{"uid":"cap_x7fRyGpxMUWBtcAR46vY0","slug":"massat-agent-security-audit-c651b944","name":"MASSAT Agent Security Audit","description":"Independent multi-agent security audit (OWASP ASI01-ASI10 coverage) of a counterparty agent or MCP server before you grant it tool access or spend authority. Findings are Merkle-committed and the audit report is signed.","url":"https://api.craigmbrown.com/v1/services/security.massat-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"owner":{"type":"string"},"scope":{"enum":["quick","full"],"type":"string","default":"full"},"anchor":{"type":"boolean","default":false},"target":{"type":"string"},"subject":{"type":"object","properties":{"manifest":{"type":"object"},"artifacts":{"type":"object"},"capabilities":{"type":"array"},"declared_tools":{"type":"string"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"5","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$5/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"5","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"5","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_dUN5GOtXovdSbYIRbWLKP","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"5","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Runs an independent multi-agent OWASP ASI01-ASI10 security audit on a counterparty agent or MCP server, returning signed Merkle-committed findings before you grant it tool access or spend authority.","exampleAgentPrompt":"Before I connect the FinanceBot MCP server to my wallet agent, run a full OWASP ASI01-ASI10 security audit on it — use its manifest and declared tools — and give me a signed risk report with any findings and remediation steps.","exampleUseCases":[{"title":"Pre-integration MCP server vetting","prompt":"I'm about to plug a third-party MCP server called 'DataFetch Pro' into my agent pipeline. Can you run a full security audit on it using its manifest and capabilities list before I grant it any tool access?"},{"title":"Spend authority gating for financial agents","prompt":"I need to decide whether to give this external trading agent spend authority on my account. Run a quick OWASP ASI security audit on it and tell me the risk score and any critical findings before I approve anything."},{"title":"Tamper-evident compliance record","prompt":"We're onboarding a new AI agent vendor and our compliance team needs a signed, Merkle-committed audit report showing full ASI01-ASI10 coverage was done. Can you run the full audit on their agent manifest and artifacts and give me the proof-of-audit ID?"}],"resultDescription":"A JSON object containing: a status (completed, insufficient_subject, or input_blocked), a unique proof_of_audit_id, a Merkle root and audit hash for tamper-evidence, a numeric risk_score and categorical risk_level, an array of findings each tagged with OWASP ASI category (ASI01-ASI10), severity, detail, and remediation advice, a result_summary, evidence_class, score_semantics, and powered_by (BlindOracle). Optionally includes credentials and next_step guidance.","failureModes":["insufficient_subject: returned when the submitted manifest/artifacts/capabilities do not provide enough information to complete the audit","input_blocked: returned when the target input is flagged as invalid or unsafe to process","Missing required fields (target or subject) may result in a 400-level error","Network or provider downtime may cause timeouts","Partial manifests may result in incomplete ASI coverage with lower confidence findings"],"whenToPreferThis":"Choose this endpoint when you need an independent, cryptographically verifiable security assessment of a counterparty agent or MCP server before granting it any tool access or financial authority — especially when OWASP ASI01-ASI10 compliance coverage and a tamper-evident signed audit trail are required. Prefer this over generic reputation checks or self-attested agent metadata when the stakes involve spend authority or sensitive tool permissions.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T06:43:40.739Z","isFirstParty":false,"canonicalSlug":"massat-agent-security-audit-c651b944"}