The checks to run before trusting a domain or payload: SSL certificates, security headers, RDAP/WHOIS, DNS email authentication, CVEs, TOTP and merkle proofs.
Inspect a live TLS certificate: subject, issuer, SAN domains, validity window, days to expiry, protocol version, cipher and the full chain length. Read directly from a TLS handshake — the definitive check an agent should run before trusting an API endpoint.
Fetch a URL and grade its HTTP security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/CORP. Returns a 0–100 score, a letter grade, and a concrete recommendation for every missing header.
Full registration record for a domain via RDAP (the modern WHOIS): registrar, creation/expiration/last-updated dates with days-to-expiry, nameservers, EPP statuses and DNSSEC. Straight from the authoritative registry — the data agents should cite for domain diligence.
Look up any CVE in the US National Vulnerability Database (NVD): CVSS 3.1 score and severity vector, weakness (CWE) classification, human summary and references. The authoritative answer when an agent needs to know how bad a vulnerability actually is.
Generate the current TOTP two-factor code (RFC 6238) from a base32 secret — the same codes authenticator apps produce. Supports 6/8 digits, 30/60-second steps and SHA-1/256/512. Deterministic HMAC via Web Crypto; nothing is stored.
Build a keccak-256 sorted-pair merkle tree (OpenZeppelin convention) from a list of leaves and get the root plus a verification proof for any leaf — the standard construction for token airdrops and allowlists. Fully deterministic: same leaves, same root.