Hello
' for safe display","Remove XSS payloads from user-submitted rich text"],"inputModes":["application/json"],"description":"Remove XSS vectors from untrusted HTML without installing a sanitizer locally. Powered by nh3 (Rust). Strips script tags, event handlers, data URIs, and other injection vectors. Returns clean HTML plus threat metadata.","outputModes":["application/json"]},{"id":"sql_validate","uri":"https://validate-agent.fly.dev/api/v1/validate/sql","name":"SQL Syntax & Injection Check","tags":["security","validation","sql","injection"],"examples":["Check if agent-generated SQL is syntactically valid before executing","Detect SQL injection in 'SELECT * FROM users WHERE id=1 OR 1=1'","Validate a BigQuery query before submitting to the API"],"inputModes":["application/json"],"description":"Validate SQL syntax and detect injection patterns before executing queries. Supports 30+ dialects via sqlglot including PostgreSQL, MySQL, BigQuery, Snowflake, and SQLite. Catches tautologies, UNION attacks, and stacked queries.","outputModes":["application/json"]},{"id":"simple_validate","uri":"https://validate-agent.fly.dev/api/v1/validate/simple","name":"Data Format Validation","tags":["validation","email","url","uuid","phone","ipv4","data-quality"],"examples":["Validate user@example.com is a real email format","Check and normalize a phone number to E.164 format","Verify a UUID before using it as a database key"],"inputModes":["application/json"],"description":"Validate and normalize emails, URLs, UUIDs, phone numbers, and IPv4 addresses. RFC-compliant checks with normalization output. Ideal for agents in sandboxed environments that cannot install validation libraries.","outputModes":["application/json"]},{"id":"json_schema","uri":"https://validate-agent.fly.dev/api/v1/validate/json-schema","name":"JSON Schema Validation","tags":["validation","json","schema","structured-output"],"examples":["Validate LLM function-call output matches the expected schema","Check if API response body conforms to OpenAPI schema","Verify agent config JSON before loading"],"inputModes":["application/json"],"description":"Validate any JSON data against a JSON Schema definition. Supports Draft 4, 6, 7, 2019-09, and 2020-12. Use to verify LLM-generated structured output matches expected format.","outputModes":["application/json"]},{"id":"batch_validate","uri":"https://validate-agent.fly.dev/api/v1/validate/batch","name":"Batch Validation","tags":["validation","batch","bulk","data-quality"],"examples":["Validate a CSV column of 500 email addresses in one call","Check 100 URLs and 50 phone numbers together","Bulk-validate form submissions before database insert"],"inputModes":["application/json"],"description":"Validate up to 1,000 values in a single request. Mix types freely — emails, URLs, UUIDs, phones, IPv4 in one call. Returns per-item results with a summary. First 10 batch requests per agent count as 1 credit each (regardless of item count). After trial, per-item billing resumes. Cheaper per-item than individual calls.","outputModes":["application/json"]},{"id":"ip_geo_reputation","uri":"https://validate-agent.fly.dev/api/v1/validate/ip-geo","name":"IP Geo-Reputation & Sanctions","tags":["security","ip","geo","sanctions","reputation"],"examples":["Check if an IP address is from a sanctioned country","Get the country and reputation score for 8.8.8.8","Validate IP and detect private/reserved ranges"],"inputModes":["application/json"],"description":"Validate IP addresses and check geo-reputation. Detects private/reserved ranges, looks up country via MaxMind GeoLite2, and flags IPs from sanctioned countries. Returns reputation score.","outputModes":["application/json"]},{"id":"secret_sweep","uri":"https://validate-agent.fly.dev/api/v1/detect/secrets","name":"Secret & Credential Sweeping","tags":["security","secrets","credentials","api-keys","redaction"],"examples":["Scan a config file for accidentally committed API keys","Check if text contains AWS access keys or GitHub tokens","Redact secrets from log output before storing"],"inputModes":["application/json"],"description":"Scan text for leaked secrets, API keys, tokens, and credentials. Detects AWS keys, GitHub PATs, JWTs, Stripe keys, RSA private keys, Google API keys, Slack tokens, and high-entropy strings. Returns detections with optional redaction.","outputModes":["application/json"]},{"id":"text_repair","uri":"https://validate-agent.fly.dev/api/v1/repair/text","name":"JSON & Markdown Repair","tags":["repair","json","markdown","formatting","data-quality"],"examples":["Fix JSON with trailing commas and single quotes","Repair a markdown table with missing separator rows","Clean up LLM-generated JSON that won't parse"],"inputModes":["application/json"],"description":"Fix broken JSON (trailing commas, single quotes, comments, unquoted keys) and normalize malformed markdown tables (missing separators, uneven columns). Returns repaired text with a list of repairs made.","outputModes":["application/json"]},{"id":"web_asset_validation","uri":"https://validate-agent.fly.dev/api/v1/validate/web-assets","name":"Web Asset & Citation Formatting","tags":["validation","url","markdown","links","formatting"],"examples":["Validate all URLs in an LLM-generated response","Check markdown link formatting in documentation","Find broken or malformed URLs in text"],"inputModes":["application/json"],"description":"Extract and validate URLs and markdown links from text. Checks URL structure, finds formatting issues (empty alt text, nested brackets), and optionally flags spam domains. No HTTP requests made.","outputModes":["application/json"]},{"id":"language_toxicity","uri":"https://validate-agent.fly.dev/api/v1/detect/language-toxicity","name":"Language & Toxicity Triage","tags":["moderation","language","toxicity","profanity","content-safety"],"examples":["Check if user input is in a supported language","Screen text for profanity before publishing","Detect language and toxicity level of chat messages"],"inputModes":["application/json"],"description":"Detect the language of text and check for English profanity. Uses n-gram language detection and configurable English profanity word lists. Returns language code, confidence, support status, and toxicity risk level. Toxicity detection currently covers English only.","outputModes":["application/json"]},{"id":"static_scan","uri":"https://validate-agent.fly.dev/api/v1/scan/static","name":"Static Security Scan","tags":["security","static-analysis","malware","secrets"],"examples":["Scan Python source for eval/exec calls and hardcoded credentials","Check if source code contains obfuscated malicious patterns","Detect dynamic execution and subprocess calls in agent code"],"inputModes":["application/json"],"description":"Regex-based malicious string and secret detection in source code. Detects dynamic execution (eval, exec, subprocess), hardcoded IPs, and exposed credentials. Supports custom patterns with ReDoS protection. Multi-encoding evasion detection via deep decode.","outputModes":["application/json"]},{"id":"tool_chain_audit","uri":"https://validate-agent.fly.dev/api/v1/audit/tool-chain","name":"Tool Chain Audit","tags":["security","ast-analysis","tool-chain","source-sink"],"examples":["Audit Python code for read_file -> eval chains","Check if agent tool pipeline has dangerous source-to-sink paths","Analyze Node.js code for input -> exec vulnerabilities"],"inputModes":["application/json"],"description":"AST analysis of dangerous source-to-sink tool chains. Parses Python via AST and Node.js via regex heuristics. Identifies paths from data sources (read_file, input, HTTP) to dangerous sinks (eval, exec, subprocess, HTTP POST).","outputModes":["application/json"]},{"id":"adversarial_probe","uri":"https://validate-agent.fly.dev/api/v1/probe/adversarial","name":"Adversarial Probe","tags":["security","canary","honeytoken","exfiltration","adversarial"],"examples":["Check if a canary token leaked in agent execution logs","Detect base64-encoded exfiltration of honeytokens","Probe logs for URL-encoded canary leak attempts"],"inputModes":["application/json"],"description":"Honeytoken canary leak detection in execution logs. Multi-layer search: plaintext, HTML/URL decoded, base64-decoded, and URL-encoded segments. Detects exfiltration attempts by agents that leak canary tokens through encoding obfuscation.","outputModes":["application/json"]}],"pricing":{"paid":{"deep":0.005,"batch":0.0005,"simple":0.001,"deep_pii":0.008,"structural":0.002},"network":"eip155:8453","currency":"USDC","freeTier":{"requests":200},"paymentProtocol":"x402"},"version":"0.7.0","provider":{"url":"https://validate-agent.fly.dev","organization":"Validate Agent"},"description":"Security and data-quality guardrails for AI agents. Stop prompt injections before they reach your LLM. Strip PII to stay compliant. Sanitize untrusted HTML without installing dependencies. Validate emails, URLs, JSON schemas, and SQL syntax in under 10ms. Works from any environment — sandboxed, serverless, or containerized. No API key needed. 200 free requests, then pay-per-call via x402 (USDC on Base).","capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":false},"authentication":{"schemes":[{"scheme":"x402","network":"eip155:8453","description":"USDC micropayments on Base via x402 protocol","facilitatorUrl":"https://api.cdp.coinbase.com/platform/v2/x402"}]},"protocolVersion":"1.0","documentationUrl":"https://validate-agent.fly.dev/docs","defaultInputModes":["application/json"],"defaultOutputModes":["application/json"]},"signature_status":"unsigned","signature_detail":"No card signature supplied","signature_key_url":null,"signature_checked_at":"2026-10-10T15:50:19.748082+00:00","domain_claimed_at":null,"domain_proof_checked_at":null,"source_name":"Agenstry federation","source_url":"https://agenstry.com/docs","last_check":{"checked_at":"2026-10-10T15:50:19.748082+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},"also_published_at":[],"history_urls":["https://validate-agent.fly.dev/.well-known/agent-card.json"],"skills":[{"skill_id":"adversarial_probe","name":"Adversarial Probe","description":"Honeytoken canary leak detection in execution logs. Multi-layer search: plaintext, HTML/URL decoded, base64-decoded, and URL-encoded segments. Detects exfiltration attempts by agents that leak canary tokens through encoding obfuscation.","tags":["security","canary","honeytoken","exfiltration","adversarial"],"quality_warning":false},{"skill_id":"batch_validate","name":"Batch Validation","description":"Validate up to 1,000 values in a single request. Mix types freely — emails, URLs, UUIDs, phones, IPv4 in one call. Returns per-item results with a summary. First 10 batch requests per agent count as 1 credit each (regardless of item count). After trial, per-item billing resumes. Cheaper per-item than individual calls.","tags":["validation","batch","bulk","data-quality"],"quality_warning":false},{"skill_id":"simple_validate","name":"Data Format Validation","description":"Validate and normalize emails, URLs, UUIDs, phone numbers, and IPv4 addresses. RFC-compliant checks with normalization output. Ideal for agents in sandboxed environments that cannot install validation libraries.","tags":["validation","email","url","uuid","phone","ipv4","data-quality"],"quality_warning":false},{"skill_id":"html_sanitize","name":"HTML/XSS Sanitization","description":"Remove XSS vectors from untrusted HTML without installing a sanitizer locally. Powered by nh3 (Rust). Strips script tags, event handlers, data URIs, and other injection vectors. Returns clean HTML plus threat metadata.","tags":["security","sanitization","html","xss"],"quality_warning":false},{"skill_id":"ip_geo_reputation","name":"IP Geo-Reputation & Sanctions","description":"Validate IP addresses and check geo-reputation. Detects private/reserved ranges, looks up country via MaxMind GeoLite2, and flags IPs from sanctioned countries. Returns reputation score.","tags":["security","ip","geo","sanctions","reputation"],"quality_warning":false},{"skill_id":"text_repair","name":"JSON & Markdown Repair","description":"Fix broken JSON (trailing commas, single quotes, comments, unquoted keys) and normalize malformed markdown tables (missing separators, uneven columns). Returns repaired text with a list of repairs made.","tags":["repair","json","markdown","formatting","data-quality"],"quality_warning":false},{"skill_id":"json_schema","name":"JSON Schema Validation","description":"Validate any JSON data against a JSON Schema definition. Supports Draft 4, 6, 7, 2019-09, and 2020-12. Use to verify LLM-generated structured output matches expected format.","tags":["validation","json","schema","structured-output"],"quality_warning":false},{"skill_id":"language_toxicity","name":"Language & Toxicity Triage","description":"Detect the language of text and check for English profanity. Uses n-gram language detection and configurable English profanity word lists. Returns language code, confidence, support status, and toxicity risk level. Toxicity detection currently covers English only.","tags":["moderation","language","toxicity","profanity","content-safety"],"quality_warning":false},{"skill_id":"pii_detection","name":"PII Detection & Redaction","description":"Find and redact personal data before logging, storing, or forwarding text. Detects SSNs, credit card numbers, emails, phone numbers, IP addresses, dates of birth, passport numbers, and IBANs. NER-powered when available, with regex fallback. Returns span locations and redacted text.","tags":["privacy","pii","redaction","compliance","gdpr","hipaa"],"quality_warning":false},{"skill_id":"prompt_injection","name":"Prompt Injection Detection","description":"Screen untrusted text before it reaches your LLM. Catches obfuscation techniques including homoglyph substitution, zero-width character insertion, base64-encoded payloads, and multilingual attacks. Returns risk level, matched patterns, and cleaned text.","tags":["security","prompt-injection","llm","guardrails"],"quality_warning":false},{"skill_id":"sql_validate","name":"SQL Syntax & Injection Check","description":"Validate SQL syntax and detect injection patterns before executing queries. Supports 30+ dialects via sqlglot including PostgreSQL, MySQL, BigQuery, Snowflake, and SQLite. Catches tautologies, UNION attacks, and stacked queries.","tags":["security","validation","sql","injection"],"quality_warning":false},{"skill_id":"secret_sweep","name":"Secret & Credential Sweeping","description":"Scan text for leaked secrets, API keys, tokens, and credentials. Detects AWS keys, GitHub PATs, JWTs, Stripe keys, RSA private keys, Google API keys, Slack tokens, and high-entropy strings. Returns detections with optional redaction.","tags":["security","secrets","credentials","api-keys","redaction"],"quality_warning":false},{"skill_id":"static_scan","name":"Static Security Scan","description":"Regex-based malicious string and secret detection in source code. Detects dynamic execution (eval, exec, subprocess), hardcoded IPs, and exposed credentials. Supports custom patterns with ReDoS protection. Multi-encoding evasion detection via deep decode.","tags":["security","static-analysis","malware","secrets"],"quality_warning":false},{"skill_id":"tool_chain_audit","name":"Tool Chain Audit","description":"AST analysis of dangerous source-to-sink tool chains. Parses Python via AST and Node.js via regex heuristics. Identifies paths from data sources (read_file, input, HTTP) to dangerous sinks (eval, exec, subprocess, HTTP POST).","tags":["security","ast-analysis","tool-chain","source-sink"],"quality_warning":false},{"skill_id":"web_asset_validation","name":"Web Asset & Citation Formatting","description":"Extract and validate URLs and markdown links from text. Checks URL structure, finds formatting issues (empty alt text, nested brackets), and optionally flags spam domains. No HTTP requests made.","tags":["validation","url","markdown","links","formatting"],"quality_warning":false}],"quality_flags":[],"check_history":{"checks":2,"passed":2},"recent_checks":[{"card_url":"https://validate-agent.fly.dev/.well-known/agent-card.json","checked_at":"2026-10-10T15:50:19.748082+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},{"card_url":"https://validate-agent.fly.dev/.well-known/agent-card.json","checked_at":"2026-10-10T13:11:22.006938+00:00","success":true,"http_status":200,"detail":"Agent Card validated"}],"endpoint_tls_check":{"checked_at":"2026-10-10T15:50:19.748082+00:00","success":true,"detail":"Valid TLS connection to advertised endpoint host; no A2A request sent"},"protocol_check":{"checked_at":"2026-10-10T13:11:22.006938+00:00","state":"unconfirmed","http_status":404,"detail":"Endpoint response did not match the JSON-RPC request"},"events":[],"relationships":[],"verification":{"agent_card_url":"https://validate-agent.fly.dev/.well-known/agent-card.json","last_successful_card_check":"2026-10-10T15:50:19.748082+00:00","latest_card_check":{"checked_at":"2026-10-10T15:50:19.748082+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},"signature_status":"unsigned","signature_checked_at":"2026-10-10T15:50:19.748082+00:00","task_endpoint_tested":true,"task_execution_tested":false,"endpoint_tls_checked_at":"2026-10-10T15:50:19.748082+00:00","endpoint_tls_reachable":true,"protocol_check_state":"unconfirmed","protocol_checked_at":"2026-10-10T13:11:22.006938+00:00","provider_identity_verified":false,"domain_claimed_at":null,"domain_proof_checked_at":null}}