Checks that tell you what's wrong, and where

The toolsPrices are per call, in USDC on Base.

• /verify-manifest
  free
  Tells you which file does not match its sha256, which one is missing, and which one you never listed.
• /json-schema-strict
  free
  Names the field that broke the schema and the path to it, instead of a bare "invalid".
• /ru-text-normalize
  free
  Brings Russian text to one shape (yo, quotes, dashes, spaces) and returns what it changed.
• /tls-cert
  0.005
  Certificate expiry, issuer and SAN coverage, days left and a verdict.
• /package-check
  0.005
  Registry check for npm or PyPI: latest version, deprecation, licence, staleness.
• /receipt-verify
  0.010
  Rebuilds the canonical JSON and answers one question: does the hash still match what the receipt claims?
• /domain-posture
  0.010
  Mail and DNS posture: A/AAAA, MX, SPF, DMARC policy, CAA, with a verdict.
• /http-headers
  0.010
  Security headers and the redirect chain: what is missing and why it matters.
• /site-ready
  0.010
  Crawl and AI readiness: robots, sitemap, llms.txt, AI-crawler blocks, response time.
• /openapi-conformance
  0.050
  Compares a running API with its OpenAPI document and lists where the two disagree.
• /full-report
  0.030
  Four checks in one call: domain and mail, certificate, security headers, crawl readiness — plus a package check if you name one. Bought separately, the four cost 0.035. One signed answer; the OpenAPI check is not included.

A real call

All four answers were taken from the live server on 2026-10-26. The first two calls are free and need no payment; the third is a paid tool, so it answers 402 until you sign.

1. The request

curl -s -X POST \
  https://tools.nalvorn.top/verify-manifest \
  -H 'Content-Type: application/json' \
  -d '{"manifest":"a1b2c3d4e5f6  ./app.py","files":{"./app.py":"a1b2c3d4e5f6"}}'

2. The free call answers right away: HTTP 200

{
 "ok": true,
 "verdict": "every declared digest matches",
 "declared_files": 1,
 "checked": 1,
 "mismatched": [],
 "missing": [],
 "extra_not_in_manifest": []
}

3. The same call with one digest changed: HTTP 200, ok: false

{
 "ok": false,
 "verdict": "digests do not match",
 "declared_files": 1,
 "checked": 1,
 "mismatched": [
  {
   "file": "./app.py",
   "declared": "a1b2c3d4e5f6",
   "actual": "11b2c3d4e5f6"
  }
 ],
 "missing": [],
 "extra_not_in_manifest": []
}

The 402 is the whole object a client reads: price in token atomic units, receiving address, network and the bazaar extension.

4. A paid call without payment: HTTP 402

{
 "x402Version": 2,
 "error": "PAYMENT-SIGNATURE header is required",
 "resource": {
  "url": "https://tools.nalvorn.top/receipt-verify",
  "description": "Verify a receipt: canonical JSON digest and declared sha256",
  "mimeType": "application/json",
  "serviceName": "Nalvorn verification tools",
  "tags": [
   "verification",
   "audit",
   "evidence"
  ],
  "iconUrl": "https://tools.nalvorn.top/favicon.ico"
 },
 "accepts": [
  {
   "scheme": "exact",
   "network": "eip155:8453",
   "amount": "10000",
   "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
   "payTo": "0x98d6768508A36C04d8a60E5E5B24Ac3d628F5350",
   "maxTimeoutSeconds": 120,
   "extra": {
    "name": "USD Coin",
    "version": "2"
   }
  }
 ]
}

The paid call, ready to run:

curl -s -X POST \
  https://tools.nalvorn.top/receipt-verify \
  -H 'Content-Type: application/json' \
  -H "PAYMENT-SIGNATURE: $(your-x402-client-signs)" \
  -d '{"payload":{"a":1},"sha256":"0f343b09"}'

amount is in atomic units: 10000 means 0.01 USDC, because USDC has six decimals. The free tools have no amount: nothing is charged.

How a call works

1. POST a JSON body to one of the paths above. Leave the payment header out for now.
2. The server answers HTTP 402 with the price, the receiving address and the asset. You do not pay anything to get that answer.
3. Sign an EIP-3009 authorization with an x402 client — plain curl cannot sign, and a direct USDC transfer to the address is not counted as payment. Send the same request again with the signed proof in PAYMENT-SIGNATURE; the result comes back as JSON.

Paying

Network

Base (eip155:8453)

Asset

USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Receiving address

0x98d6768508A36C04d8a60E5E5B24Ac3d628F5350

Scheme

exact — one call, one charge. No deposit, no balance, no monthly fee.

For agents

Agents read the catalogue and the payment terms directly:

Catalogue

/manifest

Protocol

/.well-known/x402

OpenAPI

/openapi.json

llms.txt

/llms.txt

Listed in directories

• Registry listing on x402scan