{"name":"KushBitx","resources":["https://staging.kushbitx.com/api/token-risk","https://staging.kushbitx.com/api/transaction-preflight","https://staging.kushbitx.com/api/verify-payment","https://staging.kushbitx.com/api/preflight","https://staging.kushbitx.com/api/agentproof-quick-check"],"version":"1.5.0","evidenceLayer":{"release":"candidate","endpoint":"https://staging.kushbitx.com/api/evidence-chains","auth":"protected policy agent bearer key","createRead":"enabled","directChecks":"restricted pilot; explicit per-policy activation required","automaticPayment":false,"executionAuthorized":false},"x402":true,"x402Version":2,"contact":"admin@kushbitx.com","canonical":"https://staging.kushbitx.com/api/services","integrationCheck":"https://staging.kushbitx.com/integration-check","openapi":"https://staging.kushbitx.com/openapi.json","termsOfService":"https://staging.kushbitx.com/terms","privacyPolicy":"https://staging.kushbitx.com/privacy","mcp":{"endpoint":"https://staging.kushbitx.com/mcp","transport":"streamable-http","serverCard":"https://staging.kushbitx.com/.well-known/mcp/server-card.json","tools":["kushbitx_preflight","spendguard_evaluate","quick_check","token_risk","preflight","verify_payment"],"payment":"x402 v2 via _meta[\"x402/payment\"] (Cloudflare Agents paidTool format)"},"sdk":{"npm":"@kushbitx/sdk","version":"0.1.5","install":"npm install @kushbitx/sdk","quickstart":"https://staging.kushbitx.com/quickstart","agentInstructions":"https://staging.kushbitx.com/integrations/agent-instructions.md","source":"https://staging.kushbitx.com/sdk/kushbitx.mjs"},"compatibilityReferences":[{"name":"HumanMirror","url":"https://humanmirror.fr/","relationship":"independent interoperability reference","scope":"SpendGuard v52 adapter request and response compatibility","evidence":"Accepted from sanitized evidence supplied by the integrator; private source was not independently fetched.","securityCertification":false,"endorsement":false,"paidIntegration":false}],"freePreview":{"endpoint":"https://staging.kushbitx.com/api/token-preview","method":"POST","description":"Base token market preview without a wallet or payment. Does not include a security verdict. During provider outages, market metrics may be returned for up to 15 minutes; after that source.limited=true with metrics withheld while identity may remain available for up to 24 hours.","rateLimit":{"requests":60,"windowSeconds":3600,"scope":"source"},"marketMetricsFallbackSeconds":900,"identityFallbackSeconds":86400,"paidReportsUseStaleFallback":false,"example":{"chain":"base","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}},"decisions":{"rule":"Sign or pay automatically only on ALLOW (KushBitx Preflight, Token Risk, Simulation Check), APPROVE (SpendGuard), PASS (Quick Check) or VERIFIED (Payment Proof). Anything else: stop, or ask a person.","services":[{"service":"preflight","name":"KushBitx Preflight","values":{"ALLOW":"Sign, if transactionDigest matches the exact transaction and expiresAt has not passed (SDK canSign).","REVIEW":"Do not sign automatically: a risk signal, or a required check that could not run (see checksUnavailable). Ask a person.","BLOCK":"Do not sign."}},{"service":"token-risk","name":"Token Risk","values":{"ALLOW":"Proceed.","WARN":"Do not proceed automatically; show the findings to a person.","BLOCK":"Do not buy or approve.","INCOMPLETE":"Do not proceed automatically: required evidence was missing (never zero risk)."}},{"service":"transaction-preflight","name":"Simulation Check (formerly Transaction Preflight)","values":{"ALLOW":"Proceed.","WARN":"Do not sign automatically; show the findings to a person.","BLOCK":"Do not sign.","INCOMPLETE":"Do not sign automatically: the simulation or a check could not run."}},{"service":"spendguard","name":"SpendGuard","values":{"APPROVE":"Within the policy; your signer may proceed.","HUMAN_APPROVAL":"Wait for an administrator's approval.","BLOCK":"Do not pay."}},{"service":"agentproof-quick-check","name":"Quick Check","values":{"PASS":"Base mainnet and the official USDC contract confirmed.","FAIL":"Do not pay on this connection."}},{"service":"verify-payment","name":"Payment Proof","values":{"VERIFIED":"Release the goods or credit.","MISMATCH":"Do not release: recipient, amount or sender differ.","FAILED":"Do not release: the transaction failed.","PENDING_OR_NOT_FOUND":"Do not release yet; check again later."}}]},"credits":{"page":"https://staging.kushbitx.com/pricing#credits","terms":"https://staging.kushbitx.com/terms#credits","topup":{"endpoint":"https://staging.kushbitx.com/api/credits/topup","method":"POST","payment":"x402, USDC on Base","body":{"amountUsdc":"1 to 50"},"bonus":"10% more credits on every top-up of 10 USDC or more"},"balance":{"endpoint":"https://staging.kushbitx.com/api/credits/balance","method":"GET"},"actions":{"endpoint":"https://staging.kushbitx.com/api/credits/action","methods":["GET","POST"],"note":"rotate, revoke, daily-limit, refund; each needs an EIP-712 signature from the paying wallet"},"headers":{"creditKey":"X-KushBitx-Credit-Key","idempotency":"Idempotency-Key (8 to 128 characters, unique per check)"},"costInCredits":{"token-risk":1,"transaction-preflight":1,"verify-payment":2,"preflight":5,"agentproof-quick-check":1},"businessPack":{"priceUsdc":99,"credits":120000,"supportDays":30,"support":"integration help by email to admin@kushbitx.com, reply within one business day","renewal":"none (no automatic renewal)","firstMonthCap":"exempt from the 50 USDC first-month cap and not counted toward it","buy":{"endpoint":"https://staging.kushbitx.com/api/credits/topup","method":"POST","body":{"plan":"business"}},"terms":"https://staging.kushbitx.com/terms#business-pack"},"technicalReview":"A KushBitx Preflight REVIEW with technicalReview: true (a check failed on our side or at a provider) returns the credits automatically.","note":"Send the credit key on any paid route instead of an x402 payment. No payment request is made; the check is deducted once."},"freeTools":[{"id":"token-preview","endpoint":"https://staging.kushbitx.com/api/token-preview","method":"POST","advisory":true,"rateLimit":{"requests":60,"windowSeconds":3600,"scope":"source"}},{"id":"token-coverage","endpoint":"https://staging.kushbitx.com/api/token-coverage","method":"POST","advisory":true,"rateLimit":{"requests":60,"windowSeconds":3600,"scope":"source"}},{"id":"spendguard-evaluate","endpoint":"https://staging.kushbitx.com/api/spendguard/evaluate","method":"POST","advisory":true,"executionAuthorized":false,"rateLimit":{"requests":120,"windowSeconds":3600,"scope":"source"},"optionalPaidEvidence":["transaction-preflight","token-risk"],"automaticPayment":false},{"id":"spendguard-protected-policy","endpoint":"https://staging.kushbitx.com/api/spendguard/policies","method":"POST","protectedPolicy":true,"separateAdminAndAgentKeys":true,"pilotRetentionDays":30,"executionAuthorized":false}],"services":[{"id":"token-risk","name":"Token Risk","endpoint":"https://staging.kushbitx.com/api/token-risk","method":"POST","network":"eip155:8453","paymentAsset":"USDC","price":"0.001","description":"Token-risk report for one Base ERC-20 contract. Checks whether the token can be sold (honeypot simulation), buy/sell/transfer tax, owner privileges (mint, pause, blacklist, balance changes, proxy upgrades), holder concentration and DEX liquidity. Returns ALLOW, WARN, BLOCK or INCOMPLETE with scored findings and per-check coverage. INCOMPLETE means required evidence was unavailable, never zero risk. Read-only: never signs or trades.","inputSchema":{"type":"object","properties":{"chain":{"type":"string","enum":["base"],"description":"Blockchain network."},"address":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Base token contract address."}},"required":["chain","address"],"additionalProperties":false}},{"id":"transaction-preflight","name":"Simulation Check","aliases":["Transaction Preflight"],"endpoint":"https://staging.kushbitx.com/api/transaction-preflight","method":"POST","network":"eip155:8453","paymentAsset":"USDC","price":"0.001","description":"Simulate one unsigned Base transaction before an agent signs it. Runs eth_call and gas estimation on current chain state, decodes the intent (ERC-20 transfer, approve, NFT setApprovalForAll), flags unlimited approvals, calldata sent to a non-contract, zero-address targets, reverts and destination risk labels such as phishing or sanctions. Returns ALLOW, WARN, BLOCK or INCOMPLETE with findings. No key or signed transaction is requested.","inputSchema":{"type":"object","properties":{"chain":{"type":"string","enum":["base"]},"from":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Optional sender used for simulation."},"to":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Transaction destination."},"valueWei":{"type":"string","pattern":"^[0-9]+$","description":"Native ETH value in wei."},"data":{"type":"string","pattern":"^0x([a-fA-F0-9]{2})*$","description":"Unsigned calldata."}},"required":["chain","to"],"additionalProperties":false}},{"id":"verify-payment","name":"Payment Proof","endpoint":"https://staging.kushbitx.com/api/verify-payment","method":"POST","network":"eip155:8453","paymentAsset":"USDC","price":"0.00288","description":"Verify one Base USDC payment onchain before an agent releases goods or credit. Reads the transaction receipt and checks the official USDC Transfer logs against the expected recipient, amount and optional sender. Returns VERIFIED, MISMATCH, FAILED or PENDING_OR_NOT_FOUND with block number, confirmations, the matching transfer and a Basescan link. Read-only: never moves funds.","inputSchema":{"type":"object","properties":{"chain":{"type":"string","enum":["base"]},"txHash":{"type":"string","pattern":"^0x[a-fA-F0-9]{64}$"},"expectedTo":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$"},"expectedFrom":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$"},"expectedAmount":{"type":"string","pattern":"^[0-9]+(\\.[0-9]{1,6})?$","description":"Expected USDC amount."}},"required":["chain","txHash","expectedTo","expectedAmount"],"additionalProperties":false}},{"id":"preflight","name":"KushBitx Preflight","endpoint":"https://staging.kushbitx.com/api/preflight","method":"POST","network":"eip155:8453","paymentAsset":"USDC","price":"0.005","description":"One check before money moves on Base. Simulates the unsigned transaction, decodes approvals and transfers, screens the token and the recipient or spender, and applies a protected SpendGuard policy when given. Returns ALLOW, REVIEW or BLOCK with sourced findings. Fail-closed: no ALLOW unless every check ran. Does not detect prompt injection; Protected SpendGuard can cap what an agent pays, but does not detect it either.","inputSchema":{"type":"object","properties":{"chainId":{"type":"integer","enum":[8453],"description":"Base mainnet."},"from":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Wallet that will sign. Required in practice: without it the verdict is REVIEW (sender_unknown), because the transaction cannot be simulated from the signing wallet."},"to":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Transaction destination (contract or wallet)."},"value":{"type":"string","pattern":"^[0-9]+$","description":"Native ETH value in wei."},"data":{"type":"string","pattern":"^0x([a-fA-F0-9]{2})*$","description":"Unsigned calldata."},"intent":{"type":"string","enum":["swap","transfer","approve","buy_token","contract_call"],"description":"What the agent means to do."},"tokenAddress":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Token to screen, when it is not the transaction destination (for example the token being bought)."},"amount":{"type":"string","pattern":"^[0-9]+(\\.[0-9]{1,18})?$","description":"Amount in token units, for the record."},"expectedRecipient":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Swap: who must receive the output (default: from). ETH or ERC-20 transfer: who must be paid; a different recipient is BLOCK (EXPECTED_RECIPIENT_MISMATCH)."},"minAmountOut":{"type":"string","pattern":"^[0-9]+(\\.[0-9]{1,36})?$","description":"Swap: smallest acceptable output, in token units (for example 25.5)."},"expectedTokenOut":{"type":"string","pattern":"^0x[a-fA-F0-9]{40}$","description":"Swap: token the swap must deliver; 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE for native ETH. For buy_token, tokenAddress is used when this is absent."},"policy":{"type":"object","properties":{"policyId":{"type":"string"},"agentId":{"type":"string"},"requestId":{"type":"string"}},"required":["policyId","agentId","requestId"],"additionalProperties":false,"description":"Protected SpendGuard policy (send the agent key as Authorization: Bearer). Base USDC transfers only."}},"required":["chainId","to"],"additionalProperties":false},"requiredChecks":{"byType":{"native_transfer":["sender","simulation","destination","effects"],"erc20_transfer":["sender","simulation","calldata_decode","recipient","token","effects"],"approval":["sender","calldata_decode","spender","token","effects"],"swap":["sender","simulation","effects","swap_outputs","token"],"contract_call":["sender","simulation","destination","effects"]},"withPolicy":["policy"],"note":"token applies when a token is involved: the ERC-20 being moved or approved, or the swap output token unless it is native ETH. effects uses eth_simulateV1 with traceTransfers from the sender, including internal calls. A missing required check gives REVIEW. Address poisoning (ETH and ERC-20 transfers): a recipient that shares the first and last 4 hex characters with an address the sender really paid or was paid by (last 1,000 transfers each way, real tokens only), but is a different address, is REVIEW (ADDRESS_POISONING_SUSPECTED); with a planted line between them (fake token, zero or dust) it is BLOCK (ADDRESS_POISONING_PLANTED); a recipient the sender never dealt with is an information note (FIRST_TIME_RECIPIENT); if the history is unavailable the report says so in addressPoisoning and limitations, without changing the verdict. Agents should always send expectedRecipient for transfers. Verdict policy for autonomous agents: an ETH or ERC-20 transfer whose recipient differs from expectedRecipient is BLOCK (EXPECTED_RECIPIENT_MISMATCH); swap output that reaches neither the sender nor expectedRecipient is BLOCK; a recipient labelled phishing or drainer by a named independent source is BLOCK, other or single-source labels are REVIEW; revoking or lowering an allowance (approve to 0, decreaseAllowance) is ALLOW with an information note; verified official routers and aggregators (Uniswap, Aerodrome, 0x, KyberSwap, 1inch, Odos, Velora, CoW, LI.FI) are known spenders, and a provider label on them is reported as PROVIDER_DISAGREEMENT. A holder transferring a token it owns to an unlisted address: market signals and transfer restrictions are information. A limited approval (below 2^128) to a Sourcify-verified contract deployed at least 90 days ago is ALLOW with a note. Honeypot.is is BLOCK only when its sell simulation ran and failed; otherwise, against GoPlus, it is REVIEW with PROVIDER_DISAGREEMENT. An unlimited approval to a verified official router is ALLOW with an advisory UNLIMITED_APPROVAL note (to an unknown contract it is REVIEW). When buying, weak signals (low liquidity, new pair, concentration, no trading pair, missing market data) are ALLOW and listed in riskSignals; honeypot, sell tax, blacklist and owner controls keep their weight. An approval is judged by its spender: to a verified official spender, or a limited approval to a verified contract, the token's owner-control and market signals are listed in riskSignals and a sell problem (honeypot, sell tax) stays a visible warning. When Honeypot.is has no pair for a token, the honeypot and tax checks come from GoPlus; without either it is REVIEW."}},{"id":"agentproof-quick-check","name":"AgentProof Quick Check","endpoint":"https://staging.kushbitx.com/api/agentproof-quick-check","method":"GET","network":"eip155:8453","paymentAsset":"USDC","price":"0.001","description":"Fast pre-payment sanity check for agents on Base: confirms the RPC reports Base mainnet (chain ID 8453) and that the official USDC contract has deployed code. No request body. Returns PASS or FAIL with both checks and a timestamp. It is not a token-risk report, transaction simulation or payment proof.","inputSchema":{"type":"object","properties":{},"required":[],"additionalProperties":false}}]}