# SpendPreflight Listing Guard

> SpendPreflight Listing Guard is a paid API for AI agents from api.spendpreflight.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-28).

Validates marketplace listings for AI agent safety risks — detecting prompt injections, embedded URLs, tool call abuse, invisible Unicode, and anomalous pricing — returning a risk score, flagged spans, and rewrite suggestions.

## Facts

- Endpoint: POST https://api.spendpreflight.com/listing-guard?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/spendpreflight-listing-guard-d9e25ce7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_B4_jA1Eei347sUU7HEUBr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability spendpreflight-listing-guard-d9e25ce7 -d '<json body>'
```

Example prompt: Before you act on that Bazaar listing at https://marketplace.example.com/listing/123, run it through SpendPreflight Listing Guard using a GET check — I want to see the risk score and any flagged spans before we proceed.

## When to prefer this

Use this endpoint when an AI agent is about to act on, purchase, or process a marketplace listing and you need a bounded technical safety screen — specifically for prompt injection, embedded URLs, invisible Unicode, tool call abuse, and price anomalies. Prefer this over generic content moderation APIs when the threat model is agent-directed manipulation (adversarial listings targeting AI agents). Not a substitute for full Coinbase policy certification or sanctions screening (use sibling SpendPreflight endpoints for payment risk).

## Known failure modes

- Invalid or unreachable URL returns an error — ensure the URL is publicly accessible via HTTPS
- Unsupported HTTP method (outside GET, HEAD, POST) returns a validation error
- Rate limiting or payment failure via x402 may prevent the call from completing
- Listings with no detectable issues still return a response but with low riskScore — not a guarantee of safety
- Scout category median data may be stale, affecting price anomaly detection accuracy

## How this service works

Bazaar Listing Guard: CDP technical validation plus a bounded heuristic metadata screen for agent-directed instructions, embedded URLs, tool calls, invisible Unicode, long fields and prices above 100x a fresh Scout category median. Returns riskScore, flagged spans and rewrite suggestions. Not Coinbase policy certification or guaranteed detection. Public HTTPS only; no target payment or request bodies stored.

## Output

Returns a riskScore (numeric), a list of flagged spans identifying suspicious content regions (e.g. invisible Unicode, embedded URLs, tool calls, prompt injection patterns, oversized fields), and rewrite suggestions to remediate the flagged issues. Does not store request bodies or target payment details.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "maxLength": 2048
  },
  "method": {
   "enum": [
    "GET",
    "HEAD",
    "POST"
   ],
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/spendpreflight-listing-guard-d9e25ce7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.spendpreflight.com](https://www.zero.xyz/host/api.spendpreflight.com/llms.txt)