# Algernon – A B2B compliance and security oracle for AI agents on Base via x402

> Source: <https://github.com/tobiaslofton/algernon-x402-oracle>
> Published: 2026-10-24 00:26:14+00:00

An autonomous **HTTP 402 ("Payment Required")** API that provides B2B Trust Center, SOC 2 compliance, and DNS deliverability audits to AI agents, payable micro-per-call in **USDC on Base (EIP-155:8453)**.

Autonomous agents performing research, due diligence, or lead qualification need to verify vendor security (SOC 2, ISO 27001, sub-processors, email authentication) without:

- Stalling for a human credit card or monthly SaaS subscription.
- Solving CAPTCHAs.
- Navigating closed Web2 billing dashboards.

With **x402**, the agent calls the API, receives a machine-readable `402 Payment Required` challenge, signs a 5-cent USDC payment via its on-chain wallet on Base, and receives the verified audit dossier in under 500ms.

- **Endpoint:**`GET /.well-known/x402.json`
- **Output:**

```
{
  "version": "1.0",
  "recipient": "0x6398B23C1e7E0aB1bFB12F50702de61749D40F46",
  "supported_networks": ["eip155:8453"],
  "accepted_tokens": [
    {
      "symbol": "USDC",
      "contract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "chain": "base"
    }
  ],
  "routes": {
    "GET /v1/audit": {
      "price": "0.05",
      "currency": "USDC",
      "description": "Full B2B Trust Center, SOC 2 compliance, and email authentication audit for any company domain."
    }
  }
}
```

When an agent calls `GET /v1/audit?domain=vanta.com` without payment:

- **Status:**`402 Payment Required`
- **Headers:**  - `X-402-Network` :`eip155:8453` (Base)
  - `X-402-Token` :`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` (USDC)
  - `X-402-Amount` :`0.05`
  - `X-402-Recipient` :`0x6398B23C1e7E0aB1bFB12F50702de61749D40F46`

The agent attaches its signed proof in the `X-Payment-Proof` header and retries:

- **Status:**`200 OK`

```
{
  "domain": "vanta.com",
  "trust_score": 100,
  "risk_tier": "LOW RISK (Enterprise Ready)",
  "trust_center_platform": "Vanta",
  "trust_center_url": "https://trust.vanta.com",
  "certifications": [
    "CCPA / CPRA",
    "FedRAMP",
    "GDPR",
    "HIPAA",
    "ISO 27001",
    "ISO 42001 (AI)",
    "NIST CSF / 800-53",
    "PCI-DSS",
    "SOC 2 Type II"
  ],
  "subprocessors": [
    "Amazon Web Services (AWS)",
    "Datadog",
    "HubSpot",
    "Intercom",
    "Okta",
    "OpenAI",
    "Snowflake"
  ],
  "identity_providers": [
    "Atlassian Cloud",
    "Google Workspace",
    "Microsoft Entra ID / M365",
    "Slack Enterprise"
  ],
  "spf_enabled": true,
  "dmarc_enabled": true,
  "status_page_indicator": "NONE (All Systems Operational)",
  "grc_summary": "vanta.com operates a Vanta trust posture (Score: 100/100)..."
}
```

Run the test client to simulate the full unauthenticated challenge -> paid unlock loop:

```
python test_agent.py
```