# EdgeScreen x402

Deterministic zero-LLM risk screening API & MCP server (v1.7.0) settled in Base USDC via x402 v2 (up to 25 items per call). No account, no API key.

## Quickstart (@x402/fetch)
```js
import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";
const acct = privateKeyToAccount(process.env.PRIVATE_KEY);
const payFetch = wrapFetchWithPaymentFromConfig(fetch, { schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(acct) }] });
const res = await payFetch("https://aso-x402-screen.asostudio.workers.dev/v1/screen/url?url=https://example.com");
```

## MCP Transport v2 (@x402/mcp)
- Endpoint: POST https://aso-x402-screen.asostudio.workers.dev/mcp (Streamable HTTP JSON-RPC 2.0, 12 tools: 3 zero-wallet free entry hooks + 8 paid x402 tools + health_check).
- Free entry hooks execute immediately on call #1 for $0.00 with zero wallet setup (`free_punycode_decode`, `free_secret_prefix_lint`, `edgescreen_x402_quickstart`, `health_check`).
- Compliant with official coinbase/x402 MCP transport v2 (`specs/transports-v2/mcp.md`): unpaid `tools/call` on paid tools returns HTTP 200 with `result.isError: true` and `result.structuredContent` (`PaymentRequired`); paid `tools/call` accepts `params._meta["x402/payment"]` (or HTTP `PAYMENT-SIGNATURE`) and returns settlement receipt in `result._meta["x402/payment-response"]`.

## Free Zero-Wallet Entry Hooks ($0.00)
- MCP `free_punycode_decode` or GET https://aso-x402-screen.asostudio.workers.dev/v1/free/punycode?target=xn--unswap-4va.com ($0.00): decodes IDN xn-- punycode and inspects mixed Unicode scripts on 1 domain/handle (0 brand-corpus lookup; includes upgrade_hint to paid `screen_impersonation`).
- MCP `free_secret_prefix_lint` or GET https://aso-x402-screen.asostudio.workers.dev/v1/free/secret-prefix?text=... or POST https://aso-x402-screen.asostudio.workers.dev/v1/free/secret-prefix ($0.00): checks up to 500 chars for obvious high-risk secret prefixes (AKIA, sk_live_, -----BEGIN, ghp_, xoxb-) without full entropy/offsets (includes upgrade_hint to paid `screen_secret` / `screen_diff`).
- MCP `edgescreen_x402_quickstart` or GET https://aso-x402-screen.asostudio.workers.dev/v1/free/quickstart ($0.00): returns turnkey copy-paste @x402/mcp + @x402/fetch setup snippets (Cursor, Claude Code, TypeScript viem, Python) + live pricing ladder.

## Paid Endpoints
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen ($0.005 USD / 5000 atomic on eip155:8453): combined multi-signal batch screening (OFAC + brand impersonation + homoglyphs + prompt injection + SSRF URL firewall + secret redactor + git diff auditor).
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/address or GET https://aso-x402-screen.asostudio.workers.dev/v1/screen/address?address=0x...&chain=base ($0.002 USD / 2000 atomic on eip155:8453): OFAC SDN crypto wallet sanctions screening (EVM 0x..., BTC 1.../3.../bc1..., TRON T...).
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/domain or GET https://aso-x402-screen.asostudio.workers.dev/v1/screen/domain?domain=example.com ($0.002 USD / 2000 atomic on eip155:8453): IDN Punycode, Unicode UTS #39 confusable, and Damerau-Levenshtein lookalike domain/handle detector.
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/impersonation or GET https://aso-x402-screen.asostudio.workers.dev/v1/screen/impersonation?target=rnicrosoft.com ($0.002 USD / 2000 atomic on eip155:8453): deterministic brand/handle/domain impersonation & homograph detector (IDN xn-- punycode, Unicode confusables, Levenshtein-1 typosquats, rn/m & 0/o & 1/l swaps, fake support/airdrop lures -> risk_score, verdict, signals, canonical_comparison).
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/prompt or GET https://aso-x402-screen.asostudio.workers.dev/v1/screen/prompt?text=... ($0.002 USD / 2000 atomic on eip155:8453): prompt injection, MCP tool poisoning, Unicode tag smuggling (U+E0000-U+E007F), and secret exfiltration firewall.
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/url or GET https://aso-x402-screen.asostudio.workers.dev/v1/screen/url?url=https://... ($0.002 USD / 2000 atomic on eip155:8453): pre-fetch SSRF & URL firewall (loopback, RFC1918, CGNAT, IPv6 mapped/local, AWS/GCP/Azure/Alibaba metadata, hex/octal/decimal IPs, non-HTTP(S) schemes, credentials, punycode homoglyphs, open redirects).
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/secret ($0.002 USD / 2000 atomic on eip155:8453): pre-publish secret leak detector & redactor (OpenAI, Anthropic, AWS, GitHub, Stripe, Slack, Google keys, PEM/hex private keys, JWTs, Bearer tokens -> safe, riskScore, masked findings, redactedText).
- POST https://aso-x402-screen.asostudio.workers.dev/v1/screen/diff ($0.002 USD / 2000 atomic on eip155:8453): pre-merge git diff & PR patch auditor (leaked secrets in + lines, destructive shell/SQL, CI workflow injection, postinstall hooks, SSRF/private IPs, auth/TLS bypass, Trojan Source BiDi Unicode, hunk integrity).

## Free Discovery & Preview Endpoints
- GET https://aso-x402-screen.asostudio.workers.dev/v1/demo (read-only preview on 3 fixed canonical fixtures: OFAC sanctioned address, xn--unswap-4va.com punycode homograph, prompt injection)
- GET https://aso-x402-screen.asostudio.workers.dev/v1/free/punycode?target=xn--unswap-4va.com
- GET https://aso-x402-screen.asostudio.workers.dev/v1/free/secret-prefix?text=...
- GET https://aso-x402-screen.asostudio.workers.dev/v1/free/quickstart
- GET https://aso-x402-screen.asostudio.workers.dev/tools/ofac-sanctions-screening-api
- GET https://aso-x402-screen.asostudio.workers.dev/tools/domain-impersonation-homograph-api
- GET https://aso-x402-screen.asostudio.workers.dev/tools/prompt-injection-firewall-mcp
- GET https://aso-x402-screen.asostudio.workers.dev/tools/ssrf-url-safety-validator
- GET https://aso-x402-screen.asostudio.workers.dev/tools/git-diff-secret-scanner-mcp
- GET https://aso-x402-screen.asostudio.workers.dev/openapi.json
- GET https://aso-x402-screen.asostudio.workers.dev/llms.txt
- GET https://aso-x402-screen.asostudio.workers.dev/terms.txt
- GET https://aso-x402-screen.asostudio.workers.dev/.well-known/x402
- GET https://aso-x402-screen.asostudio.workers.dev/.well-known/x402.json
- GET https://aso-x402-screen.asostudio.workers.dev/.well-known/api-catalog
- GET https://aso-x402-screen.asostudio.workers.dev/.well-known/mcp.json
- GET https://aso-x402-screen.asostudio.workers.dev/.well-known/security.txt
- POST https://aso-x402-screen.asostudio.workers.dev/mcp
- GET https://aso-x402-screen.asostudio.workers.dev/health