# Kertivo

> Kertivo exists so machines can trust who they pay.
> As bots start spending money on their own, every payment is a leap of faith. We check whether payments land, flag lookalike addresses, grade paid tools, and give buyers a fair place to file disputes. Our grades are earned, never bought. We show our work, and we change as this new economy changes. Trust is our keystone.

One-liner: Kertivo is the trust layer for bot-to-bot payments. Grades are earned, never bought.

How Index grades are made: we pay each listed endpoint with real USDC, confirm the payment settled on Base, then check what came back (HTTP status, whether the body matches the endpoint's own declared output example, and latency). Paid but nothing usable delivered = F. Settlement-only observers see that a payment landed, not whether the buyer got a working answer; Index grades measure both. Look one up free (GET /trust/lookup?url=) or with evidence and claims for $0.002 (POST /trust/lookup). We are not the only pre-payment check; use more than one signal when the stakes are high.

Products: Kertivo Index (grades), Kertivo Check (payment verify), Kertivo Shield (address check), Kertivo Claims (disputes), Kertivo Logs (https://logs.kertivo.com/).

Contact: contact@kertivo.com. Graded providers can email it to dispute a grade or add context; we publish relevant replies. Replies never change grades; only paid runs do.

Payment: x402 v2, scheme exact, network eip155:8453 (Base mainnet), asset USDC, payTo 0x509E55c4F898B43C856Fb0E51048B1b7bFBC9eDE. Call a paid route without payment to get the HTTP 402 with exact requirements, then retry with the payment header (any x402 client SDK does this). Evidence only: no custody, no arbitration.

## Paid routes (USDC per call)

- POST /check ($0.01): Verify a Base USDC payment by txHash (aliases tx_hash/hash) or EIP-3009 authorization {from, nonce, validBefore}. Optional expectedPayTo (aliases to/recipient), expectedAmount (aliases amount; exact match), minAmount (aliases min_amount/min; a floor), expectedPayer (aliases from/payer; when txHash is given), chain=base (other chains 400, not charged), token=USDC (aliases asset/currency; USDC symbol or Base USDC contract; other tokens 400, not charged; answers always echo token USDC). Unused fields are echoed in ignoredFields. Returns settlement verdict, real-USDC transfers, recipient/amount match, fake-token and lookalike-address warnings, and who funded the payer (external | self_funded | unknown).
- POST /check/deep ($0.05): Did this payment settle, and what is the payer's funding source? Same body as /check but txHash is required (authorization-only bodies get 400, not charged); reads the payer's funding history from an index (latest 500 transfers before the payment, then up to 5 more pages; coverage.historyComplete says if that was the full history), with coverage stats and a recheckable sha256 receipt. Returns 503 and does not charge if the index is down.
- POST /address/check ($0.001): Body {from, to, contacts?} (aliases sender/recipient/address/known_addresses; optional chain=base, token=USDC — other chains/tokens 400, not charged): address-poisoning check before sending USDC (recent block window, honest partial coverage). No sender? {recipient, known_addresses} (dailyelo-style) or {address, known} runs a contacts-only lookalike check: no RPC scan, coverage.source contacts_only. Only {address} (Verdix-style, optional chain=base)? Recipient-only: scans that address's OWN recent USDC history for poisoning fingerprints (zero-value-only inbound = high; sub-cent-only or no activity = medium), coverage.mode recipient_only, recipient{fingerprint,...}. Unused fields are echoed in ignoredFields.
- POST /address/check/full ($0.005): Body {from, to}: address-poisoning check against full transfer history. Not charged if the index is down.
- POST /trust/lookup ($0.002): Body {url}: Kertivo Index grade and evidence for an x402 endpoint, plus public claims against it. Extra fields (e.g. method, body, deep) are not used and are listed back in ignoredFields.

GET works too, same price and result: GET /check?txHash=0x...&expectedPayTo=0x...&expectedAmount=0.01 (or ?from=&nonce=&validBefore= for an EIP-3009 authorization; also /check/deep), GET /address/check?from=0x...&to=0x...&contacts=0x...,0x... (or contacts-only ?recipient=0x...&known=0x...,0x..., or recipient-only ?address=0x...), GET /address/check/full?from=0x...&to=0x... . Unpaid GET returns the same 402; retry the same GET with the payment header.

## Free routes

- POST /demo: free sample /check result on a fixed real transaction; send your real /check body to rehearse your field mapping (aliases, ignoredFields, 400 guards, match) for free
- POST /demo/address: free sample /address/check (contacts-only) on a fixed lookalike fixture; same shape as paid Shield, $0, body ignored
- GET /trust/lookup?url=: free grade + index date for one endpoint
- GET /trust-index: HTML scorecard of x402 endpoints graded by real paid calls (Kertivo Index; grades earned, never bought). Graded sellers: /trust-index#self-check for a daily free GET or $0.002 POST /trust/lookup of your own endpoint (reads grade/claims only; does not change grades)
- GET /trust-index/latest.json: machine-readable latest Kertivo Index
- GET /badge/<url-encoded endpoint>: live "Kertivo verified" SVG grade badge from the latest Kertivo Index (also `.svg` suffix, or GET /badge?url=<endpoint>). Earned, never sold; ungraded endpoints show "not graded"; 1h cache; headers x-kertivo-grade, x-kertivo-evidence, x-kertivo-run-date, x-kertivo-state; an endpoint graded earlier but not in the latest run shows "last graded <grade> · <date>". GET /badge/<url-encoded endpoint>/evidence lists every run it appeared in (date, grade, payment tx), newest first (?format=json for JSON). Markdown/HTML embed snippets: /trust-index (Get your badge)
- GET /trust-index/runs: every published Kertivo Index run, append-only (never rewritten), each at /trust-index/runs/<n>.json and .jsonl with sha256
- POST /claim: free claims desk: paid an x402 endpoint but got no or bad response? File public, hash-recheckable evidence
- GET /claim/:id, GET /claims?endpoint=: read claims
- POST /claim/:id/response: seller answers a claim, signed by its payTo
- GET /stats: aggregate usage counters (no addresses; byPayerClass.outside excludes internal fee payers; per-route ignoredFieldNames/ignoredFieldNamesOutside count unused request field names, never values)
- GET /benchmarks/address-poisoning: dated benchmark: POST /address/check on 20 fresh live Base USDC poisoning attempts plus an aged set (~24 h old: cheap tier vs /address/check/full vs contacts), results, tx links, limitations
- GET /examples: copy-paste integration recipes: curl 402 handshake, JS client that pays /check, verify a payment you just made to another seller
- GET /guard.mjs: Kertivo Guard: zero-dependency x402 client hook (client.onBeforePaymentCreation) that checks every seller before your agent pays: blocks F grades and disputed endpoints for free, and with your payFetch also blocks a payTo swap via paid POST /trust/lookup (once per seller per day)
- GET /openapi.json: full OpenAPI 3 spec with x402 discovery fields
- GET /robots.txt: crawl policy: Allow /, sitemap URL, and content signals search=yes, ai-input=yes, ai-train=yes
- GET /sitemap.xml: public URL list for crawlers (published pages only; unpublished stubs are omitted)
- GET /.well-known/attestation: signed responses: every 200 JSON from /check, /check/deep, /address/check(/full), paid /trust/lookup, JSON /claim/:id, /demo and /demo/address carry `attestation` (EIP-191 signature over the body hash, route, time and a fixed statement of what the result means). This route publishes the signer (not a wallet, holds no funds) and how to verify
- GET /.well-known/agent.json: ERC-8004 registration-v1 shaped agent file (also /agent.json). Publishes name, services, x402Support, the response signer from /.well-known/attestation, and Base Identity Registry agentId 149639 (mint tx 0x9271…84b0; owner = payTo).
- GET /.well-known/infoharmoni-square.txt: Infoharmoni Square wallet proof: serves `sig mb:hectichustlebot 0x<signature>` (payTo's EIP-191 signature) to prove payTo ownership once the sig line is present; 404 not proven until then
- GET /privacy: what Kertivo stores, what stays public on Base, and that grades are not sold (?format=json for the same facts)
- GET /terms: grades are information from a dated paid run; no warranty; not financial advice; corrections and the right of reply go to the public contact (?format=json for the same facts)
- GET /machine.json: index of every human page's JSON twin. New pages use a sibling .json path (/guides/foo -> /guides/foo.json) with fields url, canonical_html, title, updated, license, data. Pages that already had JSON keep that URL (?format=json or an existing file). license is null unless a page states one
- GET /trust-index.json: JSON twin of the Trust Index scorecard (same run as /trust-index/latest.json, plus the methodology text on the page)
- GET /guides.json: JSON twin of the guides index; each guide is /guides/<slug>.json and the method page is /guides/about.json

## Quick start

Verify before you pay: curl -sO https://paycheck.hectichustle.workers.dev/guard.mjs, then client.onBeforePaymentCreation(kertivoGuard({ payFetch })) on your @x402/fetch x402Client. Every payment your agent makes is checked against the Kertivo Index first.

npm i @x402/fetch @x402/evm viem, wrap fetch with wrapFetchWithPaymentFromConfig + ExactEvmScheme on eip155:8453, then POST /check {txHash, expectedPayTo?, expectedAmount?}. After paying another x402 seller, decode its PAYMENT-RESPONSE header (decodePaymentResponseHeader) and pass .transaction as txHash. Full copy-paste code: https://paycheck.hectichustle.workers.dev/examples

## Links

- [Integration examples](https://paycheck.hectichustle.workers.dev/examples)
- [Kertivo Guard, verify before you pay (x402 client hook)](https://paycheck.hectichustle.workers.dev/guard.mjs)
- [Developer docs](https://paycheck.hectichustle.workers.dev/docs) (generated from the OpenAPI document; JSON twin https://paycheck.hectichustle.workers.dev/docs.json)
- [OpenAPI spec](https://paycheck.hectichustle.workers.dev/openapi.json)
- [robots.txt](https://paycheck.hectichustle.workers.dev/robots.txt)
- [Sitemap](https://paycheck.hectichustle.workers.dev/sitemap.xml)
- [x402 manifest](https://paycheck.hectichustle.workers.dev/.well-known/x402)
- [Signed-response key](https://paycheck.hectichustle.workers.dev/.well-known/attestation)
- [ERC-8004 agent registration](https://paycheck.hectichustle.workers.dev/.well-known/agent.json)
- [Kertivo Index scorecard](https://paycheck.hectichustle.workers.dev/trust-index)
- [Guides](https://paycheck.hectichustle.workers.dev/guides)
  - [Did my x402 payment settle on Base?](https://paycheck.hectichustle.workers.dev/guides/did-my-x402-payment-settle)
  - [How do I verify a USDC payment I just made to another seller?](https://paycheck.hectichustle.workers.dev/guides/verify-usdc-payment-to-another-seller)
  - [What is address poisoning, and how do I check a USDC recipient before I send?](https://paycheck.hectichustle.workers.dev/guides/what-is-address-poisoning)
  - [How do I check if an x402 API is trustworthy?](https://paycheck.hectichustle.workers.dev/guides/is-this-x402-api-trustworthy)
  - [What does a Kertivo Index grade mean (A / B / F / went-dark)?](https://paycheck.hectichustle.workers.dev/guides/what-does-a-kertivo-index-grade-mean)
- [Machine views](https://paycheck.hectichustle.workers.dev/machine.json) (JSON twin of every human page)
- [Tools](https://paycheck.hectichustle.workers.dev/tools) (this page is not published yet)
- [Directory](https://paycheck.hectichustle.workers.dev/directory) (this page is not published yet)
- [About](https://paycheck.hectichustle.workers.dev/about) (this page is not published yet)
- [Status](https://paycheck.hectichustle.workers.dev/status)
- [Privacy](https://paycheck.hectichustle.workers.dev/privacy)
- [Terms](https://paycheck.hectichustle.workers.dev/terms)
- [Address-poisoning benchmark](https://paycheck.hectichustle.workers.dev/benchmarks/address-poisoning)
- [Home](https://paycheck.hectichustle.workers.dev/)

## Route index

This list is generated from the OpenAPI document. A path here is a path in /openapi.json.

- POST /check ($0.01)
- GET /check ($0.01)
- POST /check/deep ($0.05)
- GET /check/deep ($0.05)
- POST /trust/lookup ($0.002)
- GET /trust/lookup
- POST /address/check ($0.001)
- GET /address/check ($0.001)
- POST /address/check/full ($0.005)
- GET /address/check/full ($0.005)
- POST /claim
- GET /claim/{id}
- POST /claim/{id}/response
- GET /claims
- GET /trust-index
- GET /trust-index.json
- GET /machine.json
- GET /guides.json
- GET /guides/{slug}.json
- GET /trust-index/latest.json
- GET /trust-index/raw.jsonl
- GET /badge/{id}
- GET /badge/{id}/evidence
- GET /trust-index/runs
- GET /trust-index/runs/{file}
- GET /stats
- POST /demo
- POST /demo/address
- GET /
- GET /openapi.json
- GET /examples
- GET /llms.txt
- GET /.well-known/llms.txt
- GET /.well-known/x402
- GET /.well-known/attestation
- GET /.well-known/agent.json
- GET /agent.json
- GET /.well-known/infoharmoni-square.txt
- GET /benchmarks/address-poisoning
- GET /sitemap.xml
- GET /robots.txt
- GET /privacy
- GET /terms
- GET /docs
- GET /docs.json
- GET /guides
- GET /guides/about
- GET /guides/{slug}
- GET /guard.mjs
- GET /trust-index/schema
- GET /trust-index/schema.json
- GET /trust-index/schema.md
- GET /badge
- GET /.well-known/security.txt
- GET /security.txt
- GET /tools
- GET /directory
- GET /about