Verdict L402

Endpoints (21 live)

• POST /v1/command-gate — For coding agents that run shell commands: approve, review or block. Text rules first (root deletion, download-and-run, key exfiltration, reverse shells, SQL destruction, persistence, privilege escalation), then a fake terminal that simulates the command without ever running it (decoy files, pipe an (0.0174 USDC on Base)
• POST /v1/web-guard — For agents that read web pages: finds what a human cannot see but an agent reads (HTML comments, CSS-hidden text, hidden attributes, invisible Unicode-encoded text) and tells whether those hidden instructions target an AI. Extraction by code, reading by the decision engine on the hidden text only. R (0.0215 USDC on Base)
• POST /v1/canary-check — Did a model reply leak what it should keep secret? Canary tokens and secret phrases searched by code (even split, spaced or uppercased), then paraphrases of the system prompt read by the engine. Returns clean, review or leak. (0.0092 USDC on Base)
• POST /v1/answer-gate — For model cascades: is the small model's answer usable, or should the larger model be paid? Detects refusal, evasion, off-topic answers, contradiction and incompleteness; decides accept, review or escalate. Does not fact-check without a source: provide the source to check substance. (0.0092 USDC on Base)
• POST /v1/terms-scan — Before an agent clicks "I accept": flags risky clauses in terms of service or contracts (auto-renewal, data resale, waiver of court or class action, liability cap, unilateral changes, exit penalties, IP grab). Flags, does not give legal advice. Returns accept, review_clauses or do_not_accept. (0.0174 USDC on Base)
• POST /v1/ask-human — For autonomous agents: before acting, continue or stop and ask? Estimates irreversibility, ambiguity of the instruction, missing information and risk, scaled to the stakes you declare. Returns proceed, proceed_with_check or ask_human with reasons. (0.0092 USDC on Base)
• POST /v1/mcp-vet — Before an agent installs an MCP server, skill or tool: is the description poisoned (hidden orders to the agent), does it ask for more permissions than its purpose, does it imitate a known tool? Code checks (lookalike names, broad permissions, hidden text) then a reading of the descriptions. Judges t (0.0215 USDC on Base)
• POST /v1/tool-output-guard — Tool results (MCP servers, APIs, search, file reads) are untrusted content the agent re-reads. Detects a result that gives orders to the agent, strays from what the tool should return or asks to send data (tool poisoning). Returns allow, review or block. (0.0133 USDC on Base)
• POST /v1/triage — Customer support triage and spam filter: classifies an inbound message by category and urgency, scores spam, and returns a routing decision (queue, escalate, review, discard). (0.0092 USDC on Base)
• POST /v1/grounding — Hallucination check for RAG: is a claim supported by the source text? Returns supported, unsupported, contradicted or uncertain with probabilities, so an agent can verify an answer before showing it. (0.0174 USDC on Base)
• POST /v1/firewall — Agent security guardrail. Judges the pair (untrusted content + proposed action) before an AI agent acts: detects tool calls that obey hidden prompt injection, leave the user's goal, destroy data or send data or money elsewhere. Adjustable sensitivity and optional multi-model consensus. Returns allow (0.0256 USDC on Base)
• POST /v1/payee-check — Invoice-fraud guard for AI agents that pay bills. Detects supplier bank-detail change fraud (BEC) before payment: checks the IBAN and sender domain against your supplier record (lookalike domains included), then reads pressure and off-channel requests. Returns ok, verify_callback or freeze_payment. (0.0501 USDC on Base)
• POST /v1/pointer — Computer-use agent helper. Send a screenshot (PNG/JPEG) and 1 to 8 element descriptions, get click coordinates (fractions and pixels) and the probability each UI element is really visible. Visual grounding for GUI automation and browser agents. (0.0256 USDC on Base)
• POST /v1/trade-audit — Reads your whole trade history and answers with exact laws, not a market forecast: is your edge proven (bootstrap, probabilistic Sharpe ratio, trades still needed), does your position size make you lose despite an edge (Kelly, volatility drag), did your edge die and when (CUSUM change detection), wh (0.1644 USDC on Base)
• POST /v1/trade-gate — Pre-trade risk check for traders and trading bots. Before an order is sent, checks it exactly against your own rules (risk per trade, daily loss, max loss, cooldown after a loss, trade quota, blocked hours, days and instruments, minimum reward to risk) and computes the largest size still allowed. If (0.0174 USDC on Base)
• POST /v1/sentiment — Sentiment from -1 to +1 with confidence, mixed-opinion flag and a separate score per aspect you name (price, support, delivery). Abstains when the text is ambiguous. (0.0174 USDC on Base)
• POST /v1/moderate — Semantic content moderation, not a word list: profanity (even disguised, any language), harassment, hate, sexual content, threats, self-harm, scams. Per-category scores, allow/review/block, configurable ignore list. (0.0092 USDC on Base)
• POST /v1/lead-qualify — Inbound lead qualification and routing for sales agents: spam, job application, vendor pitch, existing customer, or a real project with urgency. Hard rules first (disposable email, tests), returns a routing lane. (0.0215 USDC on Base)
• POST /v1/reply-guard — Output guardrail for customer-support chatbots. Blocks unauthorized promises, invented facts, leaked instructions or customer data, off-topic answers and bad tone before the reply is sent. Returns send, human_review or block. (0.0256 USDC on Base)
• POST /v1/pii-scan — PII detector that finds what regex misses (names, addresses, ID numbers, health data, credentials) and locates what patterns can verify (emails, valid IBANs, Luhn-checked cards, phones). Does not rewrite text. (0.0337 USDC on Base)

+1 more endpoint.

MCP tools (4)

Verdict L402 https://verdict.kechlab.com/mcp

• verdict_command_gate — Free sample. Before a coding agent runs a shell command, ask whether to allow, review or block it: root deletion, download and run, privilege escalation, secret exfiltration. Pass the human intent when you know it. Not a sandbox: it reads the command, it does not run it.
• verdict_firewall — Free sample. Before an agent acts on untrusted content (pay, send, delete, click, reply), give the human goal, the content it read and the action it proposes. Returns allow, review or block: it catches actions that follow orders hidden in the content.
• verdict_guard — Free sample. Before your agent reads untrusted text (web page, email, document, tool output), check it for prompt injection, data exfiltration requests, secrets and toxic content. Returns allow, review or block with scores and reasons. Use it on text you did not write. Do not use it to judge an action: use verdict_firewall.
• verdict_mcp_vet — Free sample. Before installing an MCP server, skill or tool: is its description poisoned (hidden orders to the agent, excessive permissions, look-alike names)? Returns allow, review or block with reasons.