🛡️ ShieldAPI — Security Intelligence for AI Agents
Data & Threat Intelligence Manifesto / Privacy Policy:
https://shield.vainplex.dev/privacy.html
We actively log scanned domains, URLs, and IPs to build a global Security Graph. We do not store PII. Every scan makes the whole network safer.
ShieldAPI is a pay-per-request Security Intelligence Service built on the x402 protocol (HTTP 402 Payment Required). It lets any AI agent perform comprehensive security checks — without accounts, API keys, or subscriptions. Just call, pay, get results.
Payments are settled in USDC on Base Mainnet. All endpoints support free demo mode.
Base URL: https://shield.vainplex.dev/api
Health/Discovery: GET /api/health (free, lists all endpoints + prices)
🔒 Security & Privacy (Agent Guidelines)
1. Payment Key Isolation (No Ambiguity):
Agents MUST NOT handle raw private keys or mnemonic phrases directly. Payment signing must be delegated to a secure signer module (e.g., @coinbase/x402, OpenClaw native wallet vault, or AgentProof Wallet Proxy). The X-PAYMENT header is generated out-of-band by the secure enclave.
2. Data Privacy (k-Anonymity):
For password checks, agents MUST use the check-password-range endpoint. Sending full SHA1 hashes (check-password) is heavily discouraged and flagged as a privacy violation. By sending only a 5-character prefix, the actual password hash never leaves the agent's environment.
3. Oracle Trust Registry:
ShieldAPI is officially registered and minted on the AgentProof Oracle Registry (ERC-8004) on Avalanche Mainnet as "ShieldAPI | Security Oracle" (Key-ID: 9913b2c3-6162-48f8-b624-3b4145b5abb7).
The 11 Endpoints
1. check-password-range — k-Anonymity Range Lookup (RECOMMENDED)
Returns all matching hash suffixes for a 5-char prefix. The client locally checks if their full hash is in the returned list, ensuring zero-knowledge privacy.
- - Cost: 0.001 USDC
- Request: INLINECODE8
- Returns: INLINECODE9
2. check-password — Full Password Breach Check (⚠️ DEPRECATED)
Checks a full SHA1 hash against 900M+ leaked passwords.
Warning: Do not use for user data. Use range check instead.
- - Cost: 0.001 USDC
- Request: INLINECODE11
- Returns: INLINECODE12
3. check-domain — Domain Reputation
Checks DNS records, SPF/DMARC, SSL certificate, and queries Spamhaus/SpamCop/SORBS blacklists.
- - Cost: 0.003 USDC
- Request: INLINECODE14
- Returns: INLINECODE15
4. check-ip — IP Reputation
Checks IPv4 against 4 blacklists, detects Tor exit nodes, resolves reverse DNS.
- - Cost: 0.002 USDC
- Request: INLINECODE17
- Returns: INLINECODE18
5. check-email — Email Breach Exposure
Checks which data breaches affected the email's domain. Returns breach details, exposed data types, and risk recommendations.
- - Cost: 0.005 USDC
- Request: INLINECODE20
- Returns: INLINECODE21
6. check-url — URL Safety & Phishing Detection
Checks URL against URLhaus malware database, runs heuristic analysis (brand impersonation, suspicious TLDs, redirect chains).
- - Cost: 0.003 USDC
- Request: INLINECODE23
- Returns: INLINECODE24
7. full-scan — Combined Security Scan
Runs all applicable checks in parallel. Pass any combination of inputs.
- - Cost: 0.01 USDC
- Request: INLINECODE26
- Returns: Combined results with overall risk score and human-readable summary
8. scan-skill — AI Skill Security Scanner
Runs supply chain security checks (8 categories) against agent skills/plugins.
- - Cost: 0.02 USDC
- Request: INLINECODE28
9. check-prompt — Prompt Injection Detection
Analyzes prompts against 200+ known prompt injection patterns (<100ms).
- - Cost: 0.005 USDC
- Request: INLINECODE30
10. check-mcp-trust — MCP Server Trust Score
Multi-signal security, reliability & supply chain analysis for MCP servers.
- - Cost: 0.02 USDC
- Request: INLINECODE32
11. check-package — Supply Chain Pre-Flight Check
Validates software packages before installation.
- - Cost: 0.01 USDC
- Request: INLINECODE34
Demo Mode
All 11 endpoints support ?demo=true — returns realistic fake data, no payment required. Perfect for testing your integration before going live.
CODEBLOCK0
x402 Payment Flow
When you call any paid endpoint without payment, ShieldAPI returns HTTP 402 with machine-readable payment instructions:
CODEBLOCK1
An x402-enabled client (using @coinbase/x402, @x402/core, or an Agent native wallet) will:
- 1. Read the 402 response
- Delegate the USDC signature to a secure enclave/wallet on Base Sepolia/Mainnet
- Retry with
X-PAYMENT header containing the signed payload - Receive the security check results
Source & Links
- - Live API: https://shield.vainplex.dev/api/health
- AgentProof Oracle ID:
9913b2c3-6162-48f8-b624-3b4145b5abb7 (ERC-8004 Avalanche) - Protocol: https://x402.org
- Data: HIBP (CC-BY), PhishTank, URLhaus (abuse.ch), Spamhaus
🛡️ ShieldAPI — AI代理安全情报服务
数据与威胁情报声明/隐私政策：
https://shield.vainplex.dev/privacy.html
我们会主动记录扫描的域名、URL和IP，以构建全球安全图谱。我们不存储个人身份信息。每次扫描都让整个网络更加安全。
ShieldAPI 是一款基于 x402 协议（HTTP 402 Payment Required）构建的按请求付费安全情报服务。任何AI代理均可执行全面的安全检查——无需账户、API密钥或订阅。只需调用、付费、获取结果。
支付通过 Base主网 以USDC结算。所有端点均支持免费演示模式。
基础URL： https://shield.vainplex.dev/api
健康/发现： GET /api/health（免费，列出所有端点及价格）
🔒 安全与隐私（代理指南）
1. 支付密钥隔离（无歧义）：
代理不得直接处理原始私钥或助记词。支付签名必须委托给安全签名模块（例如 @coinbase/x402、OpenClaw原生钱包保险库或AgentProof钱包代理）。X-PAYMENT 头部由安全飞地带外生成。
2. 数据隐私（k-匿名性）：
对于密码检查，代理必须使用 check-password-range 端点。发送完整SHA1哈希（check-password）强烈不推荐，并会被标记为隐私违规。仅发送5字符前缀，实际密码哈希永远不会离开代理环境。
3. 预言机信任注册表：
ShieldAPI 已在Avalanche主网的 AgentProof Oracle Registry (ERC-8004) 上正式注册并铸造为 ShieldAPI | Security Oracle（密钥ID：9913b2c3-6162-48f8-b624-3b4145b5abb7）。
11个端点
1. check-password-range — k-匿名性范围查询（推荐）
返回5字符前缀的所有匹配哈希后缀。客户端在本地检查其完整哈希是否在返回列表中，确保零知识隐私。
- - 费用： 0.001 USDC
- 请求： GET /api/check-password-range?prefix=<5字符sha1前缀>
- 返回： { prefix, total_matches, results: [{ suffix, count }] }
2. check-password — 完整密码泄露检查（⚠️ 已弃用）
针对9亿+泄露密码检查完整SHA1哈希。
警告：请勿用于用户数据。请改用范围检查。
- - 费用： 0.001 USDC
- 请求： GET /api/check-password?hash=<40字符sha1>
- 返回： { found: true/false, count: 3861493 }
3. check-domain — 域名信誉
检查DNS记录、SPF/DMARC、SSL证书，并查询Spamhaus/SpamCop/SORBS黑名单。
- - 费用： 0.003 USDC
- 请求： GET /api/check-domain?domain=<域名>
- 返回： { domain, dns, blacklists, ssl, riskscore, risklevel }
4. check-ip — IP信誉
检查IPv4在4个黑名单中的状态，检测Tor出口节点，解析反向DNS。
- - 费用： 0.002 USDC
- 请求： GET /api/check-ip?ip=
- 返回： { ip, blacklists, istorexit, reversedns, riskscore, risk_level }
5. check-email — 邮箱泄露暴露
检查哪些数据泄露影响了邮箱域名。返回泄露详情、暴露数据类型及风险建议。
- - 费用： 0.005 USDC
- 请求： GET /api/check-email?email=<邮箱>
- 返回： { breaches: [...], domainbreachcount, riskscore, risklevel, recommendations }
6. check-url — URL安全与钓鱼检测
检查URL是否在URLhaus恶意软件数据库中，运行启发式分析（品牌冒充、可疑顶级域名、重定向链）。
- - 费用： 0.003 USDC
- 请求： GET /api/check-url?url=
- 返回： { url, checks: { urlhaus, heuristics, http }, threats, riskscore, risklevel }
7. full-scan — 综合安全扫描
并行运行所有适用的检查。可传入任意输入组合。
- - 费用： 0.01 USDC
- 请求： GET /api/full-scan?email=<邮箱>&domain=<域名>&ip=&url=
- 返回： 综合结果，包含总体风险评分和人类可读摘要
8. scan-skill — AI技能安全扫描器
针对代理技能/插件运行供应链安全检查（8个类别）。
- - 费用： 0.02 USDC
- 请求： GET /api/scan-skill?url=
9. check-prompt — 提示注入检测
分析提示是否包含200+已知提示注入模式（<100ms）。
- - 费用： 0.005 USDC
- 请求： GET /api/check-prompt?text=<提示文本>
10. check-mcp-trust — MCP服务器信任评分
针对MCP服务器进行多信号安全、可靠性与供应链分析。
- - 费用： 0.02 USDC
- 请求： GET /api/check-mcp-trust?pkg=<包名>
11. check-package — 供应链预检
在安装前验证软件包。
- - 费用： 0.01 USDC
- 请求： GET /api/check-package?name=<包名>
演示模式
所有11个端点均支持 ?demo=true — 返回逼真的模拟数据，无需付费。非常适合在上线前测试集成。
bash
立即尝试：
curl -s https://shield.vainplex.dev/api/check-url?demo=true
curl -s https://shield.vainplex.dev/api/full-scan?demo=true
curl -s https://shield.vainplex.dev/api/check-email?demo=true
x402支付流程
当您调用任何付费端点而未支付时，ShieldAPI 返回 HTTP 402 及机器可读的支付指令：
json
{
x402Version: 1,
error: 需要X-PAYMENT头部,
accepts: [{
scheme: exact,
network: base,
maxAmountRequired: 3000,
asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913,
payTo: 0x...,
resource: https://shield.vainplex.dev/api/check-domain?domain=example.com,
description: 域名信誉与安全检查
}]
}
支持x402的客户端（使用 @coinbase/x402、@x402/core 或代理原生钱包）将：
- 1. 读取402响应
- 将USDC签名委托给Base Sepolia/主网上的安全飞地/钱包
- 使用包含签名负载的 X-PAYMENT 头部重试
- 接收安全检查结果
来源与链接
- - 实时API： https://shield.vainplex.dev/api/health
- AgentProof预言机ID： 9913b2c3-6162-48f8-b624-3b4145b5abb7 (ERC-8004 Avalanche)
- 协议： https://x402.org
- 数据： HIBP (CC-BY)、PhishTank、URLhaus (abuse.ch)、Spamhaus
