Agent Trust and Compliance. Five endpoints an autonomous agent can call before it trusts a counterparty domain or address, each backed by a real live check (no simulated or bundled-static data). POST /v1/domain-trust (domain): RDAP registration data + DNS (MX/SPF/DMARC/DNSSEC) -> a 0-100 trust score. POST /v1/brand-verify (domain, brand_name?): a live TLS certificate handshake -> validity, organization-validation, SAN coverage, and an optional brand-name match against the certificate identity. POST /v1/seller-trust (url): a composite of both for one resource-server URL, with a trusted/proceed_with_caution/high_risk recommendation. POST /v1/sanctions-check (address): the U.S. Consolidated Screening List (OFAC SDN + 10+ other restricted-party lists), requires an operator-supplied free API key. POST /v1/reputation (chain, address): an EVM address's on-chain activity/verification/scam-flag signal via public Blockscout explorer instances (eth, base, arbitrum, polygon). Every score is 0-100 with a 'reasons' array explaining exactly how it was computed. All outbound domain/IP lookups are guarded against private/loopback/link-local targets.
