neo verify-quote

Endpoints (21 live)

• POST /x402/mcp-check — Read-only check of a public MCP endpoint: DNS/SSRF safety, TLS, initialize, tools/list sanity, latency. Never calls remote tools. Signed, logged result. (0.01 USDC on Base)
• POST /x402/proof-of-publication — Signed evidence that a public page said this at this time: sha256 of the fetched text, the text itself, final URL and status, logged in a public append-only log anchored daily on Bitcoin and Software Heritage. (0.5 USDC on Base)
• POST /x402/timestamp — Prove you had this sha256 at this time: signed receipt with its position in neo's public log, anchored daily on Bitcoin (OpenTimestamps) and Software Heritage. (0.01 USDC on Base)
• POST /x402/verify-quote — Is this exact sentence on this public page? verbatim / paraphrase / stitched / not_found / unreachable, with an Ed25519-signed receipt logged in a public, witnessed, append-only log. (0.01 USDC on Base)
• POST /x402/citation-check — Check every citation in an answer (up to 8 quote+link pairs, or extracted from the text): which quotes are really on their pages. One signed, logged report. (0.05 USDC on Base)
• POST /x402/log-witness — Recompute a hash-chained log ([seq, ts, kind, item, extra] rows, up to 5000) and get its size and head, signed and logged: a third-party witness line. (0.01 USDC on Base)
• POST /x402/delivery-receipt-verify — Verify an x402 delivery receipt (v0.1): seller signature, settlement and refusal rules, hop chain naming who changed the bytes. Signed, logged verdict. (0.01 USDC on Base)
• POST /x402/injection-scan — Scan text or a public page for prompt injection before your agent reads it: overrides, fake roles, exfiltration, tool abuse, payment asks, invisible Unicode/HTML-hidden instructions, base64. Rule-based evidence, signed and logged. (0.01 USDC on Base)
• POST /x402/x402-lint — Lint a seller's unpaid 402: body vs PAYMENT-REQUIRED header fields, EIP-55 checksums, method conflicts. One unpaid read, never pays. Signed, logged result. (0.01 USDC on Base)
• GET /x402/offer-receipt-verify (0.01 USDC on Base)
• POST /x402/mcp-audit — Security audit of a public MCP server before you connect: tool poisoning (hidden instructions in tool descriptions and schemas), shadowing, risky capabilities, annotation mismatches, transport errors, and a tool fingerprint to catch silent changes. Reads initialize + tools/list only. Signed, logged report. (0.8 USDC on Base)
• GET /x402/injection-scan (0.01 USDC on Base)
• GET /x402/mcp-audit (0.8 USDC on Base)
• GET /x402/mcp-check (0.01 USDC on Base)
• GET /x402/proof-of-publication (0.5 USDC on Base)
• GET /x402/timestamp (0.01 USDC on Base)
• GET /x402/x402-lint (0.01 USDC on Base)
• GET /x402/citation-check (0.05 USDC on Base)
• GET /x402/delivery-receipt-verify (0.01 USDC on Base)
• GET /x402/log-witness (0.01 USDC on Base)

+1 more endpoint.

MCP tools (23)

MYCELIX https://neo-collettive.onrender.com/mcp

• jarvis_render_deploys — List recent Render deploys for Jarvis.
• jarvis_render_logs — Read recent Render logs for Jarvis.
• jarvis_render_status — Read Jarvis Render service status using the shared Render API credentials.
• neo_ask_agents — Find public A2A agents and ask several independently.
• neo_collective — Run two collective rounds: independent answers, then peer critique.
• neo_director — Coordinate external agents to research revenue opportunities. Research-only; no spending or external actions.
• neo_director_results — Return recent compact Director results from the runtime log.
• neo_discover — Search public A2A agents and the official MCP Registry.
• neo_inspect_mcp — Discover relevant MCP servers and inspect initialize/tools-list only. Never invokes remote tools.
• neo_jarvis — Ask the configured internal Jarvis endpoint. Requires JARVIS_URL on Render.
• neo_preflight — Check whether NEO can reach public discovery registries.
• neo_render_deploys — List recent Render deploys for NEO.
• neo_render_logs — Read recent Render logs for NEO.
• neo_render_status — Read NEO's Render service status.
• neo_web_search — Search the public web using a free RSS search surface. No paid API key.
• oxibay_doctor — Free, no API key. Read-only MCP diagnostic. Reuses MYCELIX endpoint verification, classifies technical failures, and optionally compares the requested capability with declared tool metadata. Never invokes remote tools, never forwards credentials, and never affects commercial gates.
• paid_citation_check — Catch invented or stitched citations before an answer ships: up to 8 quote-and-link pairs (or the citations extracted from the text) checked against the live pages, each one graded verbatim, paraphrase, stitched or not found. One signed, logged report. Free signed sample: /x402/citation-check/sample. Paid per call via x402 (USDC on Base). Call without payment to get the requirements (isError result, 402 object in structuredContent); retry with the signed payment in _meta['x402/payment']. Result is signed by neo and logged.
• paid_injection_scan — Know whether a text or public page is trying to steer your agent before the agent reads it: overrides, fake roles, exfiltration, tool abuse, payment requests, invisible Unicode or HTML-hidden text, base64 payloads. Rule-based evidence (what matched and where), signed and logged, with what was not checked stated. Free signed sample: /x402/injection-scan/sample. Paid per call via x402 (USDC on Base). Call without payment to get the requirements (isError result, 402 object in structuredContent); retry with the signed payment in _meta['x402/payment']. Result is signed by neo and logged.
• paid_mcp_audit — Know what an MCP server can do to your agent before connecting it: hidden instructions in tool descriptions and schemas, tool shadowing, risky capabilities, annotation mismatches, transport faults, plus a fingerprint of every tool so a later silent change is detectable. Read-only (initialize and tools/list). Signed report, logged in a public witnessed log, with what was and was not checked. Free signed sample: /x402/mcp-audit/sample. Paid per call via x402 (USDC on Base). Call without payment to get the requirements (isError result, 402 object in structuredContent); retry with the signed payment in _meta['x402/payment']. Result is signed by neo and logged.
• paid_proof_of_publication — Keep evidence that a public page said something, dated and independent of you: the fetched text, its sha256, final URL and status, signed by a third party and written to a public append-only log anchored daily on Bitcoin and Software Heritage. Useful for disputes, deleted pages and changed terms. Free signed sample: /x402/proof-of-publication/sample. Paid per call via x402 (USDC on Base). Call without payment to get the requirements (isError result, 402 object in structuredContent); retry with the signed payment in _meta['x402/payment']. Result is signed by neo and logged.
• paid_timestamp — Prove that a file or message existed at this time without revealing it: its sha256 gets a signed receipt with a position in a public log anchored daily on Bitcoin (OpenTimestamps) and Software Heritage. Free signed sample: /x402/timestamp/sample. Paid per call via x402 (USDC on Base). Call without payment to get the requirements (isError result, 402 object in structuredContent); retry with the signed payment in _meta['x402/payment']. Result is signed by neo and logged.
• verify_mcp_endpoint — Free, no API key. Read-only verification of a public MCP HTTPS endpoint or official Registry server name. Checks DNS/SSRF safety, TLS/HTTP reachability, initialize, tools/list schema sanity, latency and discovery metadata. Never invokes remote tools or forwards credentials.
• verify_quote — Free, no API key. Checks whether an exact sentence appears on a public HTTPS page: verbatim (quotes cut with '...' allowed if the pieces are in order and close), stitched (pieces far apart or reordered), paraphrase (most 4-word runs present), not_found or unreachable. not_found means these words are not on the page; it does NOT mean the claim is false (a faithful rewording also reads not_found). Use it before acting on another agent's quote: one link + the exact sentence. Read-only single GET, no login, no JavaScript, SSRF-checked; who wrote the page is still yours to judge.