# Nexus Gateway

> EVM Sentinel + M2M legal-code gateway for Web3. High-speed static
> security scans for AI agents (honeypot check, drainer detection,
> 13+2 breach scenarios), a bilingual (English/Indonesian) legal contract
> generator mapped to code functions, structured data payloads, and
> deterministic fitness attestation for code repositories, dependency
> lockfiles, and packages. Every paid fitness response is an EIP-712
> signed attestation by on-chain agent identity ERC-8004 #636,
> Merkle-anchored daily on Polygon, and independently verifiable via
> free public audit endpoints. Read-only static scan, no wallet approval
> required. Pay per call in USDC on Polygon PoS via the x402 protocol
> (HTTP 402). No account, no API key: identify with the x-client-id
> header, then pay when the endpoint answers 402.

Base URL: https://nexus-m2m-gateway.rakhmadaa.workers.dev
Human site: https://rakhmadaa-gif.github.io/nexus-core-gateway/
OpenAPI 3.1: https://nexus-m2m-gateway.rakhmadaa.workers.dev/openapi.json
Pricing manifest (JSON): https://nexus-m2m-gateway.rakhmadaa.workers.dev/pricing.manifest.json
x402-list directory: https://x402-list.com/services/nexus-gateway (gateway)
and https://x402-list.com/services/nexus-fitness-attestation (fitness suite)

## Security scans (paid, x402 exact, USDC on Polygon PoS eip155:137)

- POST /evm-sentinel/v1/scan-quick — Quick-Check, $0.05 USDC. Fast
  honeypot / access-control scan. Input: {"solidity_code":"..."}.
  Output: { "risk_score": 0.0-1.0, "breach_scenarios": ["BS-001", ...],
  "gas_ratio": number, "action": "ALLOW" | "BLOCK" }.
- POST /evm-sentinel/v1/scan-deep — Deep-Scan, $0.50 USDC. Full breach
  analysis: 13 core scenarios (BS-001..BS-009 + BS-012..BS-015) +
  Permit2-drain detection (BS-010) + arbitrage-execution manipulation
  (BS-011), with per-scenario detail, mitigations, and recommendations.
  Same input; richer output. Results cached 1 hour — repeat scans of the
  same code return in ~50ms. Read-only static scan, no wallet approval
  required.

## Fitness attestation (paid, x402 exact, USDC on Polygon PoS eip155:137)

Deterministic, fact-only fitness reports for code repositories,
dependency lockfiles, packages, and smart contracts. Every paid response
is an EIP-712 signed attestation by on-chain agent identity ERC-8004
#636, Merkle-anchored daily on Polygon — independently verifiable via
free public audit endpoints, never trust-based.

- POST /x402/fitness — Fitness Attestation, $0.05 USDC. GHSA/CVE
  vulnerability exposure via OSV, SPDX license detection, commit
  freshness, CycloneDX 1.5 SBOM, deterministic 0-100 score with
  per-advisory exposure windows. Input: {"repo":"owner/name"} and/or
  {"packages":[{"name":"lodash","ecosystem":"npm","version":"4.17.20"}]},
  or {"lockfile":{"filename":"package-lock.json","content":"..."}}
  (package-lock / yarn.lock / requirements.txt / Pipfile.lock / go.mod /
  Cargo.lock / composer.lock / pubspec.lock / Gemfile.lock, plus composer.json
  manifests — 10 formats, up to 512 KiB, exact pinned versions).
- POST /x402/fitness/peer-check — Peer Check, $0.05 USDC. Live probe,
  registry mirror, and incident history for a transaction counterparty.
  Input: {"peer_url":"https://..."}.
- POST /x402/fitness/lite — Gas Efficiency Rank, $1.25 USDC. Static
  per-function gas estimates, A-E bands, ranked against a calibrated
  mainnet contract cohort. HTTP 422 with no charge if the code cannot
  be ranked.
- POST /x402/fitness/full — Full Report, $2.25 USDC. Adds 5-component
  deterministic exploitability scoring and source match against
  explorer-verified on-chain code.
- POST /x402/fitness/forensic — Forensic Report, $3.50 USDC. Top-3
  detected exploit-scenario narratives for your Solidity code, ranked by
  severity, with a tamper-evident evidence bundle pinned to IPFS by two
  independent providers. The IPFS CID sits inside the signed result
  hash — fetch the bundle from any public gateway, re-hash, and check
  the proof at /attestations/proof.

Factual output only: no security guarantees, no advisory opinions
(legal_weight: 0).

## Other endpoints (paid, x402 exact, USDC on Polygon PoS eip155:137)

- POST /v1/code-modules — EVM Sentinel Quick Scan. Generate an audited
  Solidity module (ERC20/ERC721/ESCROW) with a 5-point security audit
  report. Body: {"service_type":"code_modules","params":{"type":"ERC20","name":"...","symbol":"..."}}.
  $1.20 per call.
- POST /v1/legal-code — Hybrid Legal-Code Pro. Generate a bilingual
  EN/ID legal contract mapped to code functions. Body:
  {"service_type":"legal_code","params":{"contract_type":"escrow","tier":"standard","parties":["A","B"],"jurisdiction":"ID","amount":"1000","currency":"USDC"}}.
  $300 light / $450 standard / $800 enterprise per call.
- POST /v1/structured-data — Verified structured data payloads for
  Web3, regulatory compliance, and cross-platform orchestration. Body:
  {"service_type":"structured_data","params":{"type":"ERC20","name":"...","symbol":"..."}}.
  $0.20 per call.

## Free endpoints (no payment, no x-client-id)

- POST /gateway/dry-run — free Solidity security dry-run: 13 breach
  scenarios (BS-001..BS-009 + BS-012..BS-015), gas asymmetry ratio,
  ERC-4626 vault awareness, nonce/replay defense. Use this to pre-check
  any contract before deploying or before buying a paid scan.
- GET /manifest.json — A2A agent discovery manifest.
- GET /attestations — free public audit API: query and verify the
  full signed-attestation history (no auth, no payment).
- GET /attestations/proof?hash=0x... — zero-trust proof package for any
  attestation: EIP-712 signature, Merkle proof, on-chain anchor TX, and
  independent verification steps.
- GET /samples — free multi-tier sample manifests (legal + code + matrix).
- GET /metrics — live telemetry (uptime, latency, concurrency).
- GET /pricing.manifest.json — machine-readable pricing.

## Payment protocol

Every paid call requires the x-client-id header (any stable string that
identifies your agent). Without credits the endpoint answers HTTP 402
with a payment-required header carrying a base64 JSON x402 envelope
(x402Version 2, accepts[]: scheme exact, network eip155:137, asset USDC
0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359, payTo treasury). Pay with
any x402 client, or use the built-in pull-payment rail: the gateway
contract 0x2a3D917379Bf94D7B6f239D6BcbBdD7cD8543683 on Polygon PoS
pulls USDC via EIP-712 permit.

Prices: scan-quick $0.05 USDC, scan-deep $0.50 USDC,
fitness $0.05 USDC, peer-check $0.05 USDC, fitness-lite $1.25 USDC,
fitness-full $2.25 USDC, fitness-forensic $3.50 USDC,
structured_data $0.20 USDC,
code_modules $1.20 USDC, legal_code $300/$450/$800 USDC by tier.

## Response envelope

Scan responses carry the machine fields at the top level of data:
{ risk_score, breach_scenarios[], gas_ratio, action }.
All paid responses use the M2M standard envelope:
{ status, payload_id, timestamp, service_type, data, metadata: { node_id,
version, latency_ms, credits_charged } }.