# Kertivo

> Kertivo exists so machines can trust who they pay.
> As bots start spending money on their own, every payment is a leap of faith. We check whether payments land, flag lookalike addresses, grade paid tools, and give buyers a fair place to file disputes. Our grades are earned, never bought. We show our work, and we change as this new economy changes. Trust is our keystone.

One-liner: Kertivo is the trust layer for bot-to-bot payments. Grades are earned, never bought.

Products: Kertivo Index (grades), Kertivo Check (payment verify), Kertivo Shield (address check), Kertivo Claims (disputes), Kertivo Logs (https://logs.kertivo.com/).

Payment: x402 v2, scheme exact, network eip155:8453 (Base mainnet), asset USDC, payTo 0x509E55c4F898B43C856Fb0E51048B1b7bFBC9eDE. Call a paid route without payment to get the HTTP 402 with exact requirements, then retry with the payment header (any x402 client SDK does this). Evidence only: no custody, no arbitration.

## Paid routes (USDC per call)

- POST /check ($0.01): Verify a Base USDC payment by txHash (aliases tx_hash/hash) or EIP-3009 authorization {from, nonce, validBefore}. Optional expectedPayTo (aliases to/recipient), expectedAmount (aliases amount; exact match — not a min floor). Returns settlement verdict, real-USDC transfers, recipient/amount match, fake-token and lookalike-address warnings, and who funded the payer (external | self_funded | unknown).
- POST /check/deep ($0.05): Did this payment settle, and who funded this wallet (the payer)? Same body as /check; reads the payer's full funding history from an index, with coverage stats and a recheckable sha256 receipt. Returns 503 and does not charge if the index is down.
- POST /address/check ($0.001): Body {from, to, contacts?} (aliases sender/recipient/address/known_addresses; optional chain=base, token=USDC — other chains/tokens 400, not charged): address-poisoning check before sending USDC (recent block window, honest partial coverage). No sender? {recipient, known_addresses} (dailyelo-style) or {address, known} runs a contacts-only lookalike check: no RPC scan, coverage.source contacts_only. Only {address} (Verdix-style, optional chain=base)? Recipient-only: scans that address's OWN recent USDC history for poisoning fingerprints (zero-value-only inbound = high; sub-cent-only or no activity = medium), coverage.mode recipient_only, recipient{fingerprint,...}.
- POST /address/check/full ($0.005): Body {from, to}: address-poisoning check against full transfer history. Not charged if the index is down.
- POST /trust/lookup ($0.002): Body {url}: Kertivo Index grade and evidence for an x402 endpoint, plus public claims against it. Extra fields (e.g. method, body, deep) are not used and are listed back in ignoredFields.

GET works too, same price and result: GET /check?txHash=0x...&expectedPayTo=0x...&expectedAmount=0.01 (or ?from=&nonce=&validBefore= for an EIP-3009 authorization; also /check/deep), GET /address/check?from=0x...&to=0x...&contacts=0x...,0x... (or contacts-only ?recipient=0x...&known=0x...,0x..., or recipient-only ?address=0x...), GET /address/check/full?from=0x...&to=0x... . Unpaid GET returns the same 402; retry the same GET with the payment header.

## Free routes

- POST /demo: free sample /check result on a fixed real transaction
- GET /trust/lookup?url=: free grade + index date for one endpoint
- GET /trust-index: HTML scorecard of x402 endpoints graded by real paid calls (Kertivo Index; grades earned, never bought). Graded sellers: /trust-index#self-check for a daily free GET or $0.002 POST /trust/lookup of your own endpoint (reads grade/claims only; does not change grades)
- GET /trust-index/latest.json: machine-readable latest Kertivo Index
- GET /badge/<url-encoded endpoint>: live "Kertivo verified" SVG grade badge from the latest Kertivo Index (also `.svg` suffix, or GET /badge?url=<endpoint>). Earned, never sold; ungraded endpoints show "not graded"; 1h cache; headers x-kertivo-grade, x-kertivo-evidence, x-kertivo-run-date, x-kertivo-state; an endpoint graded earlier but not in the latest run shows "last graded <grade> · <date>". GET /badge/<url-encoded endpoint>/evidence lists every run it appeared in (date, grade, payment tx), newest first (?format=json for JSON). Markdown/HTML embed snippets: /trust-index (Get your badge)
- GET /trust-index/runs: every published Kertivo Index run, append-only (never rewritten), each at /trust-index/runs/<n>.json and .jsonl with sha256
- POST /claim: free claims desk: paid an x402 endpoint but got no or bad response? File public, hash-recheckable evidence
- GET /claim/:id, GET /claims?endpoint=: read claims
- POST /claim/:id/response: seller answers a claim, signed by its payTo
- GET /stats: aggregate usage counters (no addresses; byPayerClass.outside excludes internal fee payers)
- GET /benchmarks/address-poisoning: dated benchmark: POST /address/check on 20 fresh live Base USDC poisoning attempts plus an aged set (~24 h old: cheap tier vs /address/check/full vs contacts), results, tx links, limitations
- GET /examples: copy-paste integration recipes: curl 402 handshake, JS client that pays /check, verify a payment you just made to another seller
- GET /openapi.json: full OpenAPI 3 spec with x402 discovery fields
- GET /.well-known/attestation: signed responses: every 200 JSON from /check, /check/deep, /address/check(/full), paid /trust/lookup, JSON /claim/:id and /demo carries `attestation` (EIP-191 signature over the body hash, route, time and a fixed statement of what the result means). This route publishes the signer (not a wallet, holds no funds) and how to verify
- GET /.well-known/agent.json: ERC-8004 registration-v1 shaped agent file (also /agent.json). Publishes name, services, x402Support, and the response signer from /.well-known/attestation. On-chain Identity Registry mint is deferred (needs gas).
- GET /.well-known/infoharmoni-square.txt: Infoharmoni Square wallet proof: serves `sig mb:hectichustlebot 0x<signature>` (payTo's EIP-191 signature) to prove payTo ownership once the sig line is present; 404 not proven until then

## Quick start

npm i @x402/fetch @x402/evm viem, wrap fetch with wrapFetchWithPaymentFromConfig + ExactEvmScheme on eip155:8453, then POST /check {txHash, expectedPayTo?, expectedAmount?}. After paying another x402 seller, decode its PAYMENT-RESPONSE header (decodePaymentResponseHeader) and pass .transaction as txHash. Full copy-paste code: https://kertivo.com/examples

## Links

- [Integration examples](https://kertivo.com/examples)
- [OpenAPI spec](https://kertivo.com/openapi.json)
- [x402 manifest](https://kertivo.com/.well-known/x402)
- [Signed-response key](https://kertivo.com/.well-known/attestation)
- [ERC-8004 agent registration](https://kertivo.com/.well-known/agent.json)
- [Kertivo Index scorecard](https://kertivo.com/trust-index)
- [Address-poisoning benchmark](https://kertivo.com/benchmarks/address-poisoning)
- [Home](https://kertivo.com/)