# ShieldAPI

> Security intelligence for AI agents. Pay-per-request via x402 micropayments (USDC on Base). No API keys. No signup.

ShieldAPI provides security checks that AI agents can discover, pay for, and use autonomously. All endpoints accept x402 payments — one HTTP roundtrip from request to paid response.

## Endpoints

### Prompt Injection Detection
- POST /api/check-prompt — $0.005
- Detects prompt injection in text (208 patterns, 8 languages, 4 decoders)
- Input: {"prompt": "text to check", "context": "user-input|skill-prompt|system-prompt"}
- Returns: isInjection (bool), confidence (0-1), matched patterns with evidence

### Skill Security Scanner
- POST /api/scan-skill — $0.02
- Scans AI skills/plugins for supply chain attacks (204 patterns, 8 risk categories)
- Input: {"skill": "SKILL.md content"} or {"files": [{"name": "file.js", "content": "..."}]}
- Returns: riskScore (0-100), riskLevel, findings with severity/category/evidence

### Password Breach Check
- GET /api/check-password?hash=<SHA1> — $0.001
- Checks SHA-1 password hash against 900M+ breach records (HIBP)

### Password Range (k-Anonymity)
- GET /api/check-password-range?prefix=<5chars> — $0.001
- HIBP k-Anonymity prefix lookup

### Email Breach Check
- GET /api/check-email?email=<addr> — $0.005
- Checks email for known data breaches

### Domain Reputation
- GET /api/check-domain?domain=<name> — $0.003
- DNS records, blacklists (Spamhaus, SpamCop, SORBS), SSL, SPF/DMARC

### IP Reputation
- GET /api/check-ip?ip=<ipv4> — $0.002
- Blacklists, Tor exit node detection, reverse DNS

### URL Safety
- GET /api/check-url?url=<url> — $0.003
- Phishing, malware, brand impersonation detection

### Full Security Scan
- GET /api/full-scan?email=<>&domain=<>&ip=<>&url=<> — $0.01
- Combined scan with all available checks

## Payment

All endpoints use x402 (HTTP 402 Payment Required):
- Network: Base Mainnet (eip155:8453)
- Asset: USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
- Scheme: exact

No API keys needed. Send request → receive 402 → sign USDC payment → resend with payment proof → receive response.

## Demo Mode

Add ?demo=true to any endpoint for free demo data (rate limited).

## Discovery

- OpenAPI: https://shield.vainplex.dev/openapi.json
- Well-Known: https://shield.vainplex.dev/.well-known/x402
- x402scan: https://www.x402scan.com/server/55c99a38-34b3-4b2c-8987-f58ebd88a7df

## Tools

- CLI: npx @vainplex/shieldapi-cli
- MCP Server: npx shieldapi-mcp (for Claude Desktop, Cursor, etc.)
- npm: https://www.npmjs.com/package/@vainplex/shieldapi-cli

## Links

- API: https://shield.vainplex.dev
- Health: https://shield.vainplex.dev/api/health
- GitHub: https://github.com/alberthild/shieldapi-cli