# MASSAT Agent Security Audit

> MASSAT Agent Security Audit is a paid API for AI agents from api.craigmbrown.com, paid per call via x402, $5/call, status unknown (last checked 2026-10-13).

Runs an independent multi-agent OWASP ASI01-ASI10 security audit on a counterparty agent or MCP server, returning signed Merkle-committed findings before you grant it tool access or spend authority.

## Facts

- Endpoint: POST https://api.craigmbrown.com/v1/services/security.massat-audit?utm_source=zero.xyz
- Price: $5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/massat-agent-security-audit-c651b944
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_x7fRyGpxMUWBtcAR46vY0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability massat-agent-security-audit-c651b944 -d '<json body>'
```

Example prompt: Before I connect the FinanceBot MCP server to my wallet agent, run a full OWASP ASI01-ASI10 security audit on it — use its manifest and declared tools — and give me a signed risk report with any findings and remediation steps.

## When to prefer this

Choose this endpoint when you need an independent, cryptographically verifiable security assessment of a counterparty agent or MCP server before granting it any tool access or financial authority — especially when OWASP ASI01-ASI10 compliance coverage and a tamper-evident signed audit trail are required. Prefer this over generic reputation checks or self-attested agent metadata when the stakes involve spend authority or sensitive tool permissions.

## Known failure modes

- insufficient_subject: returned when the submitted manifest/artifacts/capabilities do not provide enough information to complete the audit
- input_blocked: returned when the target input is flagged as invalid or unsafe to process
- Missing required fields (target or subject) may result in a 400-level error
- Network or provider downtime may cause timeouts
- Partial manifests may result in incomplete ASI coverage with lower confidence findings

## How this service works

Independent multi-agent security audit (OWASP ASI01-ASI10 coverage) of a counterparty agent or MCP server before you grant it tool access or spend authority. Findings are Merkle-committed and the audit report is signed.

## Output

A JSON object containing: a status (completed, insufficient_subject, or input_blocked), a unique proof_of_audit_id, a Merkle root and audit hash for tamper-evidence, a numeric risk_score and categorical risk_level, an array of findings each tagged with OWASP ASI category (ASI01-ASI10), severity, detail, and remediation advice, a result_summary, evidence_class, score_semantics, and powered_by (BlindOracle). Optionally includes credentials and next_step guidance.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "owner": {
   "type": "string"
  },
  "scope": {
   "enum": [
    "quick",
    "full"
   ],
   "type": "string",
   "default": "full"
  },
  "anchor": {
   "type": "boolean",
   "default": false
  },
  "target": {
   "type": "string"
  },
  "subject": {
   "type": "object",
   "properties": {
    "manifest": {
     "type": "object"
    },
    "artifacts": {
     "type": "object"
    },
    "capabilities": {
     "type": "array"
    },
    "declared_tools": {
     "type": "string"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/massat-agent-security-audit-c651b944/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.craigmbrown.com](https://www.zero.xyz/host/api.craigmbrown.com/llms.txt)