onyx-actions

{
  "name": "onyx-actions",
  "description": "The independent trust & verification layer for the agentic web — the signed check an AI agent runs BEFORE it pays or transacts. Returns a hard PROCEED / REVIEW / HOLD clearance plus Ed25519-signed FACTS any third party can verify offline (tamper -> rejected). Neutral by design — earns nothing from any tx, so it grades what conflicted incumbents structurally cannot. Facts, not judgments.",
  "url": "https://onyx-actions.onrender.com/a2a",
  "version": "1.0.0",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false,
    "extensions": [
      {
        "uri": "https://github.com/google-agentic-commerce/ap2/tree/v0.1",
        "description": "Onyx participates in AP2 agentic-payment flows as a merchant: agents pay Onyx for signed verification under an AP2 Cart Mandate.",
        "required": false,
        "params": {
          "roles": [
            "merchant"
          ]
        }
      },
      {
        "uri": "https://github.com/google-a2a/a2a-x402/v0.1",
        "description": "Supports payments using the x402 protocol for on-chain settlement (USDC on Base). Activate via the X-A2A-Extensions header.",
        "required": false
      },
      {
        "uri": "https://onyx-actions.onrender.com/ext/usage-rights/v0",
        "description": "usage-rights-envelope/v0 — signed, hash-bound declaration of what a buyer may do with a purchased output (resale/redistribute/derivatives/retrain/cache_ttl). Data-only: envelope rides Artifact.metadata.usage_rights or the X-Onyx-Rights HTTP header.",
        "required": false,
        "params": {
          "spec": "usage-rights-envelope/v0",
          "free_verify": "https://onyx-actions.onrender.com/verify",
          "policy": "https://onyx-actions.onrender.com/.well-known/rights.json"
        }
      }
    ]
  },
  "authentication": {
    "schemes": [
      "x402"
    ]
  },
  "defaultInputModes": [
    "application/json"
  ],
  "defaultOutputModes": [
    "application/json"
  ],
  "skills": [
    {
      "id": "onyx_agent_verify",
      "name": "Agent Verify",
      "description": "Signed agent liveness + authenticity oracle. Give an A2A agent's card URL or endpoint; Onyx sends two distinct challenge messages and reports whether it is ALIVE (different, on-topic replies), HOLLOW (same canned string to both — passes reg",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_ai_visibility",
      "name": "Ai Visibility",
      "description": "AI answer-engine visibility (GEO) oracle. Give a brand/product (+ optional category and competitors); get a SIGNED reading of how a live web-grounded answer engine represents it right now — presence, whether it's in the 'best <category>' re",
      "tags": [
        "data",
        "signed-data",
        "ground-truth",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_attestation_verify",
      "name": "Attestation Verify",
      "description": "Verify an Onyx-signed security verdict. Paste back any result from an Onyx tool (the full JSON including its onyx_attestation block); get a cryptographic verdict: is the Ed25519 signature valid, was it signed by Onyx (kid), and has any fiel",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_contract_audit",
      "name": "Contract Audit",
      "description": "Full smart-contract security audit for any Base address — source + DEPLOYED reality + AI, SIGNED. Fetches verified source, runs curated static vuln detectors (tx.origin auth, delegatecall, selfdestruct, unchecked calls, unprotected init, ow",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_market_rank",
      "name": "Market Rank",
      "description": "Signed, conflict-free rating of any agent/x402 service — 'Moody's for the agentic web'. Point it at a URL; it probes observable reality (live, discoverable, payable, breadth, transparency) and returns a 0-100 rating + A-F grade, Ed25519-sig",
      "tags": [
        "data",
        "signed-data",
        "ground-truth",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_merchant_fact_check",
      "name": "Merchant Fact Check",
      "description": "Pre-checkout merchant fact oracle. Give a storefront domain (optionally the brand you believe it is, and an expected price); get Ed25519-signed raw observations: domain registration age + registrar (RDAP), live TLS certificate age + issuer,",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_research_intel",
      "name": "Research Intel",
      "description": "Research intel — has someone solved X already? Queries 240M+ academic works via OpenAlex (includes arXiv preprints, conference papers, journal articles), ranks by citation count + recency + relevance, returns top N papers with one-line abst",
      "tags": [
        "data",
        "signed-data",
        "ground-truth",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_retail_price_check",
      "name": "Retail Price Check",
      "description": "Ground-truth retail oracle. Give a product URL; get the real current price, currency, and in-stock state as actually fetched now — with the extraction source (JSON-LD / OpenGraph / microdata) as evidence. Covers the long tail of no-API shop",
      "tags": [
        "data",
        "signed-data",
        "ground-truth",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "rhinogent_verify_counterparty",
      "name": "Rhinogent Verify Counterparty",
      "description": "Know-your-counterparty for agents. Before your agent pays a merchant, get Ed25519-signed raw facts about who it's paying: domain registration age, live TLS cert, reachability + off-domain redirects, brand-impersonation similarity, and obser",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_secure_payment",
      "name": "Secure Payment",
      "description": "Secure-transaction RAIL: one signed clearance before an agent sends funds. Give recipient + amount (and optionally a contract address or counterparty ERC-8004 agent id); Onyx runs the full security stack — recipient firewall, contract audit",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_signature_guard",
      "name": "Signature Guard",
      "description": "Pre-signature firewall for OFF-CHAIN drains — the check before your agent signs an EIP-712 typed-data message (Permit, Permit2, Seaport order). These drain a wallet with no on-chain approval: the signature itself is the authorization. Give ",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_token_risk",
      "name": "Token Risk",
      "description": "Signed token-security oracle. Give a token contract (and chain); get the real on-chain risk facts as read right now — honeypot status, buy/sell tax, mintable, ownership-reclaim, transfer-pausable, proxy, LP-lock, holder count — plus a trans",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_tx_guard",
      "name": "Tx Guard",
      "description": "Pre-payment security firewall. Give the recipient address your agent is about to pay (Base); get a SIGNED ALLOW/REVIEW/BLOCK verdict + risk score from real on-chain checks: EOA-vs-contract, contract code/verification, account age (tx count)",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_verify_explain",
      "name": "Verify Explain",
      "description": "Diagnose a failing x402 v2 /verify. Decodes a captured X-PAYMENT header, runs 10 rules (decode, schema, network/asset/payTo match, value sufficiency, EIP-3009 timing, signature shape, scheme) against expected paymentRequirements, and return",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    },
    {
      "id": "onyx_x402_receipt_verify",
      "name": "X402 Receipt Verify",
      "description": "Verify an x402 USDC settlement on Base or Base Sepolia. Given a tx hash, decodes the USDC Transfer log and confirms (or refutes) a claim of the form: 'tx X moved $Y USDC from A to B'. Returns success status, actual decoded values, and a cle",
      "tags": [
        "security",
        "verification",
        "trust",
        "x402",
        "ed25519-signed"
      ]
    }
  ],
  "preferredTransport": "HTTP+JSON"
}