# Agent/MCP Release Security Audit

POST https://playbrightgaming.com/agent-services-mainnet/agent-release-security-audit

Testnet: POST https://playbrightgaming.com/agent-services/agent-release-security-audit

Free metadata: https://playbrightgaming.com/agent-services-mainnet/agent-release-security-audit/service-info

Price: **$0.004 USDC (4,000 atomic)** using x402 v2 exact on Base mainnet eip155:8453. Base Sepolia uses test-USDC at the same atomic amount. Runtime HTTP 402 terms are authoritative.

## What it does

Runs a deterministic offline release-risk review over a caller-submitted UTF-8 text bundle. The accepted scope covers 16 rule families across JavaScript and Python dependencies, GitHub Actions, MCP/agent permissions, Docker, OpenAPI, secret-bearing release files, and public discovery configuration.

Each finding carries deterministic evidence including rule id, surface, severity, remediation, submitted path and line, submitted-file SHA-256, and a bounded excerpt. Output is capped at 200 findings.

## Billing

Completed in-scope PASS, WARN, FAIL, and INCONCLUSIVE reports are chargeable after validated durable retention. INVALID_INPUT, UNSUPPORTED_INPUT, LIMIT_EXCEEDED, INTERNAL_ERROR, TIMEOUT, transport, storage, and delivery failures are no-charge.

## Offline boundaries

Input is submitted text only. The service does not fetch repositories or URLs, query live advisory databases, execute submitted code, run a sandbox, analyze binaries, or perform expert/LLM deep review.

It does not claim penetration testing, exploit-absence proof, malware clearance, security certification, runtime-behavior proof, complete dependency-vulnerability coverage, prompt-injection immunity, supply-chain provenance attestation, live advisory intelligence, or signed attestation.

## Durable qualification

Historical launch qualification at the former $0.10 price used exactly one Base-Sepolia test-USDC authorization for 100,000 atomic. This historical proof does not represent the current 4,000-atomic price. The first buyer received HTTP 200 PASS; independent chain verification found exactly one authorization event and one matching transfer. A byte-identical replay returned the same order and response body with no second payment response, settlement, authorization, or audit execution. This is testnet qualification, not a funded mainnet purchase.

OpenAPI: https://playbrightgaming.com/openapi.json
Catalog: https://playbrightgaming.com/agents/services.json


## Runnable input and delivery contract

- [Illustrative JSON request](https://playbrightgaming.com/agents/examples/agent-release-security-audit.request.json)
- [Input schema](https://playbrightgaming.com/agents/schemas/agent-release-security-audit.input.schema.json) and [output schema](https://playbrightgaming.com/agents/schemas/agent-release-security-audit.output.schema.json)
- [Illustrative output shape](https://playbrightgaming.com/agents/examples/agent-release-security-audit.response.json) (not a current observation or promised verdict)
- [Unsigned all-service inspection helper](https://playbrightgaming.com/agents/pennybot-inspect.mjs)
- [Buyer quickstart](https://playbrightgaming.com/agents/buyer-quickstart.md)
- [Exact replay, recovery and private-key handling](https://playbrightgaming.com/agents/delivery-recovery.md)

Retain the original request bytes, signed authorization and private Idempotency-Key before purchase. Replay returns the original result and truthful settlement state without another execution/settlement; it emits no second PAYMENT-RESPONSE. Durable storage does not guarantee indefinite retention, fresh evidence on replay, or automatic resolution of every incident.