CertBeforePay gives your agent quick security checks it can call on its own: a wallet check against the ScamSniffer scam/phishing list before it sends money, a scan of skills and MCP servers before they enter its context, and a short-lived signed certificate recording what was scanned and the result.
Before paying, your agent asks POST /v1/wallet/check. It returns clear, caution or block (list_result is not listed when the address is not on the list); it never stops the payment itself, your agent decides. The result is based on the public ScamSniffer scam database (GPL-3.0). It is a scam/phishing risk signal, not a guarantee and not a sanctions (OFAC) check, and the free public data runs about 7 days behind ScamSniffer's live feed.
A self-check scans the prompt, tools, skills, MCP list and spend policy you submit. The result can become a signed certificate that records what was submitted for scanning (subject and surfaces), when, and the result (score, verdict, tier), plus its expiry. Any partner can verify the signature for free against the published key. It is not proof that the agent is safe.
POST /v1/gate scans a SKILL.md, an MCP manifest, or retrieved text before it reaches your agent: injection markers, embedded secrets, skills that shell out or post context, and MCP servers without TLS.
No sign-up and no API key. Paid routes answer HTTP 402 with x402 payment requirements; your agent pays in USDC on Base and retries. Prices are listed below, read straight from the server.
POST /v1/self-check. The server scans it and returns findings mapped to OWASP and MITRE ATLAS IDs, a score, and a verdict: ATTEST, CAUTION or HALT. It also returns a self_check_id valid for 15 minutes.POST /v1/cert/issue with that self_check_id. The certificate uses only the server's stored scan; a scan sent by the client is refused. Wallet subjects prove control with a fresh EIP-191 signature or by being the x402 payer.POST /v1/cert/verify, or asks POST /v1/peer/challenge for ACCEPT/REJECT against its own minimum score and tier.In April 2025 Invariant Labs described "tool poisoning" attacks: hidden instructions inside MCP tool descriptions that can hijack an agent and exfiltrate data. Antiy CERT later reported at least 1,184 malicious skills on the ClawHub skill market (ClawHavoc, early 2026), which used fake "ClickFix"-style install steps to get users to download and run malicious code. Our scan flags this kind of risk: instruction-override markers in skills and prompts, imperative instructions in tool descriptions, and the "Skill requests code execution" rule for skills that call curl, wget, os.system, subprocess, eval or child_process. Install steps that only link to a binary may not be caught.
Sources: Invariant Labs · Antiy CERT
CVE-2025-6514 in mcp-remote (CVSS 9.6, July 2025) was a critical remote code execution flaw. JFrog notes that a client connecting to an MCP server over plain http could be hijacked by an attacker on the local network. Our scan flags this kind of risk: a remote MCP server over http:// or ws:// is a high-severity finding that caps the verdict at CAUTION.
Source: JFrog Security Research
ScamSniffer's 2025 report counts $83.85M in signature-phishing losses across 106,106 victims: wallet drainers that trick users into signing malicious approvals, permits, setApprovalForAll or EIP-7702 batch transactions. Our check covers only the pay-to-address part of that risk: we check payTo addresses against ScamSniffer's list and return clear, caution or block (list_result is not listed when the address is not on the list). We never stop the payment; your agent decides. New scam addresses may not be listed yet.
Source: ScamSniffer 2025 report
Add a pre-payment wallet check and a skill/MCP gate to your agent with a few HTTP calls.
Get a signed record of what you submitted for scanning, when, and the result, which partners can verify themselves.
Verify certificates for free and set your own policy: minimum score, required tier, revocation checked.
Per call, in USDC on Base (network eip155:8453). This table is loaded from /.well-known/x402 on this server, not typed by hand.
| Route | What it does | Price |
|---|---|---|
| Loading prices from /.well-known/x402… | ||
Free: GET /v1/ca, POST /v1/cert/verify, GET /v1/cert/revocations, the newest 3 feed items (GET /v1/feed?limit=3, Atom), GET /.well-known/x402 and /llms.txt.
Findings carry IDs from the OWASP Top 10 for LLM Applications 2026, the OWASP Top 10 for Agentic Applications 2026, and MITRE ATLAS (v2026.09). Skill risks use SKL01–SKL10, a CertBeforePay list (not an OWASP list).
The Ed25519 root public key is published at GET /v1/ca. Anyone can check a certificate signature with that key. Revocation checks still use GET /v1/cert/revocations (or the free POST /v1/cert/verify, which checks it for you).
Certificates expire after 24 hours by default. A scan from last month should not authorize spending today.
Provisional unless the subject is a proven wallet and a real surface (prompt, tools, skills, MCP or policy) was scanned. Attested: ATTEST verdict and score ≥ 75. Endorsed: score ≥ 75, not HALT, and attestations from 3 or more different wallet-proven peers (not yourself) in the last 30 days. A HALT is always provisional. ATTEST means a fixed set of rule checks on the configuration you sent found no high or critical issue. It does not mean the agent was run, tested or audited.
No. Paid routes use x402: the server answers 402 with payment requirements and your agent retries with a PAYMENT-SIGNATURE header.
No. It is a scam/phishing signal from the ScamSniffer scam database (GPL-3.0), not OFAC/SDN. It complements, and does not replace, sanctions screening and KYC/AML. The free data runs about 7 days behind ScamSniffer's live feed.
For wallet subjects, yes at issue time: a fresh EIP-191 challenge signature, or the x402 payer equal to the subject. Non-wallet subjects (DIDs, agent ids) are not proven and are capped at provisional.
No. Certificates are built only from the server-side self-check referenced by self_check_id; a client-supplied scan is refused.
Signed Ed25519 JSON with typ=atc, issuer, subject, issued/expiry times, serial, tier, score, grade, verdict, findings hash, OWASP IDs, how the subject was proven, and which surfaces were scanned. A PEM form (BEGIN CERTBEFOREPAY AGENT TRUST CERTIFICATE) is included.
No. It is a fast, deterministic scan, not a pentest, a legal PKI, or investment advice.
Your agent can read everything it needs from one file.
Read llms.txtThe free tools below work anywhere. Paid routes need x402 payment; the "payment requirements" tab shows exactly what this server asks for.
| ID | Sev | Title | OWASP |
|---|
Newest 3 items are free (GET /v1/feed?limit=3, Atom); larger queries return 402 (x402, USDC on Base). While the feed snapshot is stale, larger queries get 503 feed_snapshot_stale instead and are not charged. With no feed snapshot at all, larger queries are still charged and return only built-in and owner-posted items.
Sends a request with no payment. The server answers 402 before running any check. Nothing is scanned or charged.
Local demo mode (X-CBP-Demo: 1) works only on a local test server with no real payTo. Production refuses it and answers 402. Demo certificates are marked with a signed demo: true and do not verify in production.
Wallet-check data is derived from the ScamSniffer scam-database, licensed GPL-3.0. Feed: contains data from the GitHub Advisory Database, licensed CC BY 4.0. Vulnerability data via OSV.dev (CC BY 4.0); PyPA Advisory Database (CC BY 4.0) and OpenSSF Malicious Packages (Apache-2.0) via OSV. This product uses the NVD API but is not endorsed or certified by the NVD. CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). OWASP Top 10 for LLM Applications 2026 and OWASP Top 10 for Agentic Applications 2026 IDs and titles by the OWASP GenAI Security Project, CC BY-SA 4.0. MITRE ATLAS technique IDs and names (v2026.09) © 2021-2026 MITRE, Apache-2.0; ATLAS and MITRE ATLAS are trademarks of The MITRE Corporation.
Support: [email protected]
Security reports: [email protected]