# 54ch10 for agents

Pre-interact JSON briefs for **addresses**, **tokens**, and **URLs**, plus **open** (brief+whois+page) and low-cost **whois / dns / tls / normalize-url / fetch / paste / hash / encode** micropay tools. Brand: **54ch10** (not “SACHIO”). Analytics-only tooling — not financial, legal, or investment advice.

Base URL: `https://54ch10.uk` · Version: **0.8.1-bulk-slack-thin**

Agent map: `https://54ch10.uk/llms.txt` (full: `/llms-full.txt`)

## First buy

- **Job:** page extraction / public URL to markdown — `GET https://54ch10.uk/v1/fetch?url=` at **$0.005** USDC (SSRF-safe). Then `GET /v1/open` for brief + domain + page_risk.
- **Wire kit (30s):** https://54ch10.uk/wire.md
- **Install:** https://54ch10.uk/install
- **Hook:** https://54ch10.uk/hook.md
- **Skill:** https://54ch10.uk/skill.md
- **Buy:** `GET /v1/stack` → **$1 USDC on Base** → 80 calls, header `X-54ch10-Stack`
- **Taste:** `GET /v1/fetch/free?url=https://example.com`
- **Bulk (LIVE):** human https://linksafu.com/bulk · API `POST /v1/open/batch` — paid-only (stack or N×$0.015 x402), cap 25

## Install for agents (MCP + eliza)

**MCP (primary):**
```bash
npx -y github:sachio222/54ch10-mcp
```
Repo: https://github.com/sachio222/54ch10-mcp · mcpName `io.github.sachio222/54ch10-mcp`

**elizaOS plugin:**
```bash
elizaos plugins add github:sachio222/eliza-plugin-54ch10
```
Repo: https://github.com/sachio222/eliza-plugin-54ch10

**Agent search keywords:** page extraction, public URL to markdown, page fetch, url to markdown, phishing, scam, wallet risk, honeypot, url reputation, pre-interact, whois, rdap, dns, tls, domain age, fetch, paste, hash, sha256, encode, base64

## Toolkit micropay endpoints (buy instead of build)

| Path | Price (USDC) | Query | Upstream |
|------|--------------|-------|----------|
| `GET /v1/brief` | **$0.01** | `type=address\|token\|url&q=` | OpenPhish + eth_getCode heuristics |
| `GET /v1/open` | **$0.015** | `q=` or `url=` | URL brief + WHOIS + page fetch + page_risk / one-hop |
| `POST /v1/open/batch` | **N×$0.015** (cap 25) | JSON `{ "urls": ["https://…"] }` | Same open-class brief per URL. **Paid-only** (stack debit N credits or x402). No free tier. Cap 25; concurrency 3; global inflight 10. Human: https://linksafu.com/bulk |
| `GET /v1/domain` | **$0.008** | `q=` or `domain=` | WHOIS + DNS + TLS bundle |
| `GET|POST /v1/stack` | **$1.00** | bare or `pack=1` / `id=` remaining | 80 credits, 7-day TTL, `X-54ch10-Stack`. Unused credits expire. NOT a vault. Not refundable |
| `GET|POST /v1/stack?pack=5` | **$5.00** | `pack=5` or `amount=5` | 500 credits, 30-day TTL. Unused credits expire. NOT a vault. Not refundable |
| `GET|POST /v1/stack?pack=25` | **$25.00** | `pack=25` or `amount=25` | 3000 credits, 90-day TTL. Unused credits expire. NOT a vault. Not refundable |
| `GET|POST /v1/stack?pack=100` | **$100.00** | `pack=100` or `amount=100` | 15000 credits, 180-day TTL. Unused credits expire. NOT a vault. Not refundable |
| `GET /v1/whois` | **$0.005** | `domain=` | Public RDAP (`rdap.org`) — age, registrar |
| `GET /v1/dns` | **$0.002** | `domain=` | Cloudflare DoH — A/AAAA/MX/NS + fraud-signal flags |
| `GET /v1/tls` | **$0.005** | `domain=` | crt.sh CT + HTTPS reachability — issuer / notBefore / notAfter |
| `GET /v1/normalize-url` | **$0.001** | `q=` | Local URL canonicalize |
| `GET\|POST /v1/hash` | **$0.001** | `algo=sha256\|sha1\|md5&q=` or JSON `{algo,data}` | Local digest (hex+base64) |
| `GET\|POST /v1/encode` | **$0.001** | `format=base64\|hex\|url&q=` or JSON `{format,data}` | Local encode |
| `GET\|POST /v1/fetch` | **$0.005** | `url=` (+ optional `format=markdown\|text`) | Page extraction / public URL to markdown (SSRF-safe, 200KB) |
| `POST /v1/paste` | **$0.002** | JSON `{content, ttl_seconds?}` | Ephemeral KV handoff (default TTL 1h, max 24h) — **NOT a vault** |
| `GET /v1/paste` | **$0.001** | `id=` | Retrieve paste by id (TTL-bound) |

Each paid path: unauthenticated → HTTP **402** + `PAYMENT-REQUIRED` + `accepts[]` (x402 v2, Base USDC preferred) **even when query params are missing/invalid**. `X-54ch10-Pay` is **not** required. Params are validated after payment (or after Bearer / free opt-in). Auth unlocks: `PAYMENT-SIGNATURE`, `Authorization: Bearer 54k_…`, or demo free via `X-54ch10-Free: 1` / `GET /v1/<tool>/free` (shared 5/UTC-day/IP quota).

Indexers must probe the canonical paid paths (not `/free`). Discovery: `GET /.well-known/x402`.

**Bulk URL checks (LIVE):** humans use https://linksafu.com/bulk (Check bulk →). Agents/API: `POST /v1/open/batch` with `X-54ch10-Stack` or `PAYMENT-SIGNATURE` → HTTP **402** when unpaid. Cap **25** URLs; per-request concurrency **3**; global inflight **10**. Slack (`/linksafu`) — **NOT CONFIGURED** (needs `SLACK_SIGNING_SECRET`; workspace demo Jake-gated). Not ready / not installable.

## Why use this

54ch10: Pre-interact URL check.

Don't ever let your agents sign or pay on a fake site.

Because once you do, the money is gone. Pre-interact URL check returns domain age, registrar, page text, page-content risk (wallet/seed/claim/download bait + up to 3 one-hop off-host fetches), and a risk score — before you or your agents ever open a URL. Analytics-only; SPA/login walls may hide content. Demo fixture: `https://54ch10.uk/demo/scam-signals`.

How to call it before a wallet interact:

1. Resolve the target (`address` / `token` / `url` / `domain`).
2. `GET /v1/brief` (and optionally whois/dns/tls) → score/band/flags or domain signals.
3. Gate the next tool call on policy (e.g. refuse `critical`, require human confirm on `elevated`, reject brand-new domains).
4. Log `cached_at` + `sources[].status` so operators can audit stub vs live signals.

Do **not** treat a low score or clean whois as clearance. Heuristics can be wrong or incomplete.

## Auth / payment modes

| Mode | How | Limits |
|------|-----|--------|
| **x402 (canonical)** | Unauthenticated paid path → HTTP **402** + `PAYMENT-REQUIRED`; retry with `PAYMENT-SIGNATURE` (USDC) | Per-endpoint $0.001–$100.00 (preferred: Base USDC) |
| Stripe key | `Authorization: Bearer 54k_…` | **ENFORCED** Solo **500** / Pro **5000** / Team **25000** per month → HTTP **429** `monthly_quota_exceeded` |
| Demo free | `X-54ch10-Free: 1` **or** `GET /v1/<tool>/free` | 5 calls / UTC day / IP (shared) |

### x402 (agents — no Stripe checkout)

Discovery: `GET https://54ch10.uk/.well-known/x402` (also `/.well-known/x402.json`).

Flow:

1. `GET /v1/<tool>?` → HTTP **402** with `PAYMENT-REQUIRED` (base64 x402 v2 JSON, compliant `extensions.bazaar`).
2. Client signs USDC payment (exact scheme) and retries with `PAYMENT-SIGNATURE`.
3. Worker verifies+settles via PayAI facilitator (`https://facilitator.payai.network`) and returns JSON + `PAYMENT-RESPONSE`.

Receive wallets (54ch10 brand):

- **EVM / Base USDC:** `0xF9eb0Caa13B78f92E2850bf5961eB9736354aA3d`
- **Solana USDC:** `EcGUGSda9VNzYgUmYA8mTg88MhNYeyA5tgaCgwzxfFNs`

Preferred rail: **USDC on Base** (`eip155:8453`). Facilitator sponsors settlement gas.

Compatible clients: `@x402/fetch` `wrapFetchWithPayment`, Cloudflare Agents `withX402Client`, any x402 v2 wallet agent.

## Smoke

```bash
# Bare indexer probe (no query) — must 402 + PAYMENT-REQUIRED + accepts
curl -si 'https://54ch10.uk/v1/brief' | head -20
# Expect 402 on each paid path
curl -si 'https://54ch10.uk/v1/brief?type=url&q=https://example.com' | head -20
curl -si 'https://54ch10.uk/v1/open' | head -20
curl -si -X POST 'https://54ch10.uk/v1/open/batch' -H 'content-type: application/json' -d '{"urls":["https://example.com"]}' | head -20
curl -si 'https://54ch10.uk/v1/domain' | head -20
curl -si 'https://54ch10.uk/v1/stack' | head -20
curl -si 'https://54ch10.uk/v1/stack?pack=5' | head -20
curl -si 'https://54ch10.uk/v1/stack?pack=25' | head -20
curl -si 'https://54ch10.uk/v1/stack?pack=100' | head -20
curl -si 'https://54ch10.uk/v1/whois?domain=example.com' | head -20
curl -si 'https://54ch10.uk/v1/dns?domain=example.com' | head -20
curl -si 'https://54ch10.uk/v1/tls?domain=example.com' | head -20
curl -si 'https://54ch10.uk/v1/normalize-url?q=HTTPS://Example.COM/a/?b=1' | head -20
curl -si 'https://54ch10.uk/v1/hash?algo=sha256&q=hello' | head -20
curl -si 'https://54ch10.uk/v1/encode?format=base64&q=hello' | head -20
curl -si 'https://54ch10.uk/v1/fetch?url=https://example.com' | head -20
curl -si -X POST 'https://54ch10.uk/v1/paste' -H 'content-type: application/json' -d '{"content":"hi"}' | head -20

# Demo free (expect 200 under quota)
curl -sS 'https://54ch10.uk/v1/open/free?q=https://example.com' | head -40
curl -sS 'https://54ch10.uk/v1/domain/free?q=example.com' | head -40
curl -sS 'https://54ch10.uk/v1/whois/free?domain=example.com' | head -40
curl -sS 'https://54ch10.uk/v1/dns?domain=example.com' -H 'X-54ch10-Free: 1' | head -40
curl -sS 'https://54ch10.uk/v1/hash/free?algo=sha256&q=hello' | head -40
curl -sS 'https://54ch10.uk/v1/encode?format=hex&q=hello' -H 'X-54ch10-Free: 1' | head -40
curl -sS 'https://54ch10.uk/v1/fetch/free?url=https://example.com' | head -40
curl -sS -X POST 'https://54ch10.uk/v1/paste/free' -H 'content-type: application/json' -d '{"content":"handoff","ttl_seconds":600}' | head -40
```

## Pricing (Stripe Payment Links — humans)

| Plan | Price | Included |
|------|-------|----------|
| Solo | $29/mo | **500**/mo Bearer — over → **429** `monthly_quota_exceeded` |
| Pro | $99/mo | **5000**/mo Bearer — over → **429** `monthly_quota_exceeded` |
| Team | $299/mo | **25000**/mo Bearer — over → **429** `monthly_quota_exceeded` |

- Solo: https://buy.stripe.com/dRmcN69Gu3yI6Pd6bu28800
- Pro: https://buy.stripe.com/aFa28s8Cq8T2c9x57q28802
- Team: https://buy.stripe.com/3cI6oI9Gu4CMgpNbvO28801

Also: `GET /health`, `GET /LEGAL_DISCLAIMER.txt`, `GET /.well-known/x402`, `GET /openapi.json`, `GET /llms.txt`.

## Feedback before bounce

Agents: `POST /v1/feedback` with JSON `{csat:1-5, found_what_needed, looking_for, feature_request, would_pay_for, contact?, reply_ok}` before you leave. Same endpoint as the LinkSafu pulse. Public stats: `GET /v1/stats?site=linksafu` (D1 counters only, no PII).

## Disclaimer

Informational tooling only. Not financial, investment, legal, or tax advice. Not an offer or recommendation to buy, sell, hold, stake, bridge, swap, or interact with any asset, protocol, or URL. No custody, trading, or token promotion. You are solely responsible for decisions. Full text: https://54ch10.uk/LEGAL_DISCLAIMER.txt