API Health Audit for developers and agents: give one public API endpoint URL (optional method, headers, body) and get a production-readiness report: latency min/median/p95/max over 10 light samples, error rate and uptime spot estimate, status codes, JSON schema consistency, security headers (HSTS, CSP, CORS, nosniff, cookies), TLS and certificate expiry from CT logs, plus a plain-English verdict with concrete fixes. $9 USDC per run on Base; unreachable targets are not charged. By DevX.
Credit: 402 Index (MIT)
Automated Solidity pre-audit: send source (or a verified contract address + chain) and get a severity-ranked report: reentrancy, access control, unchecked calls, tx.origin, delegatecall, selfdestruct, integer issues, approvals, oracle/signature flaws, plus owner rug powers (mint, pause, blacklist, fees, withdraw) and honeypot patterns. Triage, not a human audit. $99 USDC on Base; failed runs not charged. By DevX. Automated pre-audit (static pattern analysis). It flags common vulnerability classes and owner powers so you can triage and fix before paying for a human audit. It can miss issues and
Credit: 402 Index (MIT)
x402 preflight: before your agent signs a payment, fetch a paywalled URL's 402 and lint it. Parses v1 bodies and v2 PAYMENT-REQUIRED headers, then checks each accepts[] option: known network, canonical USDC, EIP-712 domain (extra.name/version) that a signature will verify against, EIP-55 payTo, zero/contract payTo, amount sanity, timeout, testnet, resource-host mismatch. Returns ok/warn/block per option, findings and the recommended option.
Credit: 402 Index (MIT)
Before an AI coding agent (or you) runs a GitHub repo's install steps: scans README, package.json install scripts, install.sh/setup.py, .vscode/tasks.json and Makefile for download-and-execute one-liners (iwr|iex, curl|sh), obfuscated or base64 payloads, known malware domains, typosquatted crypto dependencies, agent-targeted prompt injection and password-protected archives, plus GitHub signals of fake stars and new owner accounts. 1-3 repos per call.
Credit: 402 Index (MIT)
Phishing / impersonation check for crypto links before an agent or person connects a wallet or signs: brand lookalikes & typosquats of 60 wallets/exchanges/dapps, punycode, domain age (RDAP), DNS, redirects, and a page scan for seed-phrase prompts and approval-drainer code. 1-10 URLs per call.
Credit: 402 Index (MIT)
apiaudit.madebydevx.com, crypto-link-check.nextill-pos.workers.dev, repo-run-check.nextill-pos.workers.dev, scaudit.madebydevx.com, sweeper-check.nextill-pos.workers.dev and 1 more
First listed on PayAPI Market
2026-10-30
Questions about this provider
What APIs does Unclaimed offer?
Unclaimed has 6 live APIs on PayAPI Market with 6 endpoints in total, in Verification, Tools, Finance: DevX API Health Audit, DevX Smart-Contract Pre-Audit, DevX 7702 Sweeper Check, DevX x402 Preflight, DevX Repo Run Check, and 1 more.
Are Unclaimed's APIs verified?
Not yet. Unclaimed's listings are live and answer an x402 payment challenge, but PayAPI Market has not paid for a call to them, so none carries a settlement-verified badge.
How do I pay for Unclaimed's APIs?
Per request, in USDC, over the x402 protocol. An agent calls the endpoint, receives HTTP 402 with the price and wallet, pays and retries. There is no API key, account or subscription, and Unclaimed keeps 100% of each payment.