.dev/llms.txt

− # Grey Ridge Signals — x402 Data & Security APIs− > Agent-native, pay-per-call data on Base (USDC via x402). No account, no API key — agents pay inline.− > Landing page: https://x402-data-api.sigrunner.workers.dev/  |  Discovery: https://x402-data-api.sigrunner.workers.dev/.well-known/x402  |  OpenAPI: https://x402-data-api.sigrunner.workers.dev/openapi.json  |  Listed on the Coinbase CDP x402 Bazaar.− ## How to pay− Each paid GET returns HTTP 402 with an x402 v2 payment-required challenge (network eip155:8453 / Base, asset USDC).− Sign and retry per the x402 spec (https://x402.org). Settlement ~1s. No signup.− - GET https://x402-data-api.sigrunner.workers.dev/crypto/prices?coins=bitcoin,ethereum,solana — $0.004 — spot token prices + change_24h (DefiLlama), keyless.− - GET https://x402-data-api.sigrunner.workers.dev/scan/mcp?url=<mcp-server> — $0.10 — security audit of an MCP server (tool-poisoning / prompt-injection, OWASP LLM01/LLM08); findings + risk score + verdict (clear/review/block).− - GET https://x402-data-api.sigrunner.workers.dev/enrich/tech-risk?domain=<domain> — $0.05 — tech-stack -> CVE (NVD) + EPSS + CISA-KEV risk + verdict (clear/review/block).− - GET https://x402-data-api.sigrunner.workers.dev/chain/block-number — $0.001 — current Base mainnet block number.− - GET https://x402-data-api.sigrunner.workers.dev/chain/gas-price — $0.001 — current Base mainnet gas price (wei/gwei), EIP-1559 base_fee_gwei/priority_fee_gwei, gas_price_usd — no price oracle on ETH-only competitors.− - GET https://x402-data-api.sigrunner.workers.dev/chain/balance?address=<0x…> — $0.001 — ETH balance of a Base address, incl. balance_usd.− - GET https://x402-data-api.sigrunner.workers.dev/chain/token-balance?address=<0x…>&token=<0x…> — $0.001 — ERC-20 token balance of a Base address, incl. symbol/decimals/balance_formatted.− - GET https://x402-data-api.sigrunner.workers.dev/chain/tx?hash=<0x…> — $0.001 — transaction details by hash on Base.− - GET https://x402-data-api.sigrunner.workers.dev/chain/receipt?hash=<0x…> — $0.001 — transaction receipt by hash on Base: status, gas used, full logs, L1 fee breakdown (l1_fee_wei/l1_gas_price_wei/l1_gas_used/effective_gas_price_wei) + l1_fee_usd/total_fee_usd.− - GET https://x402-data-api.sigrunner.workers.dev/chain/code?address=<0x…> — $0.001 — contract-code check for a Base address (EIP-7702 delegated-EOA aware).− - GET https://x402-data-api.sigrunner.workers.dev/chain/token-security?token=<0x…> — $0.02 — token security / honeypot detector: EIP-1967/1822 proxy + upgradeability detection, bytecode scan for mint/pause/blacklist/fee-setter/ownership selectors, owner() renouncement check, live eth_call state-override transfer simulation — risk_score + verdict (clear/review/block) + flags. Real compute, not a thin data wrapper.+ # Grey Ridge Signals — MCP security scanning & on-chain data APIs+ > Two ways to use us. HUMANS & TEAMS: scan any MCP server for prompt-injection / tool-poisoning (OWASP LLM01/LLM08) in your browser — free, read-only — and subscribe by card ($9.99/mo) to gate CI and get continuous re-scans. No wallet, no crypto. AGENTS: the same endpoints are agent-native, pay-per-call on Base (USDC via x402) — no account, no API key, pay inline.+ > Scan a server (free): https://x402-data-api.sigrunner.workers.dev/scan/mcp-scanner  |  Subscribe (card): https://x402-data-api.sigrunner.workers.dev/pricing  |  Landing: https://x402-data-api.sigrunner.workers.dev/  |  Agent discovery: https://x402-data-api.sigrunner.workers.dev/.well-known/x402  |  OpenAPI: https://x402-data-api.sigrunner.workers.dev/openapi.json+ ## For humans & teams — scan your MCP server, pay by card (no wallet)+ If you build, ship, or operate MCP servers and tools, this is the fast path — no crypto required.+ - Scan free, in your browser: https://x402-data-api.sigrunner.workers.dev/scan/mcp-scanner — paste your server's `tools/list` (private/local servers never leave your side) or scan a public server by URL. Instant verdict: clear | review | block, with the exact injected text and which tool carries it.+ - Per-server trust report (shareable, crawlable): https://x402-data-api.sigrunner.workers.dev/scan/report?url=<your-mcp-server> — point-in-time injection verdict plus a live manifest-drift read, one page.+ - Subscribe by card — $9.99/mo: https://x402-data-api.sigrunner.workers.dev/pricing. Gives you an API key for 100 scans/month across any Grey Ridge endpoint, so you can gate your CI (fail the build on `block`) and re-scan continuously. Card only — no wallet, no USDC, no on-chain anything. Checkout is Stripe; your key is shown on the success page and at https://x402-data-api.sigrunner.workers.dev/api-key.+ - CI gate (GitHub Action): `uses: rezearcher/x402-data-api/actions/mcp-scan@main` — runs the scan on every push and fails the build on a `block` verdict.+ - Why this and not a free token checker: token-safety has free multi-chain scanners; MCP tool-poisoning / prompt-injection detection does not. This is the differentiated, paid-worthy lane.+ ## For security & platform teams — hands-on assessments (engagement, not per-call)+ When a static scan isn't enough — a live agent deployment, permission and auth boundaries, secret handling, on-chain approval and slippage exposure — Grey Ridge Signals runs scoped security assessments.+ - Service page: https://x402-data-api.sigrunner.workers.dev/security-assessment — fixed-scope assessment of MCP servers, agents, or on-chain integrations ($7,500–$15,000 per engagement) and continuous monitoring retainers ($3,000–$5,000/mo).+ - What it covers: tool poisoning and prompt injection (OWASP LLM01), excessive agency and over-scoped tools (LLM08), data exfiltration, cross-tool shadowing, invisible-unicode / variation-selector smuggling, ANSI and CSS covert channels, auth and secret handling, on-chain approval exposure — static plus live behavioural testing and manual review.+ - Deliverable: a severity-scored findings report with reproduction and remediation, an executive summary, and a free re-test after fixes ship.+ - Authorized testing only: we test solely the assets you own or explicitly authorize. Scope and authorization are fixed at a scoping call before anything is tested.+ - Start: contact@greyridgesignals.ai or the intake form at https://x402-data-api.sigrunner.workers.dev/security-assessment. Payment is by invoice, not crypto.+ ## How to pay — first paid call in ~8 lines (copy-paste, verified)+ Each paid GET returns HTTP 402 with an x402 v2 challenge (network eip155:8453 / Base, asset USDC, 6 decimals). The standard x402-fetch client signs + retries for you — no account, no API key. Your wallet needs a little USDC on Base; no gas ETH (the exact scheme is EIP-3009 gasless — the facilitator submits). The 2nd arg to wrapFetchWithPayment is a viem WalletClient, not a bare account.+   npm i x402-fetch viem+   import { createWalletClient, http } from "viem";+   import { privateKeyToAccount } from "viem/accounts";+   import { base } from "viem/chains";+   import { wrapFetchWithPayment } from "x402-fetch";+   const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY);+   const walletClient = createWalletClient({ account, chain: base, transport: http() });+   const pay = wrapFetchWithPayment(fetch, walletClient);+   const r = await pay("https://x402-data-api.sigrunner.workers.dev/gate/swap?token=0x4200000000000000000000000000000000000006&side=buy&notional_usd=500");+   console.log(await r.json());   // GO | HOLD | BLOCK — settles in ~1s, costs $0.008 USDC+ Runnable version: https://github.com/rezearcher/x402-data-api/blob/main/examples/buyer.mjs (EVM_PRIVATE_KEY=0x... node examples/buyer.mjs). Python / Axios clients + full docs: https://x402.org buyer quickstart. Prefer to look before you pay? Every flagship route has a free, no-wallet /preview (same response shape) — see the Free section below.+ Already run a generic x402 buyer adapter? This API is wire-compatible with OpenAPI-driven x402 MCP clients: our /openapi.json tags every billable route with x-billable/x-availability/x-price-usdc and honors ?preview=true on the paid path, and /.well-known/agent-capabilities.json?q=&limit=N returns ranked products whose operation_id resolves straight back to the OpenAPI operation. e.g. point the npm MCP adapter dopaminedesk-ai-data-marketplace-mcp at us with one env var — MARKETPLACE_URL=https://+ ## Start here — two flagships (what agents actually pay us for)+ ### 1. MCP server security scan — prompt-injection / tool-poisoning audit (unique; no free equivalent)+ Before your agent trusts an MCP server's tools, scan them for hidden-instruction / tool-poisoning attacks (OWASP LLM01/LLM08). Zero-egress by design: for private or OAuth-gated servers you POST only the tools/list JSON — nothing else leaves your side. Unlike token-safety (where free multi-chain scanners exist), there is no free equivalent for this.+ - POST https://x402-data-api.sigrunner.workers.dev/scan/mcp — $0.05 — itemized findings (which tool, the injected text, remediation) + risk score + verdict clear|review|block. Body: {"tools":[…]} from your server's tools/list (or GET ?url=<public-mcp-server>).+ - Free preview: POST https://x402-data-api.sigrunner.workers.dev/scan/mcp/preview with {"tools":[…]} → counts + severity + risk score + verdict (detail withheld). One-liner that pulls an auth'd server's tools/list over Streamable-HTTP: https://github.com/rezearcher/x402-data-api/blob/main/examples/mcp-scan-preview.sh+ - CI gate: uses: rezearcher/x402-data-api/actions/mcp-scan@main — runs the scan in CI and fails the build on a block verdict.+ ### 2. Pre-trade decision gate for Base trading agents — a decision, not raw flags+ Raw honeypot-flag APIs make your agent interpret the flags; this returns ONE decision sized to YOUR trade. Base-native (Base ERC-20s) — if you trade other chains, keep your multi-chain scanner and use this where you're on Base.+ - GET https://x402-data-api.sigrunner.workers.dev/gate/swap?token=<0x…>&side=buy&notional_usd=500 — $0.008 — GO|HOLD|BLOCK (honeypot/sellability + liquidity price impact vs your trade size). Free try: https://x402-data-api.sigrunner.workers.dev/gate/swap/preview?token=usdc|weth|cbbtc|aero|degen (any real Base 0x address: 3 free/day/IP).

Showing the first 40 of each.

• + chain_token_report
• + gate_swap
• + gate_swap_preview
• + chain_token_report_preview

description

x402 MCP for agents: crypto prices, funding, DeFi yields, Polymarket, Base RPC + MCP security. → Scan any MCP server for tool-poisoning/prompt-injection/exfiltration (OWASP LLM01/08) + Base data

repository_url

— → https://github.com/rezearcher/x402-data-api

version

1.2.0 → 1.3.0

website_url

https://x402-data-api.sigrunner.workers.dev → https://api.greyridgesignals.ai