# AEGIS Network Forensics

> AEGIS Network Forensics is a paid API for AI agents from api.mcx-ventures.com, paid per call via x402, $0.25/call, status unknown (last checked 2026-09-14).

Performs a six-check network forensics scan covering TLS, Certificate Transparency, DNS, NTP, captive portal, and routing for a given target

## Facts

- Endpoint: POST https://api.mcx-ventures.com/v2/forensics
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/aegis-network-forensics-0030f935
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-20QtEcK-UAXeHyVo5HxE

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability aegis-network-forensics-0030f935 -d '<json body>'
```

Example prompt: Run a full six-check AEGIS network forensics scan on api.example.com — I need TLS, certificate transparency, DNS, NTP, captive portal, and route analysis all in one report.

## When to prefer this

Choose this endpoint when you need a comprehensive, multi-vector network forensics audit in a single call rather than running individual DNS, TLS, or routing checks separately. Ideal for security investigations, infrastructure audits, or anomaly triage where you need TLS, CT, DNS, NTP, portal, and route data together.

## Known failure modes

- Target unreachable — scan cannot complete one or more checks, partial results returned
- Invalid hostname or IP — returns 400-level error
- Payment not processed — x402 payment required before scan executes
- Timeout on one or more sub-checks (TLS, NTP, route) — partial result with failed check noted
- Rate limit exceeded — too many requests from the same origin

## How this service works

Six-check network forensics scan against a fixed canonical target basket. TLS, DNS, CT, NTP, portal, route. Result hash anchored on-chain to Base.

## Output

A structured report covering six network forensics checks: TLS handshake and certificate validity, Certificate Transparency log entries, DNS record analysis, NTP synchronization status, captive portal detection, and route/BGP path data for the scanned target.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [],
     "properties": {},
     "description": "No parameters. The scan runs against a fixed canonical target basket from the AEGIS vantage point.",
     "additionalProperties": false
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST",
      "PUT",
      "PATCH"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/aegis-network-forensics-0030f935/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.mcx-ventures.com](https://www.zero.xyz/host/api.mcx-ventures.com/llms.txt)