How it works.
Pay-per-use verification over x402 on Base mainnet and Solana
A fixed price, no account.
Each Cybercentry service is a fixed-price API. Instead of accounts or API keys you pay per call with x402, an HTTP-native payment handshake. Agents and clients discover the catalogue via /openapi.json and invoke any service by POSTing JSON, paying automatically.
What's here.
The homepage: every service with its price, category and chain, plus the live exploit feed.
Machine-readable discovery doc (OpenAPI + x-payment-info) so agents, clients, and x402scan can find and invoke the paid services.
One x402-gated endpoint per service: POST JSON (the canonical call method; GET with query params also works), priced at its catalog value. Returns the deliverable.
A demo page guarded by Next.js middleware (proxy.ts): browsers see a paywall and pay with a connected wallet.
The payment flow.
On the storefront, fill a service's inputs and hit Pay (or call /api/services/<service> directly). No payment is attached yet.
The server replies 402 Payment Required with a PAYMENT-REQUIRED header describing what it accepts: scheme "exact", network Base, the service's price in USDC, and the address to pay.
The wallet builds an "exact" payment authorization and signs it (no on-chain tx yet), then retries the request with a PAYMENT-SIGNATURE header.
The server forwards the payment to the facilitator, which verifies the signature and settles the transfer on Base. No private keys live on this server.
On success the server returns the service's deliverable (200) plus a PAYMENT-RESPONSE header with the settlement details (transaction hash, payer, amount).
Call it yourself.
Get USDC (and a little ETH) on Base in your wallet.
Open the homepage, pick a service, fill its inputs and hit Pay.
Or call an endpoint directly: without payment you get a 402.
curl -i -X POST "https://centry.cybercentry.co.uk/api/services/wallet_verification" \
-H "Content-Type: application/json" \
-d '{"wallet_address":"0x..."}'POST JSON is canonical; GET with query params also works
Headers in play.
For agents (Model Context Protocol).
Every service is also a Model Context Protocol (MCP) tool, so an agent can call it, and pay for it, without a human in the loop. Point any MCP client at the endpoint opposite.
Free in any client. list_services and recent_exploits need no payment, so an agent can discover the catalogue and the live threat feed before spending anything.
Paid tools, two ways. Agents built on @x402/mcp pay per call from a wallet. Every other client (Claude Desktop, Cursor and the rest do not speak x402) passes a subscription token instead, either as a subscription_token argument or an X-Subscription-Token header.
Call a paid tool with neither and you get a JSON-RPC 402 carrying the accepts array, so a paying client knows exactly what to send and retry with.
https://centry.cybercentry.co.uk/api/mcpcurl -X POST "https://centry.cybercentry.co.uk/api/mcp" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Common questions.
- Do I need an account or an API key?
- No. There is no signup, no API key and no monthly minimum. A client that speaks x402 pays per call from a wallet; one that does not can use a subscription token. Two tools, the catalogue and the exploit feed, are free and need no wallet at all.
- What happens if a call fails?
- You are not charged. The verification runs before the payment settles, so a failure means nothing is taken. A successful call settles on-chain and returns a receipt alongside the result.
- Which chains can I pay on?
- USDC on Base mainnet or Solana mainnet. The 402 challenge lists both, and your client picks. Payment is a signed authorisation that a facilitator verifies and settles: you are never asked to send funds to an address.
- How do I pay if my client does not support x402?
- Buy a subscription and pass the token, either as a subscription_token argument on an MCP tool or as an X-Subscription-Token header on the REST endpoint. Claude Desktop, Cursor and most current MCP clients do not implement x402, so this is the usual route today.
- How do I add this to my agent?
- One command, npx skills add https://centry.cybercentry.co.uk, which installs into Claude Code, Cursor, Copilot, Windsurf, Gemini and OpenClaw. Or add it as a remote MCP server at https://centry.cybercentry.co.uk/api/mcp with transport streamable-http.
- How many chains does wallet verification cover?
- 31 EVM chains, screened against the OFAC SDN list with risk scoring and suspicious-activity detection. It is asynchronous: the call returns a job id and a poll url, and a result usually takes under two minutes.
- Does a clean result mean something is safe?
- No. A verification informs a decision, it does not block a transaction and it is not a guarantee. A clean result means the checks that ran found nothing, not that nothing is there. Treat it as evidence and weigh it with everything else you know.
- What does a call cost?
- $1.00 in USDC for any paid service, the same price whether it is reached over REST or as an MCP tool. The catalogue at /api/catalog carries the live price for every service and is free to call.