# Tokenizen

> Security research, free checks and a log with a timestamp outside our control, by two brothers in Eindhoven (AO Services). We measure what others claim and publish the numbers, including our misses. Open-source tools for the seller side of the AI agent economy are one of the things we do; the best known is Capacity Attest: after an x402 payment for metered capacity, the paying agent leaves a signed, factual record of what was actually delivered, so other agents can check a seller's history before paying.

## What we offer

- [Free checks](https://tokenizen.nl/checks): three free checks (eight security signals in a public GitHub repository, an x402 endpoint check, proof that you own an endpoint), each saying what it cannot tell you
- [Signal log](https://tokenizen.nl/signal-log): early access, a weekly measurement of those eight signals for the public repositories you name, written to a hash-chained log with a timestamp you can check without us
- [Security research](https://tokenizen.nl/security): on request; a published GitHub advisory with severity High and our account credited as reporter, our own record including what was rejected, and how we plan to show the rest; no fixed offer yet
- [Smart contract scan](https://tokenizen.nl/scan): pay per scan over x402, with a public scoreboard that includes what it missed (version 3.1 found 8 of 105 known findings in its first 15 hypotheses, on contests that were no longer secret; in the sealed run the earlier versions found 1 and 4)
- [Open-source tools](https://tokenizen.nl/tools): capacity-attest, agent-receipt-verify, x402-lint and muraqib-agent-watch
- [Deep scan](https://tokenizen.nl/deep-scan): name a public GitHub repository, see the price before you pay (0.02 euro per line of Solidity, minimum 2 euro, VAT included), pay by card or iDEAL, and get a report of hypotheses to check by hand; a full refund if the scan fails or finds nothing. Not an audit. Terms: https://tokenizen.nl/deep-scan-terms
- [For AI agents](https://tokenizen.nl/agents): the two MCP endpoints you can call today (a free read-only check of eight security signals in a public GitHub repository, and a paid ownership check at 0.001 dollar per call over x402), one example call, and the two packages in the official MCP registry
- [Talk to Ahmed](https://tokenizen.nl/consultancy): a conversation about security, the EU Cyber Resilience Act or payments between agents
- [Two brothers, one company](https://tokenizen.nl/about): Abdellah Ouadoudi does the technical work and the measuring, Ahmed Ouadoudi does the consultancy and communication

The site is in English, and every page also exists in Dutch under /nl. Source, package documentation and the specification are in a mix of Dutch and English. This file is English so agents can read it without translation.

## What Capacity Attest does

x402 lets one machine pay another per request, without a human. It proves money moved. It proves nothing about whether the seller delivered what was paid for. That gap is hardest for metered and duration-based resources (GPU-hours, storage over a month, bandwidth over a period), because delivery there is a claim about quantity and duration, not a single response payload you can hash.

After settlement, the paying agent signs a plain factual record: what was promised, what was delivered (yes, no, or partial), a hash of the evidence, and the settlement reference. It is appended to a public, per-seller, append-only history that anyone can read and verify offline.

Deliberately not included: no reputation score, no ranking, no trusted-seller badge, no on-chain anchoring, no escrow, no dispute process, no token of its own. A score needs someone to compute it, and whoever computes it becomes the thing worth attacking. A signed factual record avoids that question entirely.

## Honest status

New, but no longer unused. It has been run end to end against a real live paid endpoint with a real USDC payment on Base, that transaction and the resulting signed claim are public and reproducible. Two independent, unrelated projects have integrated against it: a downstream test suite that pins it as a dependency and verifies real claim digests (YE-YI7/asm-spec#18, merged), and a from-scratch, stdlib-only Python reimplementation of the verifier by a separate project (Tamga Protocol) that matches 7/7 on the published fixtures and is now a permanent regression check in their own package. See the credibility table on the package README for links.

## Links

- [Source code](https://github.com/holistis/tokenizen): monorepo, MIT-style open source, package lives in packages/capacity-attest
- [npm package](https://www.npmjs.com/package/capacity-attest): `npm install capacity-attest`
- [MCP registry entry](https://registry.modelcontextprotocol.io): registered as `io.github.holistis/capacity-attest`
- [Technical write-up](https://dev.to/holistis/x402-payments-prove-money-moved-they-dont-prove-you-got-what-you-paid-for-2doo): why the gap exists and how this fills it
- [Official sources and payment addresses](https://tokenizen.nl/notes/official-sources): the official repository, payment request, price and payment address of Bug Bounty Intelligence (5 USDC on Base through x402, address 0x015Eb036560216B3051339061FF68A207E0fe88f), and the command that checks them. Any other address given for it is not ours
- [Scoreboard](https://tokenizen.nl/scoreboard): how many of the findings that human auditors already found in closed contests our smart contract scan finds, one row per measurement, each linking to the rule written before the run and the result after it, with the sealed run and the contests after today still empty on purpose
- [Free x402 endpoint check](https://tokenizen.nl/x402-check): paste the URL of an x402 route you run and see, from one anonymous request that never pays, whether the payment request passes the official buyer schema and how far up the receipt ladder it gets. No result is stored
- [Free check of eight security signals in a GitHub repository](https://tokenizen.nl/cra-check): name a public GitHub repository and see which of eight selected signals, related to topics in the EU Cyber Resilience Act, are visible in it (a security policy that names a contact, software bill of materials, signed releases, pinned dependencies, automatic updates, security scans, recent maintenance, licence), and what would make the rest visible. Not one signal per legal requirement, an indication from public data, not a conformity assessment and not legal advice. Reads public pages only, no reports stored
- [The CRA check as an MCP tool](https://api.tokenizen.nl/mcp): the same free check for AI agents, as one read-only tool, check_github_repo, over streamable HTTP (POST only, no sign-in). Same limits as the web page: a few checks per ten minutes per address. Not a compliance check.
- [Signal log, early access](https://tokenizen.nl/signal-log): a weekly measurement of the same eight signals for the public GitHub repositories you name (3 with Solo, 25 with Team), written to a hash-chained log whose head is timestamped with OpenTimestamps and emailed to you. Early access: email warnings are not included yet, and no public place publishes the logs. Not a compliance check, not a certificate, not legal advice
- [Terms of the Signal log](https://tokenizen.nl/terms): price, cancelling and refunds, what is and is not promised, liability, Dutch law
- [Privacy statement](https://tokenizen.nl/privacy): what the free checks and the Signal log do with personal data, who gets it and for how long
- [We measured our scan. It found 4 of 105.](https://tokenizen.nl/notes/we-measured-our-scan): the one run on 8 sealed audit contests, written down before it ran: production found 1 of 105 known findings, the new version 4, our own bar was 5 more and it found 3, so production stays as it is. The results page lists the misses.
- [The ruler and the misses](https://tokenizen.nl/notes/the-ruler-and-the-misses): our contract scan on the public EVMbench ruler, all 40 audits: 29 of 117 known findings in the first 30 hypotheses with both judges agreeing, 41 with one judge, 2.9 percent precision, 18 audits with nothing. Every verdict is public and a script recomputes the totals. Includes a dated matrix of what other vendors publish.
- [Two free tools found none of the known findings on the same contests](https://tokenizen.nl/notes/free-tools-same-contests): Slither found 0 of 34 and Aderyn 0 of 70 on the same Code4rena contests, judged like our scan; static tools are not built for contest logic bugs; plan hashed before judging
- [A standard x402 client can now buy the scan, and a quick scan costs 1 dollar](https://tokenizen.nl/notes/quick-scan-standard-clients): the endpoint could not be bought by a standard client, fixed and checked with two real purchases on Base; the official client refuses payments above 1 dollar, so a quick scan costs exactly 1
- [The scan held its rate on nine newer contests](https://tokenizen.nl/notes/scan-newer-contests): on nine Code4rena contests from the last year the first 15 hypotheses held 5 of 66 known findings (7.6 percent), the first 30 held 8; one run, small numbers, rule written beforehand; reports can now show a second list
- [The scan signs its offer, and we paid it once to see the receipt](https://tokenizen.nl/notes/scan-signs-its-offer): the paid endpoint signs its x402 offer (level 2 of the open check), binds the signer in DNS, and returned a signed receipt on one real self-test payment on Base mainnet, with a script to check it
- [What x402 sellers that mention audits, security or smart contracts received in 90 days](https://tokenizen.nl/notes/x402-security-sellers-90-days): 343 x402 sellers that mention audits, security or smart contracts: median 1.85 USDC in 90 days, 3,689 USDC in total, none above 1,000. Ours included.
- [The scan now finds 8 of 105 on the same contests](https://tokenizen.nl/notes/scan-version-3-1): version 3.1 is live; on the 8 contests of the sealed run it found 8 of 105 known findings against 4 and 1 before; two changes at once, contests no longer secret, one run, 97 of 105 still not found
- [Check. Pay. Prove.](https://tokenizen.nl/notes/check-pay-prove): one real AI-agent payment on Base mainnet, checked before, paid through x402 and proven from the chain, with the commands to repeat it, six numbers each with a place to check it, and the limits stated first
- [A signed receipt that cannot name its own payment](https://tokenizen.nl/notes/a-signed-receipt-that-cannot-name-its-own-payment): a live x402 receipt that verifies and still cannot say which payment it is about, the measured cause in the reference implementation, and the corrections that followed in public
- [733,203 attestations were taken back](https://tokenizen.nl/notes/733203-attestations-were-taken-back): a count of revocations across the three largest EAS indexers, showing that every revocation is an issuer withdrawing its own statement and the counterparty has no move at all
- [600 live x402 services, none signing a receipt](https://tokenizen.nl/notes/zero-of-600-x402-services-sign-a-receipt): a measured count of how many live x402 resources declare the offer-receipt extension, the commands to reproduce it, the limits of the number, and a live endpoint that does sign one
- [Nine ways to fake a delivery claim](https://tokenizen.nl/notes/nine-ways-to-fake-a-delivery-claim): nine independent designs for making buyer-signed claims harder to fake, each built and broken against the real code, and the structural reason none of them fully worked
- [The Hierarchy of Agent Trust](https://tokenizen.nl/notes/the-hierarchy-of-agent-trust): a plain-language story explaining why capacity-attest stops at evidence and deliberately never becomes a score or a judge
- [Eight security signals in 109 public repositories of organisations in ten EU countries](https://tokenizen.nl/notes/eight-security-signals-109-repositories): eight security signals measured on 109 public repositories with a release, how often each is visible, how we checked our own tool and what the numbers do not say
- [The same 40 reports, five different counts](https://tokenizen.nl/notes/same-reports-different-judges): Azimuth's 40 published EVMbench reports judged by two free models, 55 to 84 percent depending on the judge against 86 in their own count, what that does and does not say, and where every verdict can be checked.

## How to use it

It is a Model Context Protocol server with two tools. `record_delivery` takes an already-signed delivery claim and appends it to the ledger, rejecting invalid signatures and duplicates. `get_delivery_history` takes a seller address and returns that seller's raw claims in chronological order, with no summary or score. Run it over stdio, for example via `npx capacity-attest`.

The claim is signed by the buyer, not the seller, because the buyer is the party that knows whether the thing arrived. Signatures are EIP-191 personal-sign over a content-addressed claim id, verifiable offline with any standard Ethereum library.

## Contact

info@tokenizen.nl