# Nalvorn verification tools

> Paid verification checks over x402. Base URL: https://tools.nalvorn.top

11 POST endpoints (3 free, 8 paid). Each answers with JSON, and every answer carries a signature that can be checked.
Payment: USDC on Base (eip155:8453) through x402 v2. No accounts, no API keys.
Receiving address: 0x98d6768508A36C04d8a60E5E5B24Ac3d628F5350
Contact: support@nalvorn.top

## How to call

1. POST JSON to a path below. Without payment the answer is HTTP 402 with a
   PAYMENT-REQUIRED header (base64 PaymentRequired object) and the same JSON in the body.
2. Pay the amount from accepts[0].amount (USDC atomic units) to accepts[0].payTo.
3. Repeat the request with the signed proof in the PAYMENT-SIGNATURE header.

## Endpoints

| path | price, USD | what it does |
| --- | --- | --- |
| /verify-manifest | 0 | Compare a list of files with a sha256 manifest and report every mismatch |
| /json-schema-strict | 0 | Validate JSON against a schema; returns exact error paths |
| /ru-text-normalize | 0 | Normalise Russian text (yo, quotes, dashes, spaces) and return metrics |
| /receipt-verify | 0.01 | Verify a receipt: canonical JSON digest and declared sha256 |
| /openapi-conformance | 0.05 | Check a live API against its OpenAPI document and list mismatches |
| /full-report | 0.03 | One signed report: domain and mail, certificate, headers, crawl readiness, optional package |
| /domain-posture | 0.01 | Mail and DNS posture: A/AAAA, MX, SPF, DMARC policy, CAA, with a verdict |
| /tls-cert | 0.005 | Certificate expiry, issuer and SAN coverage for a host, days left and verdict |
| /http-headers | 0.01 | Security headers and the redirect chain, with what is missing and why it matters |
| /package-check | 0.005 | Registry check for npm or PyPI: latest version, deprecation, licence, staleness |
| /site-ready | 0.01 | Crawl and AI readiness: robots, sitemap, llms.txt, AI-crawler blocks, response time |

## Machine-readable

- Human pages in 5 languages: https://tools.nalvorn.top/, https://tools.nalvorn.top/es/, https://tools.nalvorn.top/pt/, https://tools.nalvorn.top/ru/, https://tools.nalvorn.top/uk/
- OpenAPI 3.1 with input schemas and x-payment-info: https://tools.nalvorn.top/openapi.json
- Price list as JSON: https://tools.nalvorn.top/manifest
- Payment terms as JSON: https://tools.nalvorn.top/.well-known/x402


## Free checks

Three checks do not require payment: /verify-manifest, /json-schema-strict, /ru-text-normalize.
Call them without a payment header to see the exact answer shape before paying for anything.

## Proof the answer came from us

Every paid answer carries an `attestation` block: EIP-191 signature over the canonical JSON
of {"tool": path, "result": answer}. Signer address: see /attestation-key.
Verify anyone, free: POST /attest/verify with {"tool": "...", "result": {...}, "signature": "0x..."}.
The signing key is not the payment address and holds no funds.

## Live status

- Liveness: https://tools.nalvorn.top/status
- Counters: https://tools.nalvorn.top/stats.json

## Put it in CI (no account, no token)

A release step can call a check and keep the signed answer as an artifact:

```yaml
- name: Nalvorn TLS check
  run: |
    curl -s -X POST https://tools.nalvorn.top/tls-cert \
      -H "Content-Type: application/json" \
      -H "PAYMENT-SIGNATURE: ${{ secrets.X402_PAYMENT }}" \
      -d '{"host":"example.com"}' -o attestation.json
```
## Answers are honest

Every response states what was checked and what was not. If a check cannot be made,
the answer says so instead of guessing; a failure never looks like a success.