Nexus Gateway

Security scans (EVM Sentinel)

• POST /evm-sentinel/v1/scan-quick — $0.05 USDC. Fast honeypot / access-control scan. Output: risk_score, breach_scenarios, gas_ratio, action (ALLOW|BLOCK).
• POST /evm-sentinel/v1/scan-deep — $0.50 USDC. Full breach analysis: 13 core scenarios (BS-001..BS-009 + BS-012..BS-015) + Permit2 wallet-drainer detection (BS-010) + arbitrage-execution manipulation (BS-011). 1h result cache.

Read-only static scan — no wallet approval required.

Fitness attestation (deterministic, signed, verifiable)

• POST /x402/fitness — $0.05 USDC. Fact-only fitness report for repos, dependency lockfiles, and packages: GHSA/CVE exposure, SPDX license detection, commit freshness, CycloneDX SBOM, deterministic 0-100 score.
• POST /x402/fitness/peer-check — $0.05 USDC. Live probe + registry mirror + incident history on a transaction counterparty.
• POST /x402/fitness/lite — $1.25 USDC. Gas Efficiency Rank: per-function static gas estimates, A-E bands, calibrated mainnet cohort.
• POST /x402/fitness/full — $2.25 USDC. Full report: exploitability scoring + source match against explorer-verified on-chain code.
• POST /x402/fitness/forensic — $3.50 USDC. Forensic report: top-3 detected exploit-scenario narratives ranked by severity, with a tamper-evident evidence bundle pinned to IPFS by two independent providers (the bundle CID sits inside the signed result hash).

Every paid fitness response is an EIP-712 signed attestation by ERC-8004 agent #636, Merkle-anchored daily on Polygon. Factual output only (legal_weight: 0).

Other services

• POST /v1/code-modules — EVM Sentinel Quick Scan: audited Solidity module (ERC20/ERC721/ESCROW) + 5-point security audit report. $1.20 USDC.
• POST /v1/legal-code — Hybrid Legal-Code Pro: bilingual EN/ID legal contract mapped to code functions. $300 light / $450 standard / $800 enterprise USDC.
• POST /v1/structured-data — Verified structured data payloads for Web3, regulatory compliance, cross-platform orchestration. $0.20 USDC.

Free endpoints

• POST /gateway/dry-run — free Solidity security dry-run (13 breach scenarios, gas asymmetry ratio, ERC-4626 vault awareness).
• GET /manifest.json — A2A agent discovery manifest.
• GET /attestations — free public audit API: full signed-attestation history (no auth, no payment).
• GET /attestations/proof?hash=0x... — zero-trust proof package for any attestation (EIP-712 signature, Merkle proof, on-chain anchor TX).
• GET /samples — free multi-tier sample manifests.
• GET /metrics — live telemetry.
• GET /pricing.manifest.json — machine-readable pricing.

Payment protocol (x402)

Every paid call requires an x-client-id header (any stable string identifying your agent). Without credits the endpoint answers HTTP 402 with an x402 payment-required header (base64 JSON envelope, x402Version 2, exact scheme, network eip155:137, asset USDC on Polygon PoS). Pay with any x402 client, or use the built-in EIP-712 pull-payment rail (gateway contract 0x2a3D917379Bf94D7B6f239D6BcbBdD7cD8543683 on Polygon PoS).