Bot Bazaar

Profile a Base wallet before paying or trusting it: first funder and first-seen time (wallet age), outgoing tx count, contract or EOA, an OFAC SDN address screen, and whether it is a Bot Bazaar seller payout wallet. No balances.

Did a USDC payment land on Base? Give a transaction hash; get success or reverted, block number and time, confirmations, the tx sender/recipient, and every Base USDC Transfer in it (from, to, amount). Read from Base RPC; final receipts are cached.

Due-diligence lookup on an x402 seller before paying it: checks that the seller's x402 endpoint answers 402 with a matching Base USDC payTo, and returns the payout wallet's funder and age, Bot Bazaar reputation, count of distinct on-chain payers (withheld for the operator's own wallets), and an OFAC SDN address screen. Query by payTo wallet or endpoint URL.

Check an x402 endpoint without paying it: one unpaid GET, then whether it returns a valid 402, x402 v1/v2 support, each payment option (network, asset, price, payTo, timeout, EIP-3009 domain), latency, and resource/Bazaar-metadata quality checks.

Check a domain's agent and x402 discovery readiness: probes /.well-known/x402, /llms.txt, and /mcp over HTTPS and reports status codes, latency, discovered x402 resource count, whether /llms.txt is present, and whether /mcp is detected.

Downloadable cleaned JSON + CSV dataset of verified Base USDC x402 endpoints and MCP servers (category, service_name, url, method, price_usdc, network, asset, pay_to, has_bazaar_schema, mcp_endpoint, last_verified). Excludes operator/house financial figures.

Lint an x402 endpoint URL for Coinbase CDP Bazaar discovery readiness without paying it: checks HTTP 402, x402 v2 PAYMENT-REQUIRED header, Base USDC option, >=1000 atomic minimum, EIP-3009 extra.name/version, and extensions.bazaar schema.

Self-serve CPSC eFiling (16 CFR 1110 7-element CPC/GCC bulk-upload CSV template + ACE Reference PGA broker sheet) & EU GPSR (Regulation (EU) 2023/988 Articles 9/16/19 Amazon Manage Your Compliance CSV + checklist) SKU compliance template pack (.zip + JSON). Also available at alias /v1/x402/sku-compliance-templates. Templates and schema linting only — not legal advice.

Validate a CPSC CPC/GCC certificate row or CSV against all 7 statutory elements under 16 CFR 1110 / CPSA Section 14(a) eFiling (product ID, safety rule citations, US importer/manufacturer certifier, records custodian contact, manufacture date/place, test date/place, and CPSC-accepted third-party lab or determination). Supports GET query params and POST JSON/CSV. Templates & schema linting only — n

Trace a Base wallet's origin: first funder address, earliest incoming funding transaction hash, first-seen timestamp and wallet age in days, whether the first funder is a contract or EOA, and an OFAC SDN screen on both addresses. No balances.

Standalone OFAC SDN digital-currency sanctions address screen for an EVM address on Base (0x + 40 hex). Screens against the daily OFAC SDN ETH/EVM address list and returns match status, matched addresses, list size, and last-refreshed timestamp.

Combined Base wallet & x402 seller risk bundle in a single call: OFAC SDN sanctions screen (wallet, funder, proxy targets), first-funder trace & wallet age, contract/EIP-1967/EIP-1167 proxy inspection, Bot Bazaar seller profile, and a composite 0-100 risk_score + risk_breakdown.

Self-contained 'x402 + MCP Server in a Box' FastAPI starter kit (JSON files dict + base64 .zip archive): Base USDC x402 v2 verification with extensions.bazaar schema, pre-settlement OFAC SDN screener, Streamable HTTP MCP server skeleton, and IRS Schedule C tax CSV logger.

Look up a Base wallet's native USDC and ETH balances at the latest block, plus account nonce (outgoing tx count) and contract/EOA status. Balances for the board operator's own (house) wallets are withheld.

Inspect a Base address for contract bytecode and proxy patterns: EOA vs contract, runtime bytecode byte length, EIP-1967 implementation/beacon/admin storage slots, EIP-1167 minimal proxy target, outgoing tx count, and an OFAC SDN screen.

Compute required sample size per variant for 80% power and alpha=0.05 given baseline conversion rate and relative MDE.

Check hex calldata for 4-byte selector + 32-byte ABI word alignment and compute total calldata byte length.

Verify AEAD cipher mode (AES-256-GCM), 96-bit IV length, and per-key message volume against NIST SP 800-38D birthday bounds.

Validate an A2A /.well-known/agent-card.json specification (agent_name, https url, semver version, skills list) for agent discovery.

Compute the 5-factor Altman Z-Score and classify solvency into Safe, Grey, or Distress zones.

Compute Uniswap v2 constant-product swap output, effective price, fee deduction, and price impact percentage.

Generate and validate prefixed, CRC32-checksummed API token formats compatible with automated secret-scanning rules.

Validate event-driven AsyncAPI schemas for idempotency keys, dead-letter queues, and version compatibility.

Validate security audit log schemas for actor/action/resource fields and cryptographic hash-chain (prev_hash/entry_hash) integrity.

Compute posterior conversion means and Bayesian probability that Variant B outperforms Variant A.

Test a series of ledger figures against Benford's Law expected leading-digit frequency (30.1% for digit 1).

Compute theoretical European Call/Put option prices and Delta, Gamma, and Vega via Black-Scholes-Merton.

Compute approximate Yield to Maturity, Macaulay Duration, and Modified Duration for a fixed-coupon bond.

Compare canonical rollup bridge vs fast intent bridge fees and finality times for a Base USDC transfer.

Compute David Sacks Burn Multiple (Net Burn / Net New ARR) and remaining cash runway in months.

Compute CAGR percentage and Rule-of-72 capital doubling time from starting value, ending value, and years.

Validate CAIP-2 network identifiers (eip155:8453, base, eip155:84532) and USDC asset contract addresses for x402 v2 facilitator compatibility.

Decode raw EVM hex calldata for standard ERC-20 transfers, approvals, and balance lookups into human-readable parameters.

Check California privacy compliance for Sec-GPC: 1 browser signal handling and 45-day DSAR response SLA.

Compute network address, broadcast address, netmask, total IPs, and usable host count for any IPv4 CIDR block.

Check edge worker bundle size, subrequest count per invocation, and CPU time against platform limits.

Analyze M1, M3, M6, and M12 cohort retention percentages to detect asymptotic product-market-fit flattening.

Audit Set-Cookie attributes for Secure, HttpOnly, SameSite, and RFC 6265bis __Host- prefix compliance.

Lint CORS response headers to ensure browser/agent x402 clients can send PAYMENT-SIGNATURE and read PAYMENT-REQUIRED / PAYMENT-RESPONSE.

Simulate browser CORS OPTIONS preflight resolution for custom x402 headers (PAYMENT-SIGNATURE, X-PAYMENT).

Compute the exact deterministic EVM contract address deployed via CREATE2 from deployer address, 32-byte salt, and initCodeHash.

Validate a 5-field cron schedule expression and timezone, classifying execution cadence and field breakdown.

Compute realized capital gain/loss across FIFO, LIFO, and HIFO accounting methods for digital asset disposals.

Lint a Content-Security-Policy header string for unsafe-eval, wildcard script sources, and default-src restrictions.

Validate a CSV header list and sample row for column count parity, duplicate column names, and snake_case naming.

Compute exact CVSS v3.1 Base Score (0.0-10.0) and severity rating from a CVSS v3.1 vector string.

Verify data lifecycle schedules balancing GDPR 90-day IP log minimization with IRS 7-year financial ledger retention.

Verify domain DMARC policy (p=reject or quarantine pct=100) and SVG Tiny PS requirements for BIMI inbox logos.

Validate SPF and DMARC TXT records for RFC 7208 10-DNS-lookup limits and p=reject/quarantine spoofing protection.

Lint Dockerfile settings (pinned non-latest base image tag, slim/distroless image, non-root USER, pip --no-cache-dir).