Due diligence an agent can run itself
An agent that pays strangers per call needs a way to tell a working service from a listing. Directories show what a seller claims; the chain shows who actually paid it.
/v1/trust-check probes the live 402 of any x402 origin, reads the USDC that really flowed to its payTo address on Base, counts the payers and flags the share that is the operator paying itself. It returns green, yellow or red with the reasons and the window it could read.
The other two look at a domain rather than a seller: a graded security posture (certificate, redirect and headers, SPF and DMARC, CAA, DNSSEC, registration) and whether the domain or an address appears in known leaks and infostealer logs. Exposure results are aggregates only — never passwords, devices or records.
Endpoints (9)
| Method | Path | What you get | USDC | Status |
|---|---|---|---|---|
POST | /v1/trust-check | x402 seller trust check before you pay: probes the live 402, reads USDC inflow to payTo on Base, counts payers and flags self-dealing (operator paying itself) - verdict green/yellow/red with reasons and the window it could read | 0.05 | |
POST | /v1/exposure-check | Leak and infostealer exposure of a domain: employee and user credentials seen in stealer logs (with last-seen dates and malware families), leak records mentioning the domain, and official breaches - aggregates only, never passwords or personal records | 0.03 | |
POST | /v1/exposure-check-email | Leak and infostealer exposure of one e-mail address: infections that saved it (count, first/last seen, corporate vs user services), leak records and sources - aggregates only, never passwords, logins, devices or IPs; the address is echoed only as SHA-256. For addresses you own or are authorised to check | 0.05 | |
POST | /v1/domain-security-check | Security posture of a domain in one call: TLS certificate (issuer, expiry, trust), HTTPS redirect and security headers (HSTS, CSP, nosniff), mail authentication (SPF, DMARC), CAA, DNSSEC, registration status and expiry (RDAP), plus leak/infostealer exposure - graded A-F with prioritised findings | 0.05 | |
POST | /chain/v1/chain-state | Wallet/contract state on 5 EVM chains: native balance, nonce, EOA/contract, ERC-20 balances (paid) | 0.05 | |
POST | /chain/v1/chain-call | Read-only EVM contract call with decoded revert reason and optional gas estimate (paid) | 0.02 | |
GET | /v1/conformance | Read published x402 conformance reports: does a seller refuse invalid payments? (free) | free | |
GET | /v1/conformance/prose | Read evidence-bound summaries of completed conformance runs | free | |
GET | /chain/v1/chain-info | Supported chains, limits and prices of the on-chain data lane (free) | free |
Calling it
An unpaid request returns HTTP 402 with the price and payment details. Use an x402 client for the first purchase. Before a manual transfer, check the JSON request and wallet proof contract in /openapi.json. Private result retrieval requires a fresh wallet proof; an unavailable result goes to support without another order or payment.
curl -i -X POST https://agent.connskill.com/v1/trust-check \
-H 'Content-Type: application/json' \
-d '{"origin":"some-x402-service.example"}'One free sample per endpoint per day: add the header x-free-sample: 1 on any endpoint priced 0.15 USDC or less.
Through MCP
claude mcp add --transport http connskill https://agent.connskill.com/mcp
npx -y @connskill/mcp-growth-services # local, pays for you with X402_WALLET_KEYThe rest of the catalogue
SEO data · Numbers & inboxes · EU LLM · Website analytics · Marketplace & board · Social marketing
Full price table: /pricing · machine-readable: /openapi.json, /.well-known/x402, /llms.txt