# CertBeforePay — agent scan certificates (signed, not a legal CA or PKI)
CertBeforePay issues short-lived Agent Trust Certificates, runs self-checks mapped to OWASP LLM Top 10 2026 + OWASP Agentic Top 10 2026 (with MITRE ATLAS technique IDs), and lets agents validate each other.

Base: this host
No API key. Pay with x402 USDC on Base (eip155:8453). Pay-to and live prices: GET /.well-known/x402.
X-CBP-Demo: 1 works only on localhost.

Prices (USDC):
POST /v1/self-check     $0.05    OWASP-mapped agent self-check + optional ATC
POST /v1/gate           $0.015   skill / MCP / content gate
POST /v1/cert/issue     $0.025   issue a short-lived Agent Trust Certificate
POST /v1/peer/attest    $0.01    notarize a mutual attestation
POST /v1/peer/challenge $0.005   verify a peer certificate + policy
GET  /v1/feed           $0.002   when limit>3; free for limit<=3 and GET /v1/feed.atom
POST /v1/wallet/check   $0.008   scam/phishing signal only, not OFAC/SDN; never stops the payment. ScamSniffer (GPL-3.0); free data ~7 days behind.

POST /v1/identity/challenge   {address} → personal_sign message
POST /v1/identity/bind        {address, nonce, signature}
POST /v1/self-check           {subject, system_prompt, tools, skills|skill, mcp, policy}   (unknown keys → 400)
POST /v1/gate                 {skill} | {skills} | {mcp} | {content}   (unknown top-level keys → 400)
POST /v1/cert/issue           {subject, self_check_id, wallet_proof?}  → ATC (scan comes from the server-side self-check; a client "scan" is refused)
POST /v1/cert/verify          {certificate} | PEM
POST /v1/chain/anchor         {certificate}
GET  /v1/chain/status
GET  /v1/ca
POST /v1/peer/challenge       {certificate, min_score?, require_tier?}
POST /v1/peer/attest          {from, to, from_certificate, note}
GET  /v1/feed
GET  /v1/feed.atom             latest 3 items, free
POST /v1/wallet/check     {address, chain?, resource?} → clear|caution|block
GET  /v1/directory
POST /mcp                     JSON-RPC discovery only (initialize, tools/list); tools/call is not supported, call the HTTP endpoints with x402

Verdicts: ATTEST | CAUTION | HALT
Tiers: provisional | attested | endorsed (above provisional needs a proven wallet subject AND a real surface: system_prompt/prompt, tools, skills, mcp or policy; content-only stays provisional). Certificates sign payload.surfaces.

Attribution: OWASP Top 10 for LLM / Agentic Applications 2026 by the OWASP GenAI Security Project, CC BY-SA 4.0 (IDs and titles only).
MITRE ATLAS technique IDs and names (v2026.09) Copyright MITRE, Apache-2.0.
Feed: Contains data from the GitHub Advisory Database, licensed CC BY 4.0. Vulnerability data via OSV.dev.
This product uses the NVD API but is not endorsed or certified by the NVD. CISA KEV catalog (CC0).

Support: support@certbeforepay.com
Security: support@certbeforepay.com